IP address not matching that of DDNS entry

[UncleMike]

For over 1 year I was using my Galaxy Nexus on Straight Talk (AT&T) to access my home server via SFTP using ES File Explorer. In order to make things more secure, I setup the firewall on my home server to allow SFTP connections only from my phone. To accmplish this I setup a DDNS host entry for my phone with no-ip.com, and would update the entry any time my phone switched from Wifi to mobile data, and vice versa. Once I got everything working, it continued to work without issue.

I have since switched to GoPhone, and have run into a problem I'm not sure how to fix. What's happening is that the external (routable) IP address reported to my phone by sites like ipecho.net and whatismyip.com doesn't match the source address for the incoming SFTP connections on my server. Everything still works fine when I'm on the same LAN as my server, as well as when I'm connected to Wifi at a remote location (I can succesfully connect when connected to Wifi at a local Starbucks).

The only explanation I can come up with for this different IP addresses is that AT&T is routing my SFTP traffic differently than my HTTP traffic. Would this have anything to do with my APN settings? Here they are:

Name: AT&T Phone
APN: phone
Proxy: not set
Port: not set
Username: not set
Password: not set
Server: not set
MMSC: not set
MMS proxy: not set
MMS port: not set
MCC: 310
MNC: 410
Authentication type: not set
APN type: default,supl,hipri,dun
APN protocol: IPv4
APN roaming protocol: IPv4
APN enable/disable: APN enabled (grayed out)
Bearer: unspecified
MVNO type: None
MVNO value: not set (grayed out)

Name: AT&T US MMS
APN: phone
Proxy: not set
Port: not set
Username: not set
Password: not set
Server: not set
MMSC: http://mmsc.mobile.att.net
MMS proxy: proxy.mobile.att.net
MMS port: 80
MCC: 310
MNC: 410
Authentication type: not set
APN type: mms
APN protocol: IPv4
APN roaming protocol: IPv4
APN enable/disable: APN enabled (grayed out)
Bearer: Unspecified
MVNO type: None
MNVO value: not set (grayed out)

Any ideas on how I can get this working without opening up my firewall further?

 

[Rukbat]

What's happening is that the external (routable) IP address reported to my phone by sites like ipecho.net and whatismyip.com doesn't match the source address for the incoming SFTP connections on my server.

Set the router to accept connections from your no-ip address. Work on security from that point inward.

 

[UncleMike]

The firewall on the router is already configured to reject all incoming traffic except on forwarded ports, and I see no way to restrict further based on source IP address. And even if I could, the source IP address for traffic coming from my phone when on AT&T doesn't match the no-ip address, so restricting the traffic at the router would just stop the traffic at the router instead of letting it reach the firewall on the server (where it's currently being rejected).