No cloud or hosting provider takes less than a /24 through bring your own IP, and none could. Networks across the internet drop routes smaller than a /24, so a /25 announced on its own would reach almost nobody. If you need your own addresses but fewer than 256 of them, there are three ways that work, and three that do not.
Why a /24 is the floor
Every network on the internet keeps a table of routes, and to keep that table manageable, nearly all of them accept IPv4 routes no smaller than a /24 and quietly discard anything longer. A /25, a /28 or a single address can only be reached as part of a /24 that some network announces as a whole.
That is why no provider's BYOIP goes below a /24 (the provider guides); Alibaba Cloud starts higher still, at a /23. It is not a commercial choice the provider could make differently for you. A smaller block simply would not be reachable from most of the internet.
Option 1: take the whole /24
If you need a hundred addresses, a full /24 is often less of a stretch than it sounds, and it is the cleaner answer. You bring it to your provider through its normal BYOIP process, it is announced like any other block, and you have room to grow. Leasing one avoids the capital outlay of buying, and our lease prices are published (pricing). Azure wants the block registered in your own name, and Oracle Cloud's list of accepted statuses leaves out ASSIGNED PA, the usual status of leased IP address space, so check those two with us first.
The downside is plain: you pay for 256 addresses when you use fewer.
Option 2: a tunnel delivers exactly what you need
A network that announces a full /24 can hand a smaller part of it to your server over a tunnel: a /29, a /28, or a single address. Traffic for those addresses reaches the network that announces the block, travels through a GRE or WireGuard tunnel to your server, and your server uses the addresses as if they were configured locally (how the tunnel works).
What that gets you:
- Any provider. It works where BYOIP is not offered at all, at Hetzner Cloud for example (Hetzner), because the provider only has to carry the tunnel.
- Addresses that stay yours. When you move, the tunnel moves with your server, and the addresses, their reputation and every allowlist they are on come along.
- No ASN, no ROA work on your side. The network at the far end announces the block.
The costs are the ones every tunnel has: traffic takes a detour to the tunnel's far end, the tunnel's capacity sets a ceiling, and the MTU is a little smaller than on a plain link. For most services that need a handful of stable addresses, none of the three matters much.
Option 3: the provider's own extra addresses
Most providers sell additional IPv4 addresses from their own pools, as failover, floating or elastic IPs. They are quick to add and work immediately. They are also the provider's: they stay behind when you leave, the allowlists your partners keep have to change, and you inherit whatever reputation the previous user left on them.
That is fine for addresses that only need to work, at one provider, for now.
What does not work
- Announcing a /25 or smaller yourself over BGP. It will be filtered almost everywhere, however good your session and your ROA.
- Asking a cloud to bring in a /26. Every provider's BYOIP takes a /24 or larger, so a smaller block is turned down before provisioning starts.
- Splitting a /24 across two clouds through BYOIP. At most providers a range lives in one place at a time. A tunnel can serve parts of a block in several places; BYOIP generally cannot.
Which to choose
| You need | What fits |
|---|---|
| Close to 256 addresses, at a provider with BYOIP | Buy or lease a /24 and bring it |
| A handful of addresses that must stay yours | A tunnel |
| Addresses that only need to work, at one provider | The provider's own |
Where RTM Networks fits
We do both of the first two. We lease /24s and larger for BYOIP, with the ROA, the registry record and the Letter of Authorization set up for your provider, and we deliver smaller blocks over GRE or WireGuard to a server at any provider, down to a single address (GRE and WireGuard tunnels). Tell us how many addresses you need and where your servers are, and we will say which of the two fits.
Contact
Need advice on your own situation?
This article is general; your network is not. Tell us what you are working with and we will look at it properly. We usually reply in 1-3 business hours.
