Bring your own IP
Bring your own IP, provider by provider
How to use your own IPv4 addresses at the cloud and hosting providers people ask us about: whether each offers BYOIP, what it asks for, which ASN your ROA must name, and what to do where it does not.
Bring your own IP (BYOIP) lets a provider announce address space you hold or lease from its own network, so your servers there use your addresses instead of the provider's. Your addresses stay yours when you move, keep their reputation and the allowlists they are on, and at the large clouds they avoid the hourly charge for public IPv4.
Every provider does it differently, and several do not do it at all. Each guide says what the provider offers, what it asks for and how to set it up, from the provider's own documentation, with the date we last checked it.
Bringing leased space
You do not have to own the block. With leased space the holder does the registry work: the ROA for the provider's ASN, the token or certificate in the registry record, and the letter of authorization. A few providers want the block registered in your own name, so read the guide before you sign anything.
What every provider asks for
- A /24 or larger, registered to an organization. No provider in these guides accepts less, and Alibaba Cloud starts at a /23.
- Proof that the block is yours to bring: a token or certificate in the registry record, a letter of authorization, or both.
- A ROA naming the ASN that will originate the route: usually the provider's, sometimes your own.
- A route object for the same prefix and origin in a routing registry.
- A plan for the cut-over: most providers want to be the only network announcing the prefix.
Providers
BYOIP available
A documented procedure you run yourself, in the provider's console or API, sometimes after asking for access.
AWS
AWS takes a /24 or larger from ARIN, the RIPE NCC or APNIC into an EC2 address pool. The ROA, the certificate in the registry record, and the CLI steps.
- Smallest block
- /24
- ROA names
- AS16509 and AS14618, or your own ASN
- Checked
Azure
Azure takes a /24 or larger registered in your name as a custom IP prefix. The ROA for AS8075, the certificate in the RDAP record, and the CLI steps.
- Smallest block
- /24
- ROA names
- AS8075 (AS8070 for US Gov Cloud)
- Checked
DigitalOcean
DigitalOcean takes a /24 to /18 from ARIN, the RIPE NCC, APNIC or the other registries after you request access. The ROA for AS393406 and the doctl steps.
- Smallest block
- /24
- ROA names
- AS393406
- Checked
Google Cloud
Google Cloud takes a /24 or larger once a ROA names its ASN and a PTR record carries its secret. The addresses are free; provisioning takes weeks.
- Smallest block
- /24 (Premium Tier), /23 (Standard Tier)
- ROA names
- AS396982 (Premium Tier) or AS19527 (Standard Tier)
- Checked
Oracle Cloud Infrastructure
OCI takes a /24 to a /8 from ARIN, the RIPE NCC or APNIC, with a token in the registry record and a ROA for AS31898. Allow up to 10 business days.
- Smallest block
- /24
- ROA names
- AS31898 (AS14544 in Serbia Central), or your own ASN
- Checked
OVHcloud
OVHcloud imports a /24 to /19 from the RIPE NCC, ARIN or APNIC as Additional IPs, at no extra cost. The token, the route object and the order, step by step.
- Smallest block
- /24
- ROA names
- AS16276, or your own ASN
- Checked
Vultr
Vultr takes up to five prefixes, IPv4 from /24 to /16, announced over BGP from your instance. The ROA, the LOA for AS20473, the checks and the BIRD setup.
- Smallest block
- /24
- ROA names
- Your own ASN, or AS20473 with a Vultr private ASN
- Checked
Providers
BYOIP on request
Possible through sales, support or a ticket, even where the steps are documented. Sometimes for selected products or customers only.
Alibaba Cloud
Alibaba Cloud takes a /23 or larger by ticket, in nine regions outside the Chinese mainland, announced from AS45102. Setup takes about a month.
- Smallest block
- /23
- ROA names
- AS45102 only
- Checked
Cherry Servers
Cherry Servers takes a /24 to a /20, announced from its ASN or from yours, for a one-time €200 fee per request. The ROA, the letter, the aut-num and BGP.
- Smallest block
- /24
- ROA names
- Cherry Servers' ASN for the location, or your own ASN
- Checked
Cloudflare
Cloudflare BYOIP is Enterprise-only: a /24 or larger, announced from AS13335 for Magic Transit, Spectrum, CDN or Gateway. The checks, the LOA and the API steps.
- Smallest block
- /24
- ROA names
- AS13335, or your own ASN through the account team
- Checked
Gcore
Gcore takes your prefixes through sales or support, announced from its ASN or yours, and sells BGP on dedicated servers. What it asks for and what it omits.
- Smallest block
- /24 for CDN; none published for Edge Cloud
- ROA names
- Gcore's ASN (number not published) or your own
- Checked
Hetzner
Hetzner Cloud and dedicated servers take only Hetzner's addresses. Custom bare metal can announce yours over BGP with your own ASN; a tunnel covers the rest.
