TL;DR: Consumer links are often dynamic. Rebooting the modem, moving between Wi‑Fi and LTE, joining a café, or enabling a VPN can change the public address websites see. That is normal. Confirm the new value with a fresh IP lookup after each network change before you update an allowlist.
The morning the allowlist “broke itself”
A contractor updated a cloud firewall on Monday with his home IP. Tuesday he worked from a coworking space. Every SSH attempt failed. He assumed the firewall had rolled back. It had not. His laptop was simply exiting through a different public address. One lookup would have shown the new number; instead he spent an hour diffing infrastructure-as-code.
Network switches are invisible to applications until something breaks. Email keeps flowing because it uses hostnames and TLS. SSH to a fixed IP does not. Any workflow that hard-codes yesterday’s dotted quad without a recheck ritual will eventually fail on a laptop that legitimately moved between exits.
Common events that mint a new public IP
- Modem or ONT reboot: many ISPs hand out a new lease.
- Wi‑Fi to cellular: you leave the home NAT and enter a carrier gateway.
- VPN connect/disconnect: the exit city and address both move.
- Guest networks and hotels: shared exits that rotate more often than home fiber.
Corporate split-tunnel setups can make only some apps use the VPN exit. Your browser lookup might show the VPN while a background sync still uses the office path—or the reverse. When something “randomly” fails, compare the address for the exact app that failed, not whichever tab you had open first.
Switching from Ethernet to Wi‑Fi at home usually keeps the same WAN IP because the router did not reboot. Switching buildings always changes it. The mental model is “did my packets leave through a different gateway?” not “did I change Wi‑Fi password?”
Dynamic does not mean broken
ISPs conserve addresses and simplify provisioning by using DHCP or similar assignment on the WAN. Unless you pay for a static IP or run a stable tunnel, you should expect change. Design remote access with that in mind: dynamic DNS, certificate-based VPN, or cloud jump hosts beat chasing dotted quads every week.
Security teams sometimes treat IP change as suspicious. For consumer broadband it is baseline noise. Fraud models care about velocity and context—a login from a new country five minutes after the old one matters more than a new lease after a power blip. Document your own network habits so you do not panic at your own DHCP behavior.
How long an address might last
Some home leases stay stable for months if the modem never drops. Others change nightly. There is no universal timer. Treat “it has been the same for a while” as luck, not a contract. Recheck before privileged changes.
Mobile gateways rotate more aggressively than fiber CPE. A train commute might cross several pools in one hour. Do not assume the address you captured at the station still applies at the office door.
CGNAT and invisible churn
Even when your home WAN looks stable from the router, carrier-grade NAT on mobile or some budget fiber plans puts many subscribers behind a small pool of public addresses. The pool may rotate without your modem ever rebooting. Symptoms include “works again after airplane mode” because the handset grabbed a different gateway slot.
If inbound connections to your house fail while outbound browsing works, ask the ISP about CGNAT before buying extra hardware. No amount of port forwarding fixes an address you do not uniquely hold on the public side.
A calm ritual after you move networks
Open the lookup, wait for the result, copy it, and only then edit firewall rules or vendor portals. If city or timezone also drive access policies, glance at the location estimate so you notice an unexpected country hop from a VPN. Write the capture time in the ticket. Future you will thank present you when the address has already rotated again.
Keep a tiny note template: network name, VPN on/off, public IP, timestamp. Thirty seconds of discipline prevents hours of “but it worked yesterday” threads. Changing networks is normal; pretending addresses are permanent is the optional mistake.
Remote workers who split time between countries should expect allowlists to fail unless IT uses VPN concentrators or identity-based access. The IP you had in Chicago last week will not follow you to Berlin Wi‑Fi. That is not an attack; it is geography.
Smart home apps that “phone home” to cloud APIs rarely care about your WAN IP. Your SSH shortcut to a fixed office box does. Know which tools bind to addresses versus hostnames before you blame DHCP for a broader outage.
Bookmark the lookup on your phone’s home screen if you travel often. One tap after each hotel check-in beats guessing whether tonight’s firewall rule still matches yesterday’s lobby Wi‑Fi exit.
