What is the difference between a static IP and a dynamic IP?

Two types of public addresses

Every office connected to the internet goes out through one public IP address that the internet provider gives it. The question is whether that address is yours for the long term, or on loan.

A dynamic IP is the default. The provider keeps a pool of addresses and assigns you one of them each time the router connects. Sometimes it stays the same address for months, and sometimes it changes after a disconnection, a router replacement or maintenance work at the provider. You don't choose when.

A static IP is an address that the provider reserves for you alone. It doesn't change after a disconnection, a power outage or a router replacement. With most providers this is a monthly paid add-on, and sometimes it is included in business plans.

How it works behind the scenes

A dynamic address is assigned by the same mechanism that hands out addresses inside the office, DHCP, only at the provider level. Your router asks for an address, the provider gives it one for a set period, and the router renews it from time to time. As long as the renewal succeeds, the address usually doesn't move. When the connection is cut for a long time, the provider may give the address to someone else, and you get a new one.

With a static address, the address is registered with the provider under your name or for your connection. On some connections it is set manually in the router, and on others the provider simply makes sure you always get the same one.

Note: it is important not to confuse two levels. A static public address is a matter for the internet provider. A static private address inside the office is a matter for your router, and you can set it up for free, for example for a printer, so the computers always find it.

When you really need a static address

• Access restricted by address — when a system, such as a management panel, allows entry only from set addresses. If the office address changes, you will be locked out.
• Connecting branches over a private network — a secure tunnel (VPN) between two offices is simpler when at least one side has a static address.
• A server that must be reachable from outside — security cameras you watch from home, a file server, an attendance system.
• Providers that require address registration — some services approve a connection only from an address that was registered with them in advance.

If none of these applies to you, a dynamic address is probably completely enough.

What about the phones?

With an on-premises PBX, which sits in a cabinet in the office and has to receive calls from outside, a static address was almost a must. With a cloud PBX the situation is the reverse: the phones in the office are the ones that reach out to the PBX and register with it, and the PBX answers them at the address they came from. If the address changed, the phone simply registers again from the new address.

In practice, the moment the address changes can cause an active call to be cut off, or a phone to be "unregistered" for a few seconds to a few minutes, until the next registration. In a regular office this happens very rarely, and usually at night or after a deliberate disconnection.

Pros and cons

There is also a middle path for some needs: a dynamic DNS service, which updates a fixed name (like office.example.com) every time the address changes. This works well for reaching cameras from home, but it doesn't help when a system requires you to register an exact numeric address.

Real-life examples

An accounting office in Bnei Brak with eight employees, phones and computers. There is no server that needs access from outside, and the phones are connected to a cloud PBX. A dynamic address is completely enough, and there is no point paying for an add-on.

A yeshiva with a dormitory whose administrator wants only the office computers to be able to enter the PBX management panel, not everyone who knows the password. Here a static address is worth the price: lock the entry to the office address, and consider adding another address for a manager who works from home, if he has one.

A nonprofit with two branches that keeps one file server and wants the second branch to reach it. A static address at the branch where the server sits greatly simplifies the connection between them.

A service center that works with an outside provider that approves connections only from a registered address. There is no choice: you need a static address, and you must register it with the provider.

Common mistakes

• Paying for a static address "for the phones" — with a cloud PBX this is not needed.
• Locking a system to a dynamic address — works great until the morning the address changes, and then no one can get in.
• Getting a static address and forgetting to write it down — it's worth keeping it in an organized place, together with the provider's details and the subscriber number.
• Confusing a private address with a public one — entering 192.168.1.1 in a list of allowed addresses won't help, because that is an internal address that isn't visible from outside.
• Switching providers and forgetting — a static address does not move with you when you switch to another provider. After a switch, you need to update every system that is locked to the old address.

When something isn't working: sign, cause, solution

Note the second row: it is the most common reason for the complaint "I paid for a static address and it changed." On most business connections the address stays as long as the login details are the same. A new router with different details looks to the provider like a new customer.

A full example: a nonprofit that locks the control panel to the office address

A chesed nonprofit with a small donations call center decided that the PBX control panel should open only from the office. The control panel holds donors' phone numbers, recordings and the ability to change routing — not something you want opening from any coffee shop. Here is how it went, step by step:

1. First check. A computer in the office searched "what is my ip" and noted the address. A week later they checked again — the same address. That still doesn't mean it is static, so:
2. A call with the provider. It turned out the address was dynamic, and that a static address is a small monthly add-on. They ordered one. The provider asked for two days, and the new address took effect after the router was restarted.
3. Recording it. The address was written in an internal file together with the subscriber number at the provider and the order date. It sounds trivial, but next year, when someone else handles it, this will save an hour.
4. Turning on the restriction. First they added the address to the allowed list and checked that entry from the office works. Only then did they turn on the block for everyone else. This order matters: anyone who turns on a block before confirming their own address locks themselves out.
5. The manager who works from home. His home has a dynamic address, so it wasn't registered. The solution: he connects from home to the office network through a VPN, and so goes out to the world with the office address. A simpler alternative, chosen in the end: he enters the control panel only from the office, and from home he makes do with calls through the app.

The cost: one monthly add-on at the provider. The result: even a leaked password doesn't open the control panel from outside.

What to tell your internet provider

Ordering a static address is a five-minute call, if you know what to ask for. The sentences worth preparing:

• "I need a static public IPv4 address, not behind CGNAT." — Both conditions matter. With some providers, "static" means a fixed private address inside their network.
• "Does the address stay if I replace the router?" — And if not, what needs to be transferred to the new router.
• "What do I set in the router: automatic login, or manual?" — With manual setup, you get four details from the provider: the address, the subnet mask, the gateway address and the DNS addresses. Write them all down.
• "How long until it takes effect, and is a restart needed?"
• "Does the address appear on the invoice?" — That way you will always know where to find it.

And if the provider says a static address is not possible on your plan, ask about a business plan. In most cases it is a small difference in price, and sometimes it comes with faster service when there are faults.

A fixed private address inside the office: small planning that saves trouble

Regardless of the provider, it is worth setting an order inside the office: which private addresses are fixed and which are handed out automatically. A common split on a 192.168.1.x network:

• .1 — the router.
• .2 to .20 — infrastructure equipment: managed switches, Wi-Fi access points, the camera recorder. Manual or reserved addresses.
• .21 to .49 — printers, fax adapters, a small server. Reserved in the router.
• .50 to .250 — the DHCP range: phones, computers, mobile devices. No one sets these manually.

The difference between "manual" and "reserved": a manual address is typed into the device itself, and a reserved address is set in the router according to the device's hardware address. The second is almost always better — when you replace a router, all the reservations are in one place, and when you replace a printer, you don't have to remember what was typed into it.

IP phones on a cloud PBX need neither. They reach out from any address, so they belong in the automatic range.