Fixed IP SIMMillbeck Communications

01937 534915 Ask for a quote

What Is a Fixed IP SIM Card? The Complete Guide

Everything you need to know about fixed IP SIM cards, from why a normal SIM cannot be reached to choosing between public and private addresses and securing a router properly.

The short answer

A fixed IP SIM card is a mobile data SIM that gets the same IP address every time it connects. That permanent address lets you find and connect to the router or device from elsewhere, which an ordinary mobile SIM does not allow.

Why a normal SIM cannot be reached

There are not enough public IPv4 addresses for every phone and device. Mobile networks deal with this using carrier-grade NAT, or CGNAT. Thousands of SIMs share a pool of public addresses, and each SIM gets a private address, often in the 100.64.0.0/10 range, that changes over time.

Outbound traffic works perfectly: your device can browse, upload and connect to cloud services. Inbound traffic does not. When you try to connect to the device from outside, the network has no way of knowing which of the thousands of SIMs behind that shared address you want. The connection fails.

How a fixed IP SIM fixes it

A fixed IP SIM connects through a special APN, the gateway name you type into the router. That APN gives the SIM its own address, reserved just for it. There are two kinds.

Fixed public IP

The SIM receives its own public internet address, for example 203.0.113.24. Anyone on the internet can send traffic to that address, and the router decides what to allow. This is what makes port forwarding, remote desktop, camera apps and incoming VPNs work.

Fixed private IP

The SIM receives a permanent private address, for example 10.20.0.11, on a private APN. The address cannot be reached from the internet at all. You connect your office or data centre to the private network over a VPN, then reach every SIM by its address. See private fixed IP SIM cards.

Setting up a router with a fixed IP SIM

  1. Insert the SIM with the router powered off.
  2. Set the APN and any username and password we supply, in the router’s mobile settings.
  3. Check the WAN address on the router status page. It should match the fixed IP on your SIM record.
  4. Change the router’s admin password and turn off remote web access on the default port, or restrict it to your office address.
  5. Add firewall and port forward rules for the services you need, limited to known source addresses where possible.
  6. Test from outside using a different internet connection, such as a phone on another network.

Securing a public fixed IP

A device on a public address will be scanned by automated tools within minutes of connecting. That is normal, and a correctly configured router shrugs it off. The essentials:

  • Never leave default passwords on the router or on the devices behind it.
  • Only open the ports you need, and allow them only from your own addresses where you can.
  • Prefer a VPN over exposing device web pages directly.
  • Keep router firmware up to date, ideally with a remote management platform.
  • Turn off services you do not use, such as Telnet, UPnP and unused remote management.

Alternatives to a fixed IP SIM

Approach How it works Drawbacks
Dynamic DNS A name that tracks a changing address Does not work behind CGNAT, so fails on most standard SIMs
Cloud remote access The device dials out to a vendor cloud that relays your connection Depends on a third party service, may carry a subscription, not every device supports it
Outbound VPN The router builds a tunnel to your own VPN server Needs a server with a fixed address and some setup, but works well
Fixed IP SIM The SIM itself has a permanent address Public addresses need a well configured firewall

Choosing your SIM and network

Start with how you will reach the device: public for simple direct access, private for closed and larger estates. Then decide how resilient the connection must be: a single network SIM for proven strong sites, a multi network SIM for unknown or critical sites, and a dual SIM router with two network groups for the highest resilience. Remember that the UK now has three network groups, EE, O2 and VodafoneThree, after the Vodafone and Three merger.

Glossary

APN
Access Point Name. The gateway a SIM connects through, which decides the type of IP address it receives.
CGNAT
Carrier-grade NAT. Sharing one public address between many users, which blocks inbound connections.
eUICC
The technical name for an eSIM that can hold and download several operator profiles.
IMSI
International Mobile Subscriber Identity. The number that identifies a SIM and its home network.
LTE-M
A low power 4G technology for mobile IoT devices such as trackers and alarms.
MOCN
Multi-operator core network. A shared radio network connected to more than one operator core, used by VodafoneThree.
Multi-IMSI
A SIM holding several IMSIs, switching between them to use different home networks.
NB-IoT
Narrowband IoT. A very low power 4G technology for fixed sensors and meters.
Port forwarding
A router rule that passes inbound traffic on a chosen port to a device behind the router.
Private APN
An APN that connects SIMs to a closed private network rather than the internet.

Questions we are often asked

Why does my SIM show a 100.x.x.x address?

That is a carrier-grade NAT address from the 100.64.0.0/10 range. It means the SIM is sharing a public address and cannot receive inbound connections. A fixed IP SIM solves this.

Is a fixed IP SIM safe?

A private fixed IP is not visible on the internet. A public fixed IP is safe when the router is configured properly with strong passwords, limited open ports and a firewall.

Can I use dynamic DNS instead?

Not on most mobile SIMs. Dynamic DNS needs a public address to point at, and standard SIMs sit behind CGNAT.

Does a fixed IP SIM work in a phone?

It can, but fixed IP SIMs are data only and intended for routers and devices. They are not a replacement for a phone contract.