TL;DR: On Wi‑Fi you usually exit through the building’s public IP. On cellular you often exit through a carrier gateway shared with many subscribers. Check each path separately with the homepage lookup before you assume “my phone’s IP” is a single stable number.
The hotspot that invalidated yesterday’s rule
A traveler allowlisted his hotel Wi‑Fi IP so he could reach a staging server. Mid-afternoon the hotel network died, so he tethered through LTE. Staging rejected him. Same phone, same browser, different public exit. He had never captured the cellular address because he assumed “phone IP” meant one thing.
Phones are multi-homed by design. Wi‑Fi and cellular are two uplinks with two NAT stories. Apps may prefer one when both are up. A lookup taken on hotel Wi‑Fi says nothing about what the staging server sees when iOS falls back to 5G after a weak signal.
What Wi‑Fi usually means for your public address
Café, office, and home Wi‑Fi put you behind whoever owns the upstream link. Your phone gets a LAN lease; NAT hides many devices behind one WAN address. Everyone on that SSID may share the same public IP toward the internet. Turning Wi‑Fi off is the only reliable way to leave that exit.
Enterprise Wi‑Fi may force a VPN or proxy before traffic reaches the open internet. The public IP then belongs to the corporate edge, not the coffee shop downstairs. Capture on the same SSID you use for the failing app, with the same VPN policy your IT expects.
What cellular usually means
Mobile carriers deploy large gateways. Your handset may not have a unique public IPv4 at all. The address a website sees can belong to a pool that rotates or that many customers share. IPv6 on mobile can look more “yours” in some regions, but policies still vary by carrier and plan. Do not tattoo either value onto a long-lived firewall without a plan for change.
- Wi‑Fi capture: useful for building allowlists tied to an office day.
- LTE/5G capture: useful for testing “what happens on the train.”
- Both: required if you truly work on either path.
Personal hotspot mode reuses the cellular exit while your laptop thinks it is on “Wi‑Fi.” The laptop’s lookup shows the carrier gateway, not your home fiber—even though the icon is a Wi‑Fi fan. Label screenshots with “hotspot via LTE” so future you does not confuse them with office WLAN captures.
Airplane mode is a blunt instrument that works
To force a clean comparison, toggle Wi‑Fi off, confirm cellular bars, load the lookup, save the result. Then reconnect Wi‑Fi, disable cellular data if needed, and load again. Label the two screenshots. Mixing them in one note is how tickets get nonsense edits.
iOS and Android sometimes keep a dormant path warm for handoff. Waiting ten seconds after toggling radios reduces “still showing the old exit” surprises. If results look stuck, kill the browser tab and open a fresh one—rare caching on captive portals can otherwise lie for a single reload.
Why mobile IPv4 feels magical and unstable
Many carriers ran out of public IPv4 per handset years ago. CGNAT on mobile is normal. You might share an address with strangers in another state. Abuse desks know this; strict IP allowlists often fail for phone-only workers unless the org moves to VPN or device certificates.
5G standalone and newer IPv6 deployments change the picture region by region. A lookup that showed only IPv4 last year may show a global IPv6 today. Revisit mobile captures when you upgrade plans or travel internationally—roaming partners use entirely different pools.
Location fields move with the exit too
Carrier gateways are often registered in a different city than the street you are standing on. If the city looks absurd on cellular but fine on home Wi‑Fi, that can be correct behavior. Compare with the location page on each path before you accuse the tool of “being wrong.” Design access around identity and certificates when you can; treat IP allowlists as brittle helpers, especially on phones.
Field teams should document both paths in runbooks: “office Wi‑Fi capture” and “LTE capture.” Security policies that ignore mobile reality frustrate everyone. Phones are primary computers now; their two exits deserve the same respect desktop LAN versus WAN already gets.
Low-data mode and battery saver can delay background sync until Wi‑Fi returns, which makes failures look intermittent. When debugging access, note whether the failing request happened on metered cellular or unmetered WLAN—split tunnel policies sometimes treat them differently even when the public IP is the only field the ticket asks for.
Tablets with LTE behave like phones, not like laptops on Ethernet. IT asset tags that say “mobile device” should trigger the two-path capture habit automatically instead of treating them as desk machines with one stable address.
If your org mandates MDM, confirm whether the management tunnel adds yet a third exit. Some profiles route audit traffic separately from browser traffic, and a naive lookup in Safari may not represent what the compliance agent reports.
