You have done the right thing. You have moved the business off a residential NBN plan and signed up for a proper "business" internet service. The sales rep confirmed it was business-grade. So why, six months later, when you try to connect to the office from home or set up a VPN server, does everything fail?
For many Australian businesses, the answer is three letters: CGNAT.
A surprising number of NBN plans marketed to businesses still put customers behind Carrier-Grade NAT — a technology that makes your connection behave as though you do not have a public IP address at all. The consequences only become apparent when you actually need remote access, a VPN endpoint, or IP whitelisting. By that point, you are mid-project and well and truly locked in.
This article explains what a static IP is, what CGNAT is and why it matters, the six business scenarios where a static or public IP is genuinely necessary, and how to check right now whether your current plan is actually giving you one.
Static IP vs Dynamic IP: The Plain-English Version
Every device connected to the internet uses an IP address — a numerical label that tells routers where to send data. When your router connects to your ISP, it gets assigned one of these addresses.
With a dynamic IP, that address changes. It might change every time your router reboots, every 24 hours, or on some other schedule your ISP controls. For outbound activity — browsing, sending emails, using cloud apps — this rarely causes any problem.
With a static IP, your connection always gets the same address. It does not change between reboots or across billing periods. Your business has a permanent, known, reachable point on the internet.
The distinction matters the moment anyone or anything outside your network needs to initiate a connection to you.
What Is CGNAT — and Why Is It a Problem for Businesses?
Carrier-Grade NAT (CGNAT) is a technique ISPs use to stretch a limited pool of public IP addresses across a large number of customers. Instead of giving each customer a unique public IP, the ISP assigns private addresses — you may see your router's WAN IP in the 100.64.x.x range, which is the giveaway — and routes all traffic through a shared public address.
For residential customers streaming video or scrolling social media, CGNAT is largely invisible. Everything is outbound. It works.
For businesses, CGNAT is a wall.
When your office sits behind CGNAT, there is no way for an external device to initiate a connection to you. Inbound traffic cannot find you. This means you cannot run a VPN server at the office, remote access to office systems fails, you cannot host any service others need to reach, and IP whitelisting with a stable address is impossible.
The genuinely troubling part is that many ISPs apply CGNAT to products they label as "business" plans without disclosing it clearly. You assume you have a proper public IP because you are paying business prices. You may not.
The Six Use Cases Where a Static or Public IP Is Essential
1. Running a VPN Server at the Office
If your team connects back to the office network from home or while travelling — using a solution like WireGuard or OpenVPN — your office router needs to be reachable from the internet. That requires either a static IP or a reliable public IP paired with DDNS. Behind CGNAT, this is simply not possible without complex and unreliable workarounds. See Pickle's WireGuard VPN guide for Australian businesses for a full walkthrough once you have a public IP in place.
2. Remote Access to Office Systems
Accessing a file server, NAS, office desktop, or on-premises application from outside the office requires a stable, reachable address for your network. A static IP is the cleanest solution. A dynamic public IP paired with managed DDNS is a workable alternative — provided the DDNS record updates automatically whenever the IP changes, which Pickle handles on its Fixed Wireless product.
3. VoIP Phone Systems with SIP Trunking
Many SIP trunk providers and some hosted phone systems require your office's public IP address to be whitelisted at their platform before they will accept calls from you. A static IP gives you a permanent address to provide once and leave unchanged. With a dynamic IP, that address can shift — and suddenly your phones stop working until you update the whitelist. For a broader look at business VoIP, the Pickle VoIP business guide covers this in full.
4. IP Whitelisting for Enterprise Platforms
Banking portals, government procurement systems, and enterprise SaaS platforms increasingly offer IP-based access controls — login attempts are blocked unless they originate from a pre-approved address. A static IP makes this access control permanent and reliable. A dynamic IP makes it fragile: every time your IP rotates, access breaks until you update the whitelist, which may require a support request and a waiting period.
5. Hosting Applications or Services
Businesses that self-host web applications, internal tools, APIs, or file-sharing services need a stable address that clients and systems can reach. A static IP is the standard approach here. DDNS can substitute for lower-stakes internal tools, but for anything customer-facing or operationally critical, a static IP is strongly preferred.
6. Remote Access to Security Cameras and NVRs
CCTV systems and network video recorders accessible from outside the premises require a reachable public IP. Without one — or without automatic DDNS — you are left manually updating records whenever your IP changes, which is easy to forget and creates gaps in access. A static IP or managed DDNS (as Pickle provides on Fixed Wireless) keeps your camera system reliably reachable.
What You Do NOT Need a Static IP For
To be clear: most everyday business internet activity works perfectly well without a static IP.
General web browsing, Microsoft 365, Google Workspace, Zoom, Teams, and virtually all cloud-hosted SaaS applications are outbound-initiated connections. Your IP address is irrelevant to them. Modern cloud-hosted phone systems (UCaaS platforms) also do not require your office to have a static IP — the cloud handles call routing without caring where you are connecting from.