- ROA names
- Your own ASN, over a BGP session
- Checked
IBM Cloud
IBM Cloud VPC takes your own IPv4, /24 to /8, as a beta for allowlisted accounts. IBM provisions it from a support case with a signed LoA, in two weeks or more.
- Smallest block
- /24
- Checked
Infomaniak
Infomaniak Public Cloud has a BYOIP role that support activates once you give your use case and range. What it publishes, what it does not, and what to ask.
- Checked
IONOS
IONOS Cloud takes a /24 or larger, IPv4 only, from AS8560 or your own ASN. The approval letter, the ROA and route object, and up to five business days.
- Smallest block
- /24
- ROA names
- AS8560, or your own ASN
- Checked
Leaseweb
Leaseweb announces your /24 or larger from its own ASN, never yours, on dedicated servers, racks and VMware. The ROA, route object and LOA it needs.
- Smallest block
- /24
- ROA names
- Leaseweb's ASN for the data center, never yours
- Checked
TransIP
TransIP links a /24 or larger to OpenStack on request, for €250 setup and €52.50 a month, and requires LIR membership. What it publishes, step by step.
- Smallest block
- /24
- Checked
UpCloud
UpCloud takes your own IP blocks only in its Private Cloud, through sales, announced over BGP after validation and an LOA. Elsewhere it uses its own addresses.
- Checked
Providers
No published procedure
The provider publishes nothing about BYOIP. Ask them, or use a tunnel.
Akamai Cloud (Linode)
Akamai Cloud, formerly Linode, does not document BYOIP. Linode said no in 2022 and 2023, and we found nothing newer. How to ask, and the tunnel route.
- Checked
Contabo
Contabo publishes nothing on bringing your own IP addresses. It sells its own extra IPv4, 1 to 25 per server. The tunnel route instead.
- Checked
Exoscale
Exoscale publishes nothing on bringing your own IP addresses, and its Elastic IPs are its own. How a tunnel delivers your block.
- Checked
Hostinger
Hostinger gives each VPS one dedicated IP address and says no more can be attached. It says nothing about BYOIP. The tunnel route instead.
- Checked
Providers
BYOIP not offered
The provider says it does not take your address space. A tunnel still gets it to your server.
Alternatives
No BYOIP at your provider?
Ask. Several providers handle BYOIP through sales or support without saying so on their website. Send them the prefix, its registry, who holds it and the ASN you want to announce from, and ask whether they accept it and under which ASN.
Or bring the addresses over a tunnel. We announce the block and deliver it to your server over GRE or WireGuard at any provider, including for fewer than 256 addresses, which no provider accepts through BYOIP.
Contact
Need a /24 to bring?
We lease /24s and larger from our own RIPE NCC address space, and sell blocks in the RIPE NCC, ARIN and APNIC regions. For space leased from us, we set up the ROA, the registry record and the Letter of Authorization for your provider. We usually reply in 1-3 business hours.
FAQ
BYOIP questions
Can I bring leased IP addresses to a cloud provider?
Usually, yes. The holder of the block creates the ROA for the provider's ASN, adds the provider's token or certificate to the registry record and signs the letter of authorization; we do all three for space leased from us. A few providers want the block registered in your own name, so read the provider's guide first.
What is the smallest block I can bring?
A /24, 256 addresses, at every provider in these guides except Alibaba Cloud, which starts at a /23. Smaller blocks are not accepted because networks filter announcements longer than a /24. For fewer addresses, a tunnel is the way round it.
Which ASN does the ROA need to name?
The ASN that originates the route. At most providers that is their own (AS16509 and AS14618 at AWS, AS8075 at Azure, AS396982 at Google Cloud), while a few let you announce from your own ASN. Each guide names the ASN to use.
How long does onboarding take?
From hours to weeks, depending on the provider: Azure documents hours, Oracle Cloud up to ten business days and Google Cloud several weeks. The registry work on your side, the ROA and the record changes, is usually the faster part.
Does BYOIP save money?
At the large clouds it can: they bill every public IPv4 address they provide by the hour, and AWS, Azure and Google Cloud do not charge that fee for addresses you bring. Whether it pays depends on how many addresses you use and what the block costs you to lease or buy.
Services
Related services
Other ways we help with IPv4 address space.
Lease IPv4
Rent IPv4 addresses on flexible terms
Buy IPv4
Purchase IPv4 address blocks outright
GRE tunneling
Your IPv4 space, routed to your own servers
Further reading
The real cost of public IPv4 in AWS, Azure and Google Cloud
Every major cloud bills public IPv4 by the hour. What that adds up to over a year, and how bringing your own space changes the arithmetic.
Read more