Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Mobile IPv4 lets a device keep using its home IP address while it is away from its home network. It does this by registering a care-of address with its home agent: the agent stores that relationship as a mobility binding, then tunnels packets addressed to the home address to the device’s current location.

The key distinction is that a tunnel changes how a datagram is delivered, not the address the correspondent uses for the mobile node. The original datagram remains inside an outer IP packet until the tunnel endpoint removes that outer header.

What is a Mobile IPv4 binding?

A mobility binding is the home agent’s time-limited record linking a mobile node’s home address to a care-of address. It tells the agent where to send traffic for the node while it is registered away from home. Depending on the registration, the agent can retain more than one simultaneous care-of address.

The mobile node tells its home agent its current location through Mobile IPv4’s registration procedure. The home agent must be able to intercept datagrams addressed to the node on its home network while the node is registered elsewhere. These are protocol requirements in RFC 3344, Section 4 and Section 4.2.3 (August 2002); RFC 5944 is the revised Mobile IPv4 specification.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
#1 Best Overall
TP-Link Roam 6 AX1500 Portable Wi-Fi 6 Travel Router (TL-WR1502X)
  • 𝐑𝐨𝐚𝐦 𝟔 𝐀𝐗𝟏𝟓𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐓𝐫𝐚𝐯𝐞𝐥 𝐑𝐨𝐮𝐭𝐞𝐫 - Delivers fast Wi-Fi 6 speeds (1201 Mbps on 5 GHz, 300 Mbps on 2.4 GHz) for uninterrupted video streaming, downloading, and online gaming all at the same time. Actual Wi-Fi speeds vary based on source bandwidth, environment, and distance to devices.
  • 𝐒𝐞𝐜𝐮𝐫𝐞 𝐖𝐢-𝐅𝐢 𝐎𝐧-𝐓𝐡𝐞-𝐆𝐨 - Connects to public Wi-Fi and creates a private, secure network for all your devices. Supports multiple devices at once, ideal for hotels, Airbnbs, airports, and even home use. VPN connectivity enables secure remote work. This is not a Mi-Fi device or mobile hotspot.
  • 𝐂𝐨𝐧𝐧𝐞𝐜𝐭 𝐀𝐧𝐲𝐰𝐡𝐞𝐫𝐞, 𝐀𝐧𝐲 𝐖𝐚𝐲 - Offers (1) Router Mode for Ethernet or USB (phone) tethering connections, (2) Hotspot Mode for secure access to public WiFi , and (3) AP/RE/Client Mode to extend WiFi, add WiFi to wired setups, or connect wired devices wirelessly.
  • 𝐏𝐨𝐫𝐭𝐚𝐛𝐥𝐞 𝐚𝐧𝐝 𝐃𝐮𝐫𝐚𝐛𝐥𝐞 𝐃𝐞𝐬𝐢𝐠𝐧 - The Roam 6 AX1500, measuring a compact 4.09 in. × 3.54 in. × 1.10 in., is a pocket-sized travel router perfect for your next trip or adventure.
  • 𝐌𝐮𝐥𝐭𝐢𝐩𝐥𝐞 𝐰𝐚𝐲𝐬 𝐭𝐨 𝐩𝐨𝐰𝐞𝐫 𝐲𝐨𝐮𝐫 𝐫𝐨𝐮𝐭𝐞𝐫 - Power the Roam 6 via its USB-C port using the included adapter or any 5V/3A PD power source, like a power bank.

How does Mobile IPv4 register a care-of address?

The mobile node sends a Registration Request that identifies the home address, home-agent address, care-of address, requested lifetime, and a 64-bit identification value. The request’s flags indicate which optional behaviors the node wants. The home agent records the binding for the granted registration lifetime.

Care-of address choices

Mode Where the tunnel ends Who decapsulates
Foreign-agent care-of address At the foreign agent on the visited network The foreign agent removes the outer header and forwards the inner datagram to the mobile node.
Co-located care-of address At an address assigned to the mobile node itself The mobile node removes the outer header directly.

