A fixed IP SIM is a mobile data SIM whose IP address does not change, historically used to reach field equipment directly over the cellular network. The term is still searched for, but what it means has split apart. A fixed IP can be public (routable from the internet) or private (reachable only through a VPN), and since carrier-grade NAT became standard on mobile networks, an ordinary data SIM no longer gives you either. This page explains what changed, what the terminology means now, and how remote access is actually done today.
What a fixed IP SIM is, and why the term causes confusion
At its simplest, a fixed IP SIM is a SIM that keeps the same IP address every time the device connects, rather than being handed a different one each session. That much has not changed. What has changed is the assumption that used to sit underneath the phrase: that a fixed IP also meant a publicly routable IP you could reach from anywhere on the internet.
For years those two ideas travelled together. Today they do not. A fixed IP SIM might give you a static public address, or a static private address that is only reachable across a VPN, and the difference decides whether you can connect to your device at all. That is why the same search term now covers several quite different products, and why buyers so often end up with the wrong one.
The good old days: direct remote access over cellular
In the 2G, 3G and early 4G era, getting remote access to a piece of field equipment was refreshingly simple. You put a data SIM in a router, the mobile operator handed it a public, routable IP address, and that address was reachable from the internet. If the IP was static, you could point your management tools straight at it.
From there it was ordinary networking. You used the router's port forwarding to expose the web interface of a CCTV recorder, a PLC, a digital signage player or a remote PC, and you connected in from the office as if the device were on a normal fixed line. No VPN server to run, no tunnelling software, no cloud middleman. A fixed public IP SIM and a router with port forwarding was the whole solution, and for a long time it worked well.
The device held a real, internet-routable address. Anything on the internet could initiate a connection to it. Remote access was just a matter of pointing at the right IP and opening the right port.
What changed: IPv4 ran out and CGNAT took over
The internet addressing scheme that underpinned all of this, IPv4, has only about 4.3 billion addresses. That once seemed limitless. It is not. The regional registries handed out their last blocks one by one, and the RIPE NCC, which serves Europe, the Middle East and Central Asia, made its final allocation and ran out of fresh IPv4 addresses on 25 November 2019. Its own announcement pointed to the consequence directly: with no addresses left, operators leaned harder on carrier-grade NAT.
Carrier-grade NAT, also called CGNAT or large-scale NAT, is how a mobile network now connects millions of subscribers while owning only a limited pool of public addresses. Instead of giving every device its own public IP, the operator places devices behind a shared translation layer and hands them private addresses, either the familiar RFC 1918 ranges or the dedicated shared space set aside for this purpose. Your device can still reach out to the internet, because outbound connections are translated on the way. But nothing on the internet can reach in, because from the outside your device has no address of its own.
Behind CGNAT, port forwarding to your router from the internet simply stops working, because you no longer hold a public address to forward to. This is the single change that broke the old fixed IP SIM workflow, and it is why a cheap consumer data SIM will never give you inbound remote access no matter how the router is configured.
A genuine public IP became something an operator or connectivity provider had to allocate deliberately, usually as a paid add-on on a specific APN, drawing on an increasingly scarce and valuable pool of IPv4 addresses. The fixed public IP SIM did not disappear. It became a specialist product rather than the default.
The terminology maze, decoded
Because the technology fragmented, so did the language. These are the terms you will encounter, and what each one actually means today.
| Term | What it usually means now | Reachable from the internet? |
|---|---|---|
| Standard data SIM | Dynamic private address behind CGNAT | No |
| Fixed / static IP SIM | An address that does not change, public or private | Depends which |
| Public IP SIM | A routable public address, usually static | Yes, directly |
| Private IP SIM / private APN | A fixed private address on a private network | Only across a VPN |
The trap is the word fixed. It tells you the address is stable, but not whether it is public or private, and that second question is the one that decides whether you can actually connect. If someone offers you a fixed IP SIM, the useful question is not is it fixed but is it public or private, and how am I expected to reach it. For the full technical comparison of the two addressing models, see our guide to private versus public IP for cellular IoT.
How remote access is actually done today
The important shift is that a public IP is no longer the only way, or even the usual way, to reach a remote device. There are five common approaches, and the right one depends on what you are actually trying to do.
| Approach | How access works | Needs a public IP? | Best for |
|---|---|---|---|
| Public / static IP SIM | Direct inbound plus port forwarding | Yes | Legacy kit, IP passthrough, arbitrary inbound |
| Private APN plus VPN | Site-to-site VPN into your network | No | Fleets and secure enterprise access |
| VPN overlay / tunnel | Device dials out to a rendezvous point | No | Most modern remote access over CGNAT |
| Vendor remote management | Reverse tunnel via the vendor cloud | No | Quick router interface and CLI access |
| IPv6 | Global address if operator and firewall allow | No (IPv4) | Forward-looking, still patchy |
Private APN and VPN
The enterprise standard. The SIM sits on a private APN, the device gets a known, fixed private address, and a site-to-site VPN links that private network back to yours. Nothing is exposed to the public internet, access is centralised, and it scales cleanly to large fleets. It is more to set up than a single public IP SIM, but far safer and more manageable at scale.
VPN overlays and reverse tunnels
The modern default for most remote-access needs. Because the device makes an outbound connection to a coordination server or a peer, it works straight through CGNAT without any public address at all. Tools such as WireGuard and OpenVPN, mesh overlays, and the remote management platforms built into routers from vendors like Teltonika all use this pattern. For simply reaching a device to manage it, this is usually the cleanest answer in 2026.
Where a public IP SIM still earns its place
The public IP SIM has not become obsolete. It remains the clean solution when something on the internet, rather than the device, has to start the connection: certain CCTV and DVR setups, some legacy or industrial protocols that assume a reachable endpoint, and IP passthrough, where a router hands the public address straight to an office firewall to provide wired-line failover. In those cases a static public IP SIM is still the right tool.
A public IP SIM puts the device directly on the open internet, where it will be scanned within minutes. It must be hardened: no default passwords, a tight firewall, only the necessary ports exposed, and ideally a VPN layered on top even when a public IP is present. Convenience of access is not a substitute for securing the endpoint.
So do you still need a fixed IP SIM?
Often the honest answer is that you need remote access, not a public IP, and the two are no longer the same thing. Start from what you are trying to achieve:
- If you just need to reach a device to configure or monitor it, a VPN overlay or a vendor remote management platform does the job over CGNAT, with no public IP and no device left exposed.
- If a fleet needs secure, central access, a private APN with a VPN is the model that scales.
- If something on the internet must initiate the connection, or you need IP passthrough for office failover, a static public IP SIM is still the right choice, provided the endpoint is properly secured.
The phrase fixed IP SIM has survived a decade of change because the underlying need, reaching equipment that is not on your own network, has never gone away. What has changed is that there is now more than one good way to meet it, and the cheapest label is rarely the one that tells you which you need. Decide what has to reach what, and the right connectivity choice follows from there.
Fixed does not mean reachable. Ask whether you need a public address or simply a way in, secure the endpoint either way, and choose the option that matches how the connection has to be made.