IBM Cloud BYOIP: bring your own IPv4 to VPC (beta)

You open a support case with a signed letter of authorization, IBM provisions the range itself, and you then allocate addresses from it.

What IBM Cloud accepts

From IBM's documentation, on the day we checked:

• Who. Allowlisted accounts only; the beta, announced on 29 September 2026, "is available for evaluation and testing purposes to select customers". IBM's pages do not say how an account gets on the list.
• Size. A /24 at the smallest and a /8 at the largest, IPv4 only, not overlapping anything else in your account. Up to five ranges per account per region.
• Ownership. "You must own the public IPv4 address range that you want to use." IBM names no registries and says nothing about PA, PI or legacy space.
• Who originates. Not published. The letter of authorization asks networks to accept the prefixes "when originated by IBM".
• Where. One region per range, usable in every zone of that region.
• What uses it. Floating IPs, which are single addresses on a virtual network interface or a public gateway, and public address ranges, which are blocks bound to a VPC zone. IBM lists virtual server instances, bare metal servers, load balancers, VPN gateways and network appliances.
• Price. No BYOIP fee is published. The console shows an estimated cost when you reserve a floating IP, and egress bandwidth charges apply.
• Timing. Provisioning "typically takes a minimum of two weeks".

Before you start

A place on the allowlist. Ask IBM Support or your IBM contact about it before you prepare anything else.

A letter of authorization (LoA) on company letterhead, signed. IBM's template authorizes IBM to announce the prefixes "to all of its directly connected BGP peers" and gives IBM "full permission to maintain Internet Routing Registry (IRR) objects" for them. The Provision custom CIDR dialog in the console also has a Download template button.

An answer on the ROA. IBM's BYOIP pages mention no ROA, RPKI, ASN or route object. Ask in the case which ASN will originate the range, and create the ROA for it before IBM announces (RPKI and ROAs). Until then, keep the ROA for whatever announces the range today.

The case details: the prefix, the destination region, and IPv4 with ownership Customer.

Step by step

01Open the request. In the console, go to Infrastructure, Network, Public address ranges, open the Custom authorized CIDRs (BYOIP) tab and click Provision custom CIDR, then Create support case.

02Fill in the case. With a Platinum, Premium or Advanced support plan, choose Category Account, Topic Account, Subtopic Bring your own IP to VPC. With Basic support, choose Topic Virtual Private Cloud (VPC), Subtopic Bring your own IP to VPC. Use the subject Authorize custom CIDR (BYOIP). In the description, select Provision CIDR, enter IPv4, ownership Customer and the region, and attach the signed LoA.

03Wait. IBM reviews the request and provisions the range. When the case closes, check that it is there:

ibmcloud is public-address-range-authorized-cidrs

04Allocate addresses. A floating IP from your range:

ibmcloud is floating-ip-reserve my-byoip-fip --address 203.0.113.10 --zone us-south-2

Or a public address range, bound to a VPC and zone:

ibmcloud is public-address-range-create --name my-range --cidr 203.0.113.16/28 \
  --vpc my-vpc --zone us-south-2

05Route a public address range. Add a public ingress route with the range as destination and your appliance's IP address as next hop. IBM's routing page says public ingress routing is available in the console only for now, with the CLI and API to follow. Floating IPs need no extra routing.

Pitfalls

• The range does not show up. Check that you are looking in the region you named in the case. IBM's pages give no time for the range to appear after the case closes, so if it is still missing, reply to the case.
• A public address range carries no traffic by itself. Without the ingress route, nothing arrives.
• Floating IPs attach only to a virtual network interface or a public gateway, not to legacy network interfaces.
• Changing region means starting over. You release everything allocated from the range, open a case to deprovision it, which takes a minimum of two weeks, and then provision it again.
• A page that says otherwise. IBM's planning page for public address ranges still lists "Bringing your own public IP or subnet is not supported" among its limitations, above its own BYOIP section. The BYOIP pages are the ones to follow.

If you lease the block

IBM's provisioning page says you must own the range. Its LoA template, though, has separate fields for the company whose prefixes they are and the customer IBM announces them for, and it is signed by the company that holds them. IBM says nothing else about leased space. Ask in the support case whether IBM accepts a range that another company holds and signs for, before you commit to a lease. If it does, the holder signs the LoA, creates whatever ROA IBM names, and accepts that IBM maintains the IRR objects for the prefix.

Where RTM Networks fits

We lease /24s and larger from our own RIPE NCC address space, and sell blocks in the RIPE NCC, ARIN and APNIC regions. If IBM wants a range you own, we sell one (buy IPv4). If it accepts leased space, then for space leased from us we create the ROA for the ASN IBM names and sign the letter of authorization (lease IPv4). While your account is not in the beta, or if you need fewer than 256 addresses, we announce a block and deliver it to your virtual server over GRE or WireGuard, down to a single address (GRE and WireGuard tunnels). Other providers: BYOIP guides.