How to get an outbound static IP that’s safe & secure

If you need to have a fixed IP address but its not possible or you simply have a dynamic IP ISP then this is the safest and cheapest solution.

Using a commercial VPN provider and hoping for them to maintain an IP long term is not a reliable option for many reasons.
Public VPN’s are prone to being blocked and having IP changes frequently due to people using them for hacking etc.

This is a four step process but its fairly straightforward:

A: Get a reliable low cost VPS server specific for your task by looking at the ‘Outbound Static IP Provider Comparison’ below.

B: Once you get the server, immediately check the IP provided for your server isn’t on a blacklist. Check most of these to be sure:

https://www.virustotal.com/gui/home/search | https://multirbl.valli.org/ | https://mxtoolbox.com/blacklists.aspx
https://check.spamhaus.org/ | https://www.spamcop.net/bl.shtml | https://www.barracudacentral.org/lookups

C: Now install ‘Ubuntu 24.04 LTS’ ideally (RAM 1Gb+) or if very low RAM like RackNerd (512MB) then use Debian 12. (If Amazon force U24.04LTS)

D: Install Tailscale and Connect.

Run these commands exactly in order on your VPS terminal:

1. Install Tailscale

Bash

curl -fsSL https://tailscale.com/install.sh | sh

2. Enable IP Forwarding (Critical Step) This allows the server to pass traffic from your VPN to the internet.

Bash

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

3. Start the “Exit Node”

Bash

sudo tailscale up --advertise-exit-node

(It will give you a URL. Copy/paste that into your browser to log in.)

4. Final Activation (In Browser)

Go to login.tailscale.com/admin/machines
Click the Three Dots ... next to your VPS -> Edit Route Settings.
Check the box: Use as exit node.

Here are some VPS options:

Quick Verdict: The Winner

Best Absolute Price: RackNerd (via LowEndBox) (~$12–$15 per year) – Risky Support.
Best for Heavy Data: IONOS ($2/£1 per month / Unlimited Bandwidth) – Good Balance and Unlimited High Speed.
Best for Beginners: DigitalOcean ($4–$6 per month) – Easy but Capped or OVHcould ($4.20) – Good Overall Medium Speed.

Outbound Static IP Provider Comparison

Provider	Monthly Cost (Est.)	Bandwidth (Data Cap)	Setup Difficulty	IP Reputation	Best Use Case
RackNerd (via LowEndBox)	~$1.25* (Paid ~$15/yr)*	Capped (1TB – 3TB)	Medium (Manual Linux/Very Slow Support)	Low/Mid (Shared subnets)	The “Budget King.” Best for simple web browsing or accessing a work database cheaply.
IONOS (VPS Linux XS)	$2.00/£1.00 (Paid Monthly)	Unlimited (1 Gbit/s)	Medium (Reliable)	Mid/Good (Standard)	Heavy Streaming. The cheapest way to get unlimited data. Get a 1 month contract.
OVHcloud (Starter VPS)	~$4.20 (Paid Monthly)	Unlimited (100 Mbit/s+)	Medium (Slow Support)	Good (Clean IPs)	The “Reliable Daily Driver.” Best balance of price, unlimited data, and legitimacy.
DigitalOcean (Basic Droplet)	$4.00 – $6.00 (Paid Monthly)	Capped (500GB – 1TB)	Easy (Best Docs/UI)	Excellent (Professional)	Beginners & Pros. If you want the easiest setup experience and great documentation.
AWS (EC2 + VPC)	~$7.20 + Usage ($3.60 IP fee + instance)	Expensive ($0.09/GB fee)	Hard (VPC/Networking)	Excellent (Enterprise)	Corporate Only. Only use if you need strict enterprise whitelisting. Not for personal use. Low data volume. No streaming due to cost.

Pro Alternative Options

WireGuard Server (The “Pure” Alternative)

Use this if you don’t want to rely on Tailscale’s login servers or if you want slightly faster raw speeds. We will use a trusted “auto-install” script because setting up WireGuard manually is complex.

1. Run the Auto-Installer

We use the widely trusted script from angristan (GitHub).

Bash

curl -O https://raw.githubusercontent.com/angristan/wireguard-install/master/wireguard-install.sh
chmod +x wireguard-install.sh
./wireguard-install.sh

2. Answer the Prompts

Public IP: (Press Enter, it auto-detects)
Interface: (Press Enter)
Port: (Press Enter, defaults to 51820)
DNS: (Select 1 for Google or 3 for 1.1.1.1)
Client Name: Type a name (e.g., myLaptop)

3. Get the Connection Code

The script will generate a QR code on the screen.

Mobile: Open the WireGuard app on your phone and scan the QR code.
PC/Mac: The script saves a file named myLaptop.conf. You need to copy the text inside this file and paste it into your WireGuard desktop app.
- To see the text: cat myLaptop.conf

Comparison: Which one should you use?

Feature	Tailscale Exit Node	WireGuard Direct
Setup Speed	Fast (3 commands)	Fast (1 script)
Maintenance	Zero (Auto-updates/Auto-keys)	Manual (Must manage keys yourself)
Firewalls	Punch through anything (NAT Traversal)	Requires open UDP ports
Account	Requires Tailscale Account (Google/Microsoft)	No Account (Private keys only)
Speed	95% of line speed	100% of line speed