If your business activity is purely outbound — consuming cloud services rather than hosting anything or enabling inbound connections — a static IP is a nice-to-have rather than a necessity.
What Pickle Includes as Standard
This is where a lot of business NBN plans fall short, and where Pickle is deliberately different.
Business Broadband (NBN): Every Pickle Business Broadband plan includes a static IP address as standard. There is no CGNAT, no upgrade fee, and no ambiguity — your connection gets a real, static, public IP from day one.
Enterprise Ethernet: Static IP is included, with the option for routed IP subnets and BGP routing for businesses with more complex network requirements. This is the right product for multi-site businesses or those running substantial on-premises infrastructure.
Fixed Wireless (Gen 3): Pickle's Fixed Wireless product assigns a public IP address plus access to Pickle's own DDNS server. Even though the public IP may not be fully static, the DDNS hostname always resolves to the current IP — so VPN connectivity, remote access, and inbound connections work reliably without manual intervention.
You can review all of Pickle's business internet products — including static IPs and DDNS — on the product page.
DDNS vs a Fully Static IP: When Is Each the Right Call?
Dynamic DNS (DDNS) is a system that automatically updates a hostname record whenever your IP address changes. Instead of connecting to a fixed IP address, you connect to a hostname (for example, youroffice.example.com.au) that always points to wherever your current IP happens to be.
DDNS closes most of the gap between dynamic and static IPs for remote access and VPN use cases. Pickle's managed DDNS on Fixed Wireless means the update happens automatically — you do not need a script or a third-party service.
However, DDNS is not a complete substitute in every scenario.
IP whitelisting requires a static IP. A hostname is not accepted by most banking or enterprise platforms — they want a specific IP address. If yours changes, the whitelist breaks.
Propagation delay means there can be a brief window after an IP change when the DDNS record has not fully updated. For most businesses, this is seconds to minutes and inconsequential. For operationally critical uptime, a static IP eliminates this variable entirely.
Hosting public-facing services is more reliably done with a static IP, particularly where third-party systems need to connect to you on a schedule.
For remote workers connecting to the office, DDNS is excellent. For IP whitelisting, static is required.
How to Check Whether You Are Behind CGNAT Right Now
This takes two minutes.
- Visit a site like whatismyip.com from a device connected to your business internet. Note the IP address shown.
- Log in to your router's admin interface (typically 192.168.1.1 or 192.168.0.1). Find the WAN IP address — the IP your router received from your ISP.
- Compare the two.
If they match, you have a real public IP. If they differ — and particularly if your router's WAN IP starts with 100.64 — you are behind CGNAT, and your connection does not have a reachable public address.
If that is the situation you find yourself in, it is worth having a conversation with your ISP — or switching to a provider whose business plans are genuinely built for business requirements.
Frequently Asked Questions
Q: Does every business need a static IP?
A: No. If your business only uses outbound cloud services — email, Microsoft 365, video calls, SaaS applications — a static IP is useful but not essential. You need one (or at minimum a public IP with DDNS) as soon as you need remote access to office systems, a VPN server, IP whitelisting, or any inbound connection from outside your network.
Q: I'm on a business NBN plan already — am I behind CGNAT?
A: Not necessarily, but it depends entirely on your provider. Use the two-step check above (compare your public-facing IP to your router's WAN IP) to find out. Many ISPs apply CGNAT across their business tiers without making this explicit in the product description.
Q: Is a static IP the same as a dedicated IP?
A: In the NBN context, yes — these terms are generally used interchangeably to mean an IP address assigned exclusively and permanently to your connection. A genuinely static IP is one that does not change under any normal operating condition.
Q: Can I use DDNS instead of a static IP for VPN?
A: Yes, in most cases. WireGuard and OpenVPN both support hostnames as the endpoint, so a managed DDNS hostname works well. The caveat is that if your IP changes and the VPN is mid-session, the session will drop and need to reconnect. For most businesses, this is acceptable. For operationally sensitive connections, a static IP is cleaner.
Q: What if I need multiple static IPs or a subnet?
A: Pickle's Enterprise Ethernet product supports routed IP subnets — meaning you can have a range of static IPs assigned to your connection, useful for businesses running multiple servers or segmented networks. BGP routing is also available for more advanced requirements. Contact the team to discuss your specific infrastructure needs.
Is Your Business Internet Actually Built for Business?
The static IP question is a useful litmus test. If your "business" internet plan puts you behind CGNAT, it is not genuinely business-grade — it is a residential plan with a business price tag.
Pickle's Business Broadband includes a static IP as standard, with no CGNAT and no add-on fees. Fixed Wireless includes a public IP plus managed DDNS. Enterprise Ethernet supports static IPs, subnets, and BGP. Every product is designed around what a business actually needs from its internet connection.
If you are not sure what you are currently on, or you want to move to a plan that gives you full control over your connectivity, the team is ready to help.
Call 1300 688 588, email [email protected], or visit the Pickle business internet products page to review your options.