A fixed public IP SIM gives a cellular-connected business device a permanent, directly reachable address, at a recurring per-SIM premium. A VPS running as a WireGuard or OpenVPN hub achieves the same outcome, reliable remote reachability behind carrier-grade NAT, using ordinary, cheaper SIMs, with the cost shared across every connected site rather than charged per SIM. For most business deployments, CCTV, building management systems, SCADA, beyond a handful of sites, the VPS approach is the lower total-cost path to the same reachability.
Understanding the actual problem: carrier-grade NAT
Most standard cellular data SIMs sit behind carrier-grade NAT (CGNAT), the mobile network’s own address-sharing scheme that lets many customers’ devices share a smaller pool of public IP addresses. This works fine for a device only ever making outbound connections, but it means the device has no fixed, predictable address that something outside the network can reliably connect to. For a business deployment, a CCTV system needing remote viewing, a building management system (BMS) needing remote configuration access, or a SCADA installation needing centralised monitoring, this is the actual problem needing solving, not a hypothetical one.
Two genuinely different ways to solve it
A fixed public IP SIM solves it at the network layer: the mobile network itself assigns a permanent, directly routable public address to that specific SIM, bypassing CGNAT entirely for that one SIM. Nothing extra needs configuring on the device beyond using that SIM; it’s reachable at a known address from the moment it’s inserted.
A VPS-based VPN hub solves it differently: the device, on an ordinary CGNAT’d SIM, makes an outbound connection to a VPS, which does have a fixed public address by nature, the same pattern covered throughout this site’s industrial guides. Outbound connections aren’t blocked by CGNAT, only inbound ones, which is exactly the asymmetry this approach exploits.
Cost comparison at business scale
| Sites/devices | Fixed IP SIM total cost | VPS + VPN total cost |
|---|---|---|
| 1-3 sites | Modest premium, often the simpler choice | VPS cost plus setup time, similar or slightly higher total cost at this scale |
| 10 sites | Premium charged per SIM, scaling linearly | One VPS cost, shared across all 10 sites |
| 50+ sites | Premium cost scales to a meaningful recurring business expense | Same VPS cost (perhaps a slightly larger tier), the gap widens substantially in the VPS’s favour |
The crossover point varies by exact SIM pricing and the specific VPS size needed, but the pattern is consistent across virtually every provider’s pricing: a fixed IP SIM’s cost scales with site count, a VPS hub’s cost largely doesn’t, since one reasonably specified VPS handles dozens to hundreds of connected sites without needing to scale proportionally.
CCTV-specific considerations
Remote CCTV viewing across multiple sites is one of the clearest cases where the VPS approach earns its place: a WireGuard hub gives centralised, secure access to every site’s camera system from one place, rather than needing to remember or manage separate fixed IP addresses per site. It also means camera systems are never directly exposed to the public internet, a meaningful security improvement over a fixed IP SIM approach where the device, by definition, is directly reachable from anywhere unless additional firewalling is configured on top.
BMS and SCADA-specific considerations
For building management systems and SCADA deployments specifically, the considerations covered in VPS as a SCADA VPN Concentrator and Remote Access to PLCs and Modbus Devices via VPS apply directly: protocols like Modbus and BACnet, commonly used in these systems, have no native authentication of their own, making the VPN tunnel’s access control the actual security boundary protecting the system, not just a convenience for reachability. A fixed IP SIM alone, without an additional firewall layer, leaves these protocols’ complete lack of built-in security directly exposed to the internet, a genuinely serious risk worth weighing heavily against the simplicity a fixed IP SIM otherwise offers.
When a fixed IP SIM remains the right call for a business
Worth being fair to the alternative: a single critical site needing the simplest possible setup, with no in-house networking expertise to maintain a VPN hub, or a device that genuinely can’t run a VPN client at all, are both legitimate reasons to choose a fixed IP SIM despite the cost premium. Simplicity has real value, particularly for a business without dedicated technical staff to maintain self-hosted infrastructure.
A practical decision framework
| Factor | Favours fixed IP SIM | Favours VPS + VPN |
|---|---|---|
| Number of sites | One or very few | Multiple, growing over time |
| In-house technical capability | Limited, want zero ongoing maintenance | Comfortable with the setup covered throughout this site |
| Protocol security (Modbus, BACnet, etc.) | Needs additional firewalling regardless | VPN tunnel itself provides the access control |
| Centralised monitoring across sites | Requires managing multiple separate addresses | Natural fit, one hub, every site visible centrally |
Frequently asked questions
Can a business use both approaches across different parts of the same deployment?
Yes, and it’s a reasonable pattern: a fixed IP SIM for one critical, simple site, a VPS hub for the rest of a growing multi-site fleet, chosen per-site based on the specific factors in the decision framework above rather than forced into one approach everywhere.
Does a fixed IP SIM offer better reliability for genuinely critical infrastructure?
Not inherently, both approaches depend on the same underlying cellular connection’s reliability. The VPS hub adds the tunnel itself as a component, though WireGuard’s resilience, covered throughout this site’s VPN guides, handles this well in practice without meaningfully reducing overall reliability.
Is OpenVPN a reasonable alternative to WireGuard for this specific use case?
Yes, OpenVPN remains a mature, well-supported option, particularly on older router hardware without native WireGuard support. WireGuard is generally preferred on this site for its simplicity and lower overhead where the hardware supports it, but OpenVPN is a legitimate choice where it doesn’t.
