Fibmesh Public IPs / Getting started
Start with the job.
Finish with a handover.
Bring one real service or destination. Agree how the address will reach it, prove the intended traffic paths and leave a clear recovery plan with the operator.
Prepare your first deployment Assisted setup guide · Confirm platform and deployment support during assisted setup.Available with assisted setup. Confirm the supported platform, serving location, inventory and traffic policy for your deployment.
01 / Your preparation brief
Bring the job.
Make the choices explicit.
A file server a partner must reach. An API that requires a fixed source address. Several workloads needing their own addresses.
Fibmesh confirms the supported deployment and terms before delivery.
Public IPs is available with assisted setup. Put the requirements in one brief so the allocation, routing and application can be considered together.
- Infrastructure
- Device or gateway model, operating system, site country, access provider and the operator who can change its configuration.
- Connections
- Incoming services, protocols and ports; permitted callers; outgoing destinations; and the traffic that should stay on the ISP.
- Allocation
- Dual-stack or IPv6-only for supported single targets. Separate IPv4 and IPv6 blocks for routed infrastructure. Include the required address count.
- Downstream plan
- For a gateway, record stable LAN target addresses and how selected outgoing traffic will reach it. For Routed Subnets, bring a downstream addressing plan.
- Service terms
- Agree available inventory, serving location, traffic allowance and price for the deployment. Confirm throughput, overages and support terms before setup.
02 / From request to working connection
Five steps.
A record at every stage.
Exact installation steps, supported software and platform-specific exceptions come with the confirmed deployment. Use this journey to keep the decisions and handover visible.
Agree the allocation.
Confirm the device or gateway, address family, serving location and reservation terms. The assigned address is independent of the access ISP, but remains tied to its agreed Fibmesh delivery location.
Keep: the allocation and reservation agreement.
Connect a supported target.
Use the confirmed Fibmesh client or gateway setup to establish a WireGuard tunnel over the existing internet connection. WireGuard is currently the supported tunnel; generic WireGuard capability alone does not establish Fibmesh support. A plain WireGuard profile is Compatibility Mode and does not supply every managed feature.
Keep: supported software, platform exceptions and deployment instructions.
Choose the traffic and rules.
Choose inbound access, selected outbound or full tunnel. Set incoming rules independently; full tunnel does not open inbound access. For a LAN gateway, configure forwarding and routing so the intended traffic actually passes through it. Simply plugging in an appliance does not redirect outgoing traffic.
Keep: caller, port, destination, source-address and return-route choices.
Prepare the application.
Set the listening address, permitted sources, host firewall and application authentication. For gateway forwarding, keep the private target address stable. Add domain records and application certificates if the service uses a name.
Keep: listener, firewall, authentication and domain settings.
Verify, then hand over.
Complete the acceptance checks below with the real application. Record the assignment and responsible operator. Retain a way to administer the host if the tunnel is unavailable, and confirm the agreed recovery procedure.
Keep: test results, operator details and a recovery path.
03 / Acceptance before handover
A connected tunnel
still needs a real test.
Use the real service and its intended callers. Record what succeeds, what stays blocked and what happens when the tunnel stops.
- 01 / Check
Reach it
Test from an external network using the real application and a permitted caller. For a gateway, confirm forwarding in both directions and the reply route.
- 02 / Check
Reject it
Confirm a disallowed caller or port stays blocked. Keep application authentication in the test; reaching a login page is not the whole acceptance check.
- 03 / Check
Check the source
For covered outgoing traffic, confirm the destination sees the assigned public IP. Check excluded traffic separately and verify it follows the agreed ISP route.
- 04 / Check
Interrupt it
Disconnect the tunnel in an agreed test window. Confirm the agreed blocking or explicit fallback, then test recovery and the application again.
Test both address families.
Test IPv4 and IPv6 separately. With full tunnel, an IPv6-only assignment still needs an explicit IPv4 policy. Confirm the supported platform’s exceptions and how uncovered traffic is handled.
Include a larger transfer.
Check MTU and packet-size behaviour as well as small requests, especially through a gateway. A successful handshake or small response can hide a transfer that stalls later.
Handover record / Assignment identifier · Responsible operator · Accepted paths · Interruption result · Recovery procedure
04 / Locate the fault
Start where
the path breaks.
Separate tunnel transport, address delivery, application access and the return route. Use the symptom to choose the next check.
| What you see | What to check |
|---|---|
| Tunnel will not connect | Power, client or gateway service, internet access and whether the network permits WireGuard UDP traffic. |
| Tunnel connected, service unavailable | Assignment delivery health, application listening address, permitted sources, ports and host firewall. |
| LAN target unavailable | Target address, service port, gateway forwarding and the reply route. |
| Partner sees the ISP address | The selected destination route, source-address selection and whether LAN traffic actually passes through the gateway. |
| One address family works | IPv4 and IPv6 configuration, and the destination’s support for each family. |
| Small requests work; larger transfers stall | Tunnel MTU—the maximum packet size—and path discovery. Use the supported platform’s diagnostics. |
| Address works; domain does not | A/AAAA records, DNS caching, application hostname settings and certificate validity. |
Make the support record useful.
Share the assignment identifier, platform, approximate failure time, affected protocol and the failing step. Remove credentials, tokens, private keys and application payloads from diagnostics. Keep endpoint private keys local.
05 / Before you commit
Practical questions.
Clear expectations.
Does it work behind CGNAT?
It can where your device or gateway can establish and maintain its outbound WireGuard tunnel. CGNAT means the access provider shares public addressing between customers; Fibmesh’s assigned address travels inside the tunnel. Restrictive UDP filtering still needs assessment.
Do remote visitors need Fibmesh software?
Clients connect to the public IP using the application’s normal protocol. They do not need the Fibmesh tunnel, but need a compatible application protocol and must satisfy your firewall and application authentication requirements.
Do I have to move my application or join Networks?
No. The application can stay on supported infrastructure you operate. A Networks private network is optional; account identity and service entitlement still apply.
Which country will websites think I am in?
The public address is served from the agreed Fibmesh location. Third-party IP geolocation and reputation databases can differ; an allocation does not guarantee how every website classifies it.
What are the speed, price and usage limits?
Confirm the allocation charge, throughput, traffic allowance, overages and support terms before setup. Your access connection’s bandwidth and reliability remain part of the path. Public IP delivery is not a dedicated internet leased line.
Can I keep the address when I change ISP?
The reservation is separate from the access ISP. The supported tunnel can reconnect over another eligible connection, but sessions may need to restart. Moving the allocation to another serving region is a separate decision.
Does pausing give up the address?
Pause stops delivery while retaining the reservation. Release gives up the address. With full tunnel and a kill switch, pausing can also stop covered internet access until delivery resumes or an agreed alternative is selected.
Next / Your first deployment
Bring the brief.
Agree the setup.
Share the target, address families, callers and outgoing destinations. We’ll confirm the supported deployment, serving location, available allocation and terms through assisted setup.