A care-of address identifies the tunnel’s delivery endpoint; it does not replace the mobile node’s home address as the address used by correspondents.

Rank #2
Sale
GL.iNet GL-BE3600 Slate 7 Wi-Fi 7 Travel Router Touchscreen 2.5G
  • 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
  • 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
  • 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
  • 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
  • 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.

Registration flags

  • S: Retain simultaneous bindings.
  • B: Request forwarding of broadcast datagrams.
  • D: Indicate that the mobile node performs decapsulation.
  • M: Request minimal encapsulation.
  • G: Request GRE encapsulation.
  • T: Request reverse tunneling.

A requested lifetime of zero asks to deregister the binding. A lifetime of 0xffff represents infinity in RFC 3344. These values describe Mobile IPv4 registration semantics, not a guarantee that every agent will grant the request.

How does a Mobile IPv4 tunnel carry a datagram?

Encapsulation places the original IP datagram inside a new delivery packet. The original packet is the inner datagram: its source and destination remain those of the original communication. The added outer IP header directs the encapsulated packet to the care-of address so it can cross the network to the tunnel endpoint.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
NETGEAR Nighthawk M6 5G WiFi 6 Mobile Hotspot Router (MR6110) – Blazing Fast Wireless Hotspot Router, Unlocked, Certified with AT&T - White (Renewed)
  • Unlocked, portable hot spot for 5G and 4G LTE around the world, certified with AT&T requires a 5G compatible SIM card. Ask your 5G wireless network provider for the best 5G data plan for your needs

RFC 3344 requires home agents and foreign agents to support IP-in-IP encapsulation. It also defines minimal encapsulation and GRE as optional alternatives. The registration flags M and G request those optional methods; they do not change the purpose of the tunnel, which is to deliver the original datagram to the mobile node’s current location.

What happens on the forward path?

  1. A correspondent sends a datagram to the mobile node’s home address, just as it would when the node is at home.
  2. The home agent intercepts that datagram while the node is registered away, consults its binding, and tunnels the datagram to the registered care-of address.
  3. At a foreign-agent care-of address, the foreign agent checks that the inner destination matches a current entry in its visitor list. If it matches, the agent decapsulates the packet and forwards the original datagram to the mobile node.
  4. With a co-located care-of address, the mobile node receives the tunnel packet and decapsulates it itself.

The visitor-list check matters: a foreign agent must not forward a tunneled datagram whose inner destination does not match a current visitor-list entry. RFC 3344 specifies this rule to prevent a possible routing loop.

Rank #4
NETGEAR Nighthawk M7 5G Mobile Hotspot with eSIM, WiFi 7, Up to 3.6 Gbps
  • WIFI 7 SPEEDS UP TO 3.6 GBPS, ANYWHERE YOU GO: Powered by a 5G or 4G cellular connection, M7 delivers fast, reliable WiFi 7 performance. Real-world speeds depend on carrier network, signal strength, location, and connected devices
  • GLOBAL COVERAGE WITH NETGEAR eSIM IN 140+ COUNTRIES: Purchase 5G or 4G data plans from the Nighthawk app with no contracts. Requires free NETGEAR account. Coverage and speeds vary by country and carrier
  • US CARRIER SUPPORT: The M7 is certified for AT&T and T-Mobile, unlocked for flexible use across compatible carriers. For US local carrier eSIM or SIM activation and data plan details, contact your carrier directly
  • POWERFUL BUILT IN SECURITY - includes firewall protection, WPA3 encryption, and automatic firmware updates help protect your data when using public WiFi
  • CONNECT UP TO 32 DEVICES AND FREE UP YOUR PHONE: A dedicated hotspot outperforms phone tethering. Connect laptops, tablets, and smart devices simultaneously while keeping your phone free
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What is reverse tunneling, and when is it used?

Reverse tunneling carries traffic sent by the mobile node back through the home agent instead of allowing that traffic to follow an ordinary direct route. Direct routing may work, but a network’s ingress filtering, topology, or policy can make a path through the home agent necessary or preferable.

