Question: It is possible have public IP for my PC hooked up to XFINITY gateway (the router/modem combo) through wifi? My home network has several PCs connected to the XFINITY gateway through wifi. Each one has it's own private/local IP address of course. My PC has a web server running on it with web apps I'm developing (unlike my spouse's and kids PCs). So I'd like to be able to access my PC through a public IP to test my devel web apps without having to pay to third party for this service since I'm already paying Comcast for our Internet service at home. I've been developing for awhile, but new to networking as most of my development was done on workstation at work which already has public IP. Any help and suggestions will be greatly appreciated.
You could put your "web server" PC on a static private IP address and then configure the NA[P]T gateway feature inside your router to make that IP address be the "DMZ" (a.k.a. "default host", "bastion host", "default server", etc.). Or, since you maybe only care about web development, you could just make a small handful of port forwarding rules (port mappings), for TCP ports 80 and 443, and maybe also 8000, 8080, or whatever, if you have multiple websites you're developing in parallel.
You could then point a DNS hostname at your cable gateway's public IP address. In my experience, Comcast doesn't change my public IP address very often, so since I'm only "hosting" experiments and not real public websites that need serious uptime, that's good enough for me. I haven't looked into paying for a static public IP address. If Comcast changes your public IP address a lot, you could use a Dynamic DNS solution like Dyn.com (dyndns.org) to keep your public domain name pointed at your public IP address even when your public IP address changes.
Please note that for this to work well for you, your NAT gateway needs to support "NAT Loopback" (a.k.a NAT Hairpinning), which not all NAT gateways do. NAT Loopback is for when you're running, say, a web browser on one of your machines on your home LAN, and you go to the public domain name or public IP address of your website. Your NAT gateway has to do "outgoing NAT" on that packet, and then realize that the packet needs to turn right around and go through "incoming NAT" to get to your server on the private side of the gateway.
The reason people using port forwarding or DMZ features for this is because it's more likely to be supported in home gateways. The ability to do NA[P]T for some addresses, but bridge or route other addresses, is less common. The networking layer of Linux is almost infinitely configurable, so if you can put an aftermarket Linux firmware distro on your gateway, you might be able to configure it to do "NAT for some addresses, bridging for other addresses" like your were initially envisioning, but I've never set that up myself so I can't quite vouch for it.
I'd like to be able to access my PC through a public IP to test my [development] web apps without having to pay to third party for this service since I'm already paying Comcast for our Internet service at home.
This can be done with Comcast.
It is possible have a public IP for my PC hooked up to XFINITY gateway (the router/modem combo) through wifi?
Per anecdotal experience, Comcast gateways are not always reliable or easily configured. As a suggestion, rather than just using the gateway itself, a better option might be to simply put the gateway in "bridge" mode (so it effectively acts only as a modem) and buy a router with hairpinning (NAT loop back) as mentioned by @Spiff.
I personally use this setup (Bridge Mode + External Router) and have been extremely happy with it.
Note that if you do use the "bridge mode" method above, you might have to change the external router from using 192.168.1.x to use 10.0.0.x internal addresses (which is what the gateway will likely be using). If necessary, this usually a very simple process on most routers.
Setting Things Up
While you can set up a default host (which might be better for a number of reasons), port forwarding should be sufficient for most development needs.
The exact method of setting up port forwarding will depend on the gateway or router, but if you do so, you will want to forward port 80 (HTTP) at minimum and you will likely want port 443 (HTTPS) as well (for basic web development at least).
You can also forward ports for any other services you wish to be publicly available (e.g. DNS, SMTP, FTP, SSH, etc.) or non-standard ports (e.g 8080 for "alternative port" access to a web server).
Regardless, any forwards should point to the local IP (e.g 10.0.0.x) of the server handling the request (e.g where Apache or whatever program is installed).
Getting Your Public IP
Getting your public IP is fairly simple. You can just search "What's my IP?" on Google and it will return your current Comcast address.
Test Things In The Right Order
Ensure the server/service is working on localhost if possible.
Ensure that the server/service is available to the local network (e.g you can access your web server with a local IP from another device on the network.) This usually will inform you of firewall issues.
Test that you can access the server/service from the local network via your Comcast public IP. This will help inform you of any hairpinning issues.
Test that you can access the server/service from a non-local network (e.g with your phone over 3G/4G) via your Comcast public IP. This should tell you whether or not the server/service is truly available publicly.
If you picked a non-standard service port (e.g 8080), you will need to append that to the IP (e.g 10.0.0.10:8080 or 18.104.22.168:8080). For standard ports, this should not be necessary (e.g a web server on port 80).
While IPs are all well and good, if you don't want to use them (or need to test something that relies on domain names), you can register a domain name and point the DNS at your server (via your public IP).
Note that (currently) Namecheap FreeDNS will provide free dynamic DNS services with any registered domain you own (not just Namecheap) if you need that kind of setup.
AHare- Your current assumptions and testing have been spot on for what I have experienced as well. And unfortunately, Comcast has set up their modem/router access points with minimal functionality and have implemented a sort of "dummy mode" where in even the average tech idiot (or well for the most part) can simply just set up their WiFi, make a password, control the devices on it in some comical scheme...not allowing one to wander off into any advanced section (although yes said advanced section essentially only allows port forwarding)
They have configured it to be unable to do any hosting in the way you describe, they do this I can only assume because they want you to have to pay more and upgrade to some Business Tier package which will allow some sort of functionality in this way (although most likely still limited) and it will certainly not be cheap.
Now...it may be possible to put your modem/router into bridge mode (essentially turning it back into just a modem and also stopping the Xfinity WiFi signal to be broadcast for others to use...which is not a security risk but more so a speed, QoS, and performance issue...just think about it I mean if another Comcast customer who pays for internet is connected to your gateway via the Xfinity Wifi and chewing up data its not going to show up as you using it...However you better believe that it is slowing down your connection. As much as I love connecting to this Xfinity Signal to save mobile data when I am out...I choose to nix it on my gateway. Besides it really only is of impact if you live in an urban setting (my brother actually went without an internet plan for 10 months in his apartment because the neighbors upstairs had their gateway right above his place most likely on the floor and he could just connect to the XFinity signal at all times even on Xbox and other consoles. I digress...
Comcast also changes your WAN IP more often than you would think...although it can be somewhat random. So if you bridge mode your gateway and then buy a router which supports some sort of hosting feature. I personally like to flash routers and just install DD-WRT firmware to unlock all the features of the router which many times are hidden by Linksys or Netgear etc etc. Set up your port to connect via when out and any other settings. And then it MAYYYYY be possible to do what your trying. I stress may because your still having to route through the modem which may have some features to specifically stop this even when placed in bridge mode. Or it may work perfect until they change your WAN and then you just might need to figure that small fix out. Bottom line...Comcast is only concerned with the most basic of features that 99% of their customers are worried about...which is essentially just make that darn internet work and make it easy for me to name my WIFI network and set a password...