Infomaniak BYOIP: your own IP addresses in Infomaniak Public Cloud

What Infomaniak documents is a permission for your project, so this guide sets out what to settle in your request to Infomaniak support before you move a service.

What Infomaniak accepts

From Infomaniak's Public Cloud documentation, on the day we checked:

• Size, registries and status. Not published.
• Who originates. Not published: Infomaniak does not name the ASN, or say whether it wants a ROA, a route object or a letter of authorization.
• Where. Infomaniak Public Cloud. Its external networks "are managed by Infomaniak administrators", and standard floating IPs come from its ext-floating1 network. Its page on networks and subnets names bringing your own CIDR as one use of provider networks, which Infomaniak creates and which cannot be selected when you boot an instance. Question 4 of the request below asks which network will carry your range.
• Price and timing. Not published.
• How you get it. Through a BYOIP role, listed next to the standard reader and member roles "for advanced features", which "must be activated by Infomaniak support before use". Activation takes three steps: "Contact Infomaniak support", "Provide use case and IP range details", "Wait for approval and activation".

The role unlocks four networking calls that the reader and member roles cannot make:

Before you start

Infomaniak's documented step is a support request with "use case and IP range details". A complete request saves a round trip:

• The range and its record. The prefix, the registry, the holder named in the record, and whether the range is announced anywhere today.
• The use case. Floating IPs on instances, a router or firewall instance that needs allowed address pairs, or a migration that must keep its addresses.
• The origin. Ask which ASN Infomaniak will announce the range from. If the block has ROAs and none names that ASN, networks that validate RPKI drop the route (RPKI and ROAs).
• The project. The Public Cloud project that needs the role.

Step by step

01Ask Infomaniak support for the BYOIP role, with the range, the use case and the project listed above.

02Wait for approval and activation. Infomaniak gives no timing.

03Update the registry with what Infomaniak asks for, before it announces the range.

04Create the addresses. With the role, the floating IP call accepts a specific address. In the OpenStack CLI, with the network from question 4:

openstack floating ip create --floating-ip-address 203.0.113.10 <network>
openstack server add floating ip <server> 203.0.113.10

For automation, Infomaniak's documentation says application credentials must be created with the role you need. Its page on them does not list a BYOIP role among the roles a credential can carry, so ask support how to give a credential the BYOIP role.

Pitfalls

• Treating the role as the whole service. The role is a permission. Whether the range works depends on the routing side, which Infomaniak does not document: who announces it, from which ASN, and what the registry must say. Get those answers in writing before you move a service.
• Port security. Disabling it on a port also disables that port's security groups, in Infomaniak's own description. A router or firewall instance then needs its own filtering.
• The old announcement. If the range is announced elsewhere today, add a ROA for Infomaniak's ASN before the switch, and withdraw the old announcement once Infomaniak's is live. Two origins split the traffic.
• Smaller than a /24. Infomaniak publishes no minimum, but networks across the internet filter anything smaller than a /24. For a few addresses, a tunnel is the practical route.

If you lease the block

Infomaniak publishes no rule on leased space: nothing says the range must be registered to your organization, or that you must be an LIR. Name the holder in your request. The holder does the registry side, since only the holder's maintainer can change the records: the ROA for the ASN Infomaniak names, a route object if Infomaniak wants one, and a letter of authorization if it asks for one.

Where RTM Networks fits

We lease /24s and larger from our own RIPE NCC address space (lease IPv4), and sell blocks in the RIPE NCC, ARIN and APNIC regions. For space leased from us, we create the ROA and the route object for the ASN Infomaniak names, and sign the letter of authorization. If you need fewer than 256 addresses, or addresses before Infomaniak has decided, we announce a block and deliver it to your Infomaniak instance over GRE or WireGuard, down to a single address (GRE and WireGuard tunnels). Other providers: BYOIP guides.