How does this decision interact with choosing between Teltonika, Milesight and other router brands?
It doesn’t significantly, since the major commercial router brands covered in WireGuard Hub VPS for IoT all support both fixed IP SIMs and VPN-based approaches equally well; the choice here is independent of which router hardware a site uses.
What’s a realistic SIM-only cost premium for fixed IP in a UK business context?
This varies meaningfully by provider, data allowance and contract volume, worth obtaining a current quote directly from your specific provider or, for larger fleets, a dedicated IoT SIM specialist, rather than relying on a generic published figure that may not reflect business-volume pricing.
Does moving from fixed IP SIMs to a VPS hub require replacing existing router hardware?
Generally no, if the existing routers already support WireGuard or OpenVPN, which most modern commercial cellular routers do, the migration is a configuration change rather than a hardware replacement, making this a genuinely low-risk change to evaluate even for an already-deployed fleet.
A practical migration approach for an existing fixed-IP fleet
For a business already running fixed IP SIMs across multiple sites and weighing a switch, a staged migration is considerably lower risk than switching everything simultaneously: set up the VPS hub and migrate one or two non-critical sites first, confirm reliability and remote access work as expected over a few weeks, then migrate the remaining sites in batches, only cancelling each site’s fixed IP SIM premium once its replacement tunnel is confirmed working reliably. This avoids the genuinely costly scenario of losing remote access to a critical site mid-migration with no fallback.
Procurement and contract considerations worth knowing about
Fixed IP SIM contracts, particularly at business volume, sometimes carry minimum terms or early-termination considerations worth checking before committing to either a fixed IP SIM rollout or a migration away from existing ones. This is a genuinely commercial, not technical, factor that can meaningfully affect the actual cost comparison and timing of a transition, worth involving whoever handles supplier contracts at your business before finalising a decision either way.
A note on insurance and compliance documentation
For some regulated industries or insurance contexts, particularly around CCTV and security systems, documented network architecture matters for compliance purposes beyond pure technical function. A VPN-based architecture with centralised access logging (covered in the security hardening checklist’s logging guidance) can actually strengthen a compliance position compared to a collection of individually fixed-IP devices with no centralised audit trail of who accessed what and when, worth raising with whoever owns compliance requirements at your business if this is a relevant consideration.
The genuinely common end state for growing businesses
In practice, most businesses that start with fixed IP SIMs for a handful of early sites, then grow past a dozen or so locations, eventually migrate toward a VPS-based hub specifically because the recurring per-SIM cost becomes noticeable on a finance report in a way it wasn’t at smaller scale. This isn’t a universal rule, some businesses remain happily on fixed IP SIMs indefinitely if their site count never grows much, but it’s a pattern worth being aware of when planning infrastructure for a business that expects to scale.
What’s a reasonable timeframe to evaluate before committing to a full migration?
A month or two running the staged pilot described above gives genuine confidence in reliability before committing the rest of a fleet, long enough to observe normal operational patterns including any periodic peak-load or connectivity-stress events specific to your business.
Who within a business should actually own this decision?
Ideally a collaboration between whoever manages technical infrastructure and whoever owns the relevant budget line, since the decision genuinely sits at the intersection of a technical trade-off and a recurring cost commitment, not purely one or the other.
Does this guide’s comparison still apply if the business uses a mix of fixed-line and cellular connectivity across sites?
Yes, the same VPS hub can serve as the central point for both cellular sites needing CGNAT workarounds and fixed-line sites with their own separate considerations, unifying remote access across a genuinely mixed connectivity estate rather than treating each connectivity type separately.
A closing word on getting this decision right the first time
Of every decision covered across this site’s buying guides, this is one of the few where the wrong initial choice is genuinely expensive to unwind at scale, not because migrating later is technically difficult, the staged approach covered earlier in this guide handles that cleanly, but because every month spent on the more expensive option across a large fleet before correcting course is money that doesn’t come back. For a business already running more than a handful of cellular-connected sites and still paying for fixed IP SIMs across all of them without having deliberately weighed this comparison, working through the decision framework in this guide against your actual site count and growth trajectory is genuinely worth an afternoon of a technical lead’s time, the kind of decision where a small amount of upfront analysis reliably pays for itself many times over within the first year alone.
Where to go next once the decision is made
Having decided in favour of a VPS hub, WireGuard Hub VPS for IoT is the natural next read, covering the practical setup across mixed router brands in detail. Having decided a fixed IP SIM genuinely suits your specific situation better, this guide’s job is done, the decision itself, made deliberately rather than by default, is the part that actually matters most.
A final word on recurring vs upfront cost framing
One useful reframe when presenting this decision to a finance team: a fixed IP SIM premium is a recurring operational expense that never ends, while a VPS is also a recurring operational expense but one that doesn’t scale with device count. The comparison is therefore not “pay X vs pay nothing” but “pay X per device forever vs pay Y flat indefinitely.” Framed this way, the business case for the VPS approach at any fleet size above a handful of sites becomes straightforwardly a finance question rather than a technical one, and one that most finance teams can evaluate clearly once the numbers are presented honestly rather than buried in technical detail. A well-framed cost-per-site table, showing fixed IP SIM cumulative cost versus flat VPS cost at a range of site counts, is often the most persuasive document in any such conversation.