Mobile operators assign a private IP address from the 10.xyz area to a mobile client on a 3G / 4G connection. These addresses from a local area then leads the provider via NAT to the Internet. Multiple clients share a public IP address. Surfing works, but no device connected via 3G / 4G can be reached directly from the internet.
For VPN connections, this must at most be taken into account in the configuration. For IPSec connections with IKEv1 you have to enable NAT traversal or better set equal to IKEv2. The tunnel must initiate the device with the 3G / 4G connection.
The service CAA service (Corporate Application Access) for public, non-fixed IP addresses will no longer be offered and should be discontinued by 2019 (as of May 2018).
Request for public, dynamic IP address for VPN service. After activation, change the APN to remote . The service is offered in the area for business customers.