UpCloud BYOIP: your own IP addresses in a Private Cloud

For Cloud Servers in UpCloud's public zones, the way to use your own block is a tunnel, which this guide covers too.

What UpCloud accepts

From UpCloud's documentation, on the day we checked:

• Private Cloud only. Private Cloud runs your Cloud Servers on dedicated hosts. UpCloud says it "offers the possibility for dedicated public IP blocks, and it is possible to utilise your own IP blocks (BYOIP)."
• Through sales. Its networking FAQ asks "Can I bring my own IPs or IP range?" and answers: "Yes, you can do this in our Private Cloud. Contact our sales team for more information." UpCloud documents no console, API or CLI steps for it.
• Where. A Private Cloud sits inside a parent public zone, one of UpCloud's 15 locations.
• Terms. The Private Cloud page answers "Can I bring my own IPs?" with: "Yes. UpCloud supports Bring Your Own IP (BYOIP). Your prefixes can be announced via BGP (subject to validation and LOA). Availability and prefix size requirements depend on the target region."
• Not published. Which registries UpCloud accepts, the origin ASN, a price for BYOIP itself and the lead time.
• Private Cloud price. Configurations start at €3,190 a month, on a quote for each customer.
• Public zones use UpCloud's addresses. A Cloud Server gets one IPv4 and one IPv6 address by default and can have up to five public IPv4 addresses. Additional IPv4 addresses are billed by the hour.
• Floating IPs are UpCloud's too. They are IPv4 addresses your account reserves, billed per address, and they move between Cloud Servers in the same data center. They are not available for IPv6.

Before you start

UpCloud names two requirements, validation and a letter of authorization, and leaves the rest to the conversation with sales. Prepare what every provider that announces customer space asks for, and confirm each point:

1. A /24 or larger. UpCloud says prefix size requirements depend on the region, and networks filter anything smaller than a /24.
2. The registry record. Know which registry holds the block (ARIN, the RIPE NCC or APNIC, for example) and which organization the record names.
3. A ROA for the announcing ASN, UpCloud's or yours, with the maximum length set to what is announced (RPKI and ROAs). Create it once UpCloud names the ASN.
4. A route object with the same ASN as origin.
5. A letter of authorization, which UpCloud asks for, signed by the holder of the block and naming UpCloud as the network that will carry it.

The tunnel route

For Cloud Servers in the public zones, or while the Private Cloud conversation runs, a tunnel puts your block on the server without UpCloud changing anything. A network that can announce the block does so, and a GRE or WireGuard tunnel carries its traffic to your server and back (how the tunnel works).

The server keeps the IPv4 address UpCloud assigned to it. That address is the outer end of the tunnel: the far side sends encapsulated packets to it, and UpCloud's network sees ordinary traffic between two public addresses. The leased block travels inside the tunnel. You configure its addresses on the tunnel or loopback interface, and the server answers on them as if they were local.

• Replies go back through the tunnel. Add a policy route so that traffic from the block leaves through the tunnel. Sent straight out, it would carry a source address UpCloud never assigned to the server, and networks filter such traffic.
• Open UpCloud's firewall both ways. If you use it, note that it is stateless: rules must allow incoming and outgoing traffic explicitly. Its rules match TCP, UDP or ICMP. For GRE, which is IP protocol 47, leave the protocol at All and limit the rule to the far end's address. For WireGuard, allow its UDP port.
• Set the MTU. 1,476 bytes for GRE, around 1,420 for WireGuard, with MSS clamping if the server routes the block on to virtual machines.
• Any size. A tunnel delivers fewer than 256 addresses, down to a single one, which BYOIP never does.

Pitfalls

• Relocation stops at customer-owned addresses. UpCloud's Relocate Server feature moves a server between Public and Private Cloud zones in the same data center, with one network limitation: "The server cannot have IP addresses from a dedicated, customer-owned IP network." Plan where your block lives before you migrate.
• The free trial blocks ports. During UpCloud's free trial some ports are blocked and the network runs at 100 Mbit/s. After the first payment every port except 25 is open, so test a tunnel after that.

If you lease the block

UpCloud publishes nothing about leased space or whose name the registry record must carry, which is why the request above asks. For Private Cloud BYOIP, the holder does the registry side: the ROA for the ASN UpCloud names, the route object, and the letter of authorization UpCloud asks for. With a tunnel, nothing changes at UpCloud: the network at the other end announces the block, and the holder only needs to authorize that network.

Where RTM Networks fits

We lease /24s and larger from our own RIPE NCC address space, and sell blocks in the RIPE NCC, ARIN and APNIC regions. Every lease includes the ROA, the route object, PTR records and a Letter of Authorization whenever you need one (lease IPv4). For a Private Cloud, we create the ROA for the ASN UpCloud names and sign the letter of authorization, and we sponsor AS numbers for organizations that do not run their own LIR (ASN sponsorship). For Cloud Servers in the public zones, we announce the block ourselves and deliver it over GRE or WireGuard, in any size down to a single address (GRE and WireGuard tunnels). Other providers: BYOIP guides.