Two public IPs from one Google Fiber connection
A small unmanaged switch between the Google Fiber Jack and two routers can give each router its own public IPv4 address. It works, but Google Fiber doesn't support it, and a router gets a new address every time it reboots.
A residential Google Fiber connection is normally one router plugged into the Fiber Jack. Put a small unmanaged switch in between, and two routers can each get their own public IPv4 address from the same connection. That’s useful when you want two networks that don’t depend on each other, such as a second router that keeps working while the main one is being rebuilt or upgraded.
The setup
Fiber Jack ──► unmanaged switch ──┬──► router A (WAN port)
└──► router B (WAN port)
- The Fiber Jack’s Ethernet port goes into any port on the switch.
- Each router’s WAN port goes into another port on the switch.
- Both routers get their WAN address by DHCP, which is the normal setting.
Each router sends its own DHCP request, and each one gets its own public IPv4 address. Nothing is configured on the switch, and it has no IP address of its own.
Why it works
Google Fiber’s own-router instructions have you plug a router straight into the Fiber Jack, and its business static-IP article says your router must use DHCP for its WAN address. Neither page mentions a switch. But a switch doesn’t change what the Fiber Jack sees: two devices with two MAC addresses, each asking for a lease, and the DHCP server answers both.
What to know before relying on it
It isn’t supported. Google Fiber doesn’t document this setup. Its help pages cover plugging one router into the Fiber Jack, and say support stops at the Fiber Jack once you use your own router. If something breaks, you’re on your own, so check your service terms before building on it.
The addresses aren’t static, and a reboot changes them. Static IPs are a Google Fiber business feature only; residential service is dynamic.
- When a router reboots, it comes back with a different public IP. The old lease isn’t released until the ISP sees that device gone, so the request it sends after booting is treated as new.
- A short cable drop while the router stays up is different: unplugging for a few seconds, or moving the cable to another switch port, typically brings the same address back.
- Leases can renew as often as every 15 minutes on a much longer lease, so a steady stream of DHCP renewals in a router’s logs is normal, not a sign the link is unstable.
So anything that has to reach either network from outside should use a dynamic DNS name, never the literal IP (see Dynamic DNS below). A remote device pointed at an IP address will lose its way back the first time that router reboots, and fixing it may need someone on site.
Both routers are on the internet. The switch puts both WAN ports on the same segment as the Fiber Jack. Each router needs its own firewall, with nothing exposed on its WAN side that you didn’t mean to expose. The two networks are separate only because the routers keep them separate.
They share the circuit. Two public addresses don’t mean twice the bandwidth. Both routers share one connection, so use a switch whose ports are at least as fast as the plan, and remember the switch is now a single point of failure (and needs power) for both networks.
Dynamic DNS for both addresses
Dynamic DNS (DDNS) keeps a hostname pointed at an address that changes. A small client notices the new public IP and updates the DNS record, so anything that connects by name follows along. With two routers and addresses that change on every reboot, it’s what makes this setup usable for anything inbound.
One hostname per router. Each router has its own public IP, so each needs its own name. Pointing one name at both would send traffic to whichever address was updated last.
Where the client runs:
| Option | What it does | Trade-off |
|---|---|---|
| The router’s built-in DDNS client | Updates the record the moment the router’s WAN address changes. | The fastest and simplest, but limited to the DDNS services the router supports. |
| A client on a machine behind the router | Checks the public IP on a schedule, using an outside “what’s my IP” service, and updates the record when it changes. | Works with any DNS provider that has an API, but it lags by up to one check interval. It must run behind the router it reports for, or it will publish the other router’s address. |
| A DDNS feature from the DNS provider | Uses the provider’s own update client or URL. | Easy to set up, but ties the name to that provider. |
Settings that matter:
- Short TTL. A record cached for hours keeps pointing at the old address long after the update. A TTL of a few minutes (60 to 300 seconds is common) keeps the gap short.
- A scoped credential. Give the client a token that can edit only its own record or zone, not your whole DNS account. It sits on an internet-facing device, so assume it can leak.
- Monitoring. Check now and then that the name resolves to the router’s current public IP, and alert when they differ. A DDNS client that has quietly stopped is the usual way this fails.
What DDNS doesn’t fix:
- There’s still a gap. Between a reboot and the update, the name points at the old address, and the ISP may already have given that address to someone else. Anything connecting by name should check who it reached (TLS with a valid certificate, VPN keys, SSH host keys), not trust the address.
- Some devices only accept an IP. Where a field takes an IP address only, look for a hostname option elsewhere in the same device, or use one of its other discovery methods. Don’t type in today’s address.
- IP allowlists elsewhere go stale. A firewall rule at another site that allows “your” address breaks at the next reboot. Use FQDN-based address objects where the firewall supports them, or authenticate the traffic instead of allowlisting it.
Using a managed switch instead
A managed switch works too, and lets you monitor the ports. If you use one, put the Fiber Jack and both router ports on their own VLAN that nothing else uses, so the internet-facing segment can’t leak into the LAN. Turn off spanning tree on those ports rather than using BPDU guard: you don’t want the switch sending STP frames toward the ISP, or shutting off the internet because of something it sees from that direction. Loop detection that recovers by itself is a safer way to catch a cabling mistake there.
References
- Set Up Your Own Router at Home (Google Fiber Help): plugging your own router into the Fiber Jack, and what support covers.
- Static IPs for Business: Features and Setup (Google Fiber Help): static IPs are business-only, residential addresses are dynamic, and your router must use DHCP for its WAN address.