opwanRegister interest

Your own public IP, even behind CGNAT.

opwan gives your router or server a static public address over a tunnel, so inbound connections reach you. For home labs, self-hosted services, game servers and small offices whose internet comes with CGNAT or an address that keeps changing.

Register interestSee the planned pricing

Planned, not yet available. Tell us where you'd want your exit node, and we'll build there first.

Today, behind CGNAT
100.72.14.9Shared with your ISP's other customers. Connections from outside never reach you.
With opwan
203.0.113.24Yours alone, and it stays the same. Inbound connections arrive at your router.

Example addresses.

How it works

A tunnel out, an address back.

  1. Your router dials out

    It opens a tunnel to an opwan exit node. Dialling out works from behind CGNAT, and from whatever address your ISP gives you today.

  2. The exit node carries your address

    Your static IPv4 address and your IPv6 prefix are routed to the exit node, and from there down your tunnel.

  3. Connections come home

    Anyone who connects to your address, on any port, reaches your router through the tunnel. Your replies go back the same way.

How opwan works: a tunnel out, an address backYour router or server, inside your network, opens a WireGuard or L2TP tunnel out through your ISP, which uses CGNAT or gives you an address that changes. The tunnel ends at an opwan exit node, which carries your static address, for example 203.0.113.24, and your IPv6 prefix. Anyone on the internet connects to that address on any port; the exit node sends the connection down the tunnel to you. Without opwan, those inbound connections stop at your ISP.Your networkYour router or serverMikroTik, OpenWrt, pfSense,OPNsense or LinuxYour ISPCGNAT, or an address that changeswithout opwan, inbound connections stop at your ISPWireGuard or L2TP tunnelopened from your sideopwan exit node203.0.113.24and your IPv6 prefixany portThe internetvisitors, players,your phoneHow opwan works: a tunnel out, an address backYour router or server, inside your network, opens a WireGuard or L2TP tunnel out through your ISP, which uses CGNAT or gives you an address that changes. The tunnel ends at an opwan exit node, which carries your static address, for example 203.0.113.24, and your IPv6 prefix. Anyone on the internet connects to that address on any port; the exit node sends the connection down the tunnel to you. Without opwan, those inbound connections stop at your ISP.The internetvisitors, players, phonesany portopwan exit node203.0.113.24and your IPv6 prefixwithout opwan, stops hereWireGuard or L2TPtunnel, openedfrom your sideYour ISPCGNAT, or anaddress that changesYour networkYour router or serverMikroTik, OpenWrt, pfSense,OPNsense or Linux
the tunnel and the exit node: what opwan addsinbound connectionAddresses are examples.

Routers and systems

Setup guides are planned for these. Anything else that speaks WireGuard or L2TP should work too, without a guide at first.

MikroTik RouterOS 7
WireGuard or L2TP
MikroTik RouterOS 6
L2TP
OpenWrt
WireGuard or L2TP
pfSense, OPNsense
WireGuard or L2TP
Linux
WireGuard or L2TP

Two protocols

WireGuard
Recommended. Encrypted, and the tunnel stays up when your home address changes.
L2TP
For routers without WireGuard. Not encrypted: your ISP sees the traffic, as it would without a tunnel.

Pricing

Planned pricing, in US dollars.

IPv4 + IPv6

$5–10 USD a month, planned

One static IPv4 address and a routed IPv6 prefix, on one tunnel.

What sets the price

The exact price, within that range, will depend on the exit location, the speed and the monthly data you choose. That's why the form below asks for all three.

Planned pricing, subject to change before launch. Applicable taxes extra.

Included

  • A static address that stays yours while you subscribe
  • Inbound connections on any port
  • A WireGuard or L2TP tunnel
  • The exit location you choose, among those open
  • Reverse DNS for your addresses planned

Not decided yet

  • Traffic allowance and speeds
  • The launch date
  • The exact price, within $5–10
  • Which cities open first: your answers decide

Not allowed

  • Sending spam or unsolicited bulk email
  • Running open proxies or open relays
  • Port scanning, or attacking other networks
  • Running a Tor exit node

The networks our exit nodes run on require these rules, and so do we. The full acceptable use policy comes with the launch.

Register interest

Where should your address live?

We'll open exit nodes where people ask for them. Three answers are enough: your email, your country and the cities you'd want. It's free, and it commits you to nothing.

Where you are

Speed you'd want optional

Not answered yet: move the slider or tick "Not sure".

Data through the tunnel in a month optional

Only traffic to and from your static address counts, not your whole connection: the rest of your internet use stays on your ISP, as today.

Not answered yet: move the slider or tick "Not sure".

Exit locations none chosen

Choose every city that would work for you. Closer to you, or to the people who connect to you, means less added latency.

Tell us more optional

These help us size the exit nodes and price them. Skip any you like.

How many static IPv4 addresses

Your connection today

What you would run behind it

Choose all that apply. A mail server needs reverse DNS and an address with a clean reputation; reverse DNS is planned.

Your answers are used only as the privacy details describe.

Questions

Before you register.

Why not just forward a port?

Port forwarding needs a public address on your router. Behind CGNAT, your router's outside address is private to your ISP (often in 100.64.0.0/10) and shared with other customers, so connections from the internet stop at your ISP and forwarding has nothing to forward.

With a dynamic address, forwarding works until the address changes. Dynamic DNS papers over that for names, not for anything that needs a fixed address, such as an allowlist or reverse DNS. opwan gives you an address that stays the same, wherever your connection comes from.

Is IPv6 included?

Yes. The planned offer is one: a static IPv4 address and a routed IPv6 prefix together, so you can be reached from networks that only have IPv4, as many game clients, mail servers and office networks still are, and over IPv6 with an address for every device.

WireGuard or L2TP?

WireGuard, if your router has it. It encrypts the tunnel, and it keeps the tunnel up when your home address changes.

L2TP is for routers without WireGuard, such as MikroTik RouterOS 6. It doesn't encrypt: between your router and the exit node, your ISP can see the traffic, as it could without a tunnel.

When does it launch?

There's no date yet. We're measuring interest first, and what we build follows the answers. Tick "Email me when opwan launches" in the form and you'll hear when it opens.

Can I choose my exit city?

Yes, among the locations that are open. Choose the one closest to you for the least added latency, or the one closest to the people who connect to you. Which cities open first depends on the answers to this form, so ask for the one you want.