When reverse tunneling is used, the mobile node’s outbound datagram is carried in a tunnel to the home agent, which then forwards it onward. RFC 2344 requires the home agent to validate a reverse-tunneled packet: the outer source must match a registered care-of address, and the inner source must match the mobile node. The T registration flag requests reverse tunneling.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Best Value
Roam 6 AX1500 Portable Wi-Fi 6 Travel Router Dual-Band USB C 3.0
  • 𝐑𝐨𝐚𝐦 𝟔 𝐀𝐗𝟏𝟓𝟎𝟎 𝐝𝐮𝐚𝐥-𝐛𝐚𝐧𝐝 𝐬𝐩𝐞𝐞𝐝𝐬 - Wi-Fi 6 Speeds up to 1,201 Mbps (5 GHz) and 300 Mbps (2.4 GHz) for up to 60 devices simultaneously. Actual Wi-Fi speeds vary based on source bandwidth, environment, distance to devices, and obstacles. ◇§
  • 𝐏𝐨𝐫𝐭𝐚𝐛𝐥𝐞 𝐚𝐧𝐝 𝐝𝐮𝐫𝐚𝐛𝐥𝐞 𝐝𝐞𝐬𝐢𝐠𝐧 - Roam 6 AX1500 is a pocket-sized travel router compactly designed for trips and adventures, featuring a 1 Gbps WAN/LAN port and a 1 Gbps LAN port for reliable wired connectivity.
  • 𝗦𝗲𝗰𝘂𝗿𝗲 𝗪𝗶-𝗙𝗶 𝗼𝗻-𝘁𝗵𝗲-𝗴𝗼 - Connects to public Wi-Fi and creates a private, secure network for all your devices. Supports multiple devices at once, ideal for hotels, Airbnbs, airports, and even home use. VPN connectivity enables secure remote work.
  • 𝐌𝐮𝐥𝐭𝐢𝐩𝐥𝐞 𝐰𝐚𝐲𝐬 𝐭𝐨 𝐜𝐨𝐧𝐧𝐞𝐜𝐭 - (1) Router Mode: Connects to public Wi-Fi, ISP, or phone (USB tethering). (2) AP/RE/Client Mode: Adds WiFi to wired setups, extends WiFi, or connects wired devices wirelessly.
  • 𝐎𝐮𝐫 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐜𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. Advanced security is integrated into the device’s design, development, and ongoing maintenance.

How do the main Mobile IPv4 options differ?

Choice What changes What stays the same
Foreign-agent versus co-located care-of address The tunnel endpoint and decapsulator: the foreign agent handles decapsulation in the first mode; the mobile node handles it in the second. The binding still maps the home address to a care-of address.
IP-in-IP, minimal, or GRE encapsulation The method used to carry the original datagram through the tunnel. RFC 3344 requires IP-in-IP support; minimal and GRE are optional. The tunnel delivers the original datagram to the registered endpoint.
Forward-only versus reverse tunneling Whether the mobile node’s outbound traffic is also sent through the home agent. Forward tunneling delivers traffic addressed to the mobile node’s home address.
Single versus simultaneous bindings Whether the home agent retains one care-of address or keeps simultaneous bindings as requested with the S flag. The binding associates the home address with registered delivery location information.
Broadcast forwarding requested or not Whether the home agent forwards broadcast datagrams for that registration; the B flag requests this behavior. Ordinary unicast forwarding still follows the registered binding.

What happens when a binding expires or broadcast traffic is involved?

The home agent forwards broadcast datagrams only for registrations that request them with the B flag. If a binding expires, the home agent deletes it without sending a new Registration Reply. A node therefore cannot rely on an expired binding to keep receiving tunneled traffic; it must have an active registration for the agent to use that location record.

Mobile IPv4 describes protocol behavior, not product support. The RFCs do not establish that a particular consumer router, VPN product, operating system, or training service implements Mobile IPv4; support must be checked for the specific product and version.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.