Scaleway BYOIP: your own IP addresses on Scaleway via a tunnel

Scaleway does not offer bring your own IP (BYOIP). Its IPAM FAQ, reviewed on 18 December 2025 and still there when we checked on 17 October 2026, says: "BYOIP is not currently available at Scaleway, but we are aware that there is a demand for this service." It suggests adding or upvoting a request on Scaleway's feature request site, where the BYOIP request is marked Declined, with Scaleway's reply of April 2021: "Won't do due to technical restrictions". The same FAQ says flexible IPs "are allocated from a pool of addresses, and you cannot specify an address when creating one". Dedibox sells failover IPs and /27 blocks through its own console, and no Scaleway page we found offers a way to announce a customer's prefix. Your own addresses can still reach a Scaleway server, through a tunnel.

The tunnel route

A network that can announce your block does so, and carries its traffic to your Scaleway server over GRE or WireGuard. The Instance, Elastic Metal server or Dedibox then uses the addresses as its own (how the tunnel works). Three things to get right:

• Replies go back through the tunnel. Without a policy route, the server answers through Scaleway's gateway with a source address Scaleway never assigned, and those replies are likely to be dropped. Route traffic from your block into the tunnel, as the GRE guide shows.
• Set the MTU. 1,476 bytes for GRE, around 1,420 for WireGuard, with MSS clamping if the server routes the block on to virtual machines.
• Open the firewall. In the console, an Instance security group takes TCP, UDP or ICMP rules. WireGuard needs one UDP rule for its port. GRE is IP protocol 47, so it needs a rule with protocol ANY, which the CLI and API accept. Limit that rule to the far end's address:

scw instance security-group create-rule security-group-id=<id> \
  protocol=ANY direction=inbound action=accept ip-range=192.0.2.1/32

A tunnel also does what BYOIP never does: it delivers fewer than 256 addresses, down to a single one.

Where RTM Networks fits

We announce a block and deliver it to a server at any provider over GRE or WireGuard, in any size down to a single address, so a Scaleway Instance, Elastic Metal server or Dedibox can use addresses Scaleway does not supply (GRE and WireGuard tunnels). If you need the addresses too, we lease /24s and larger from our own RIPE NCC address space (lease IPv4), and sell blocks in the RIPE NCC, ARIN and APNIC regions. Tell us which Scaleway product you run and how many addresses you need. Other providers: BYOIP guides.