Hetzner BYOIP: using your own IP addresses at Hetzner

Hetzner's cloud servers and standard dedicated servers use addresses that Hetzner assigns, and its documentation for them says nothing about bringing your own: on those, the way to use your own addresses is a tunnel, option 2 below. What Hetzner arranges on request is option 1, for custom bare-metal setups.

Option 1: Hetzner's BGP upstream

Hetzner lists this under its colocation special offers as an internet upstream with a personal, redundant BGP session. On the day we checked, its documentation said:

• You bring the ASN and the addresses. The upstream "requires an own ASN", you announce your own IP addresses, and Hetzner supplies none for it.
• Two uplinks. The connection terminates on two redundant backbone routers, with a BGP session on each, over two /30 transfer networks, which Hetzner bills separately.
• Where. Custom solutions for dedicated servers, which connect through a private network interconnect, so their location does not matter. Colocation racks and cages in Falkenstein (FSN1-DC2), Nuremberg (NBG1-DC2 and NBG1-DC4) and Helsinki (HEL1-DC1), though Hetzner cannot provide colocation space for now.
• Cabling. It needs cabling to Hetzner's meet-me room, or the private interconnect for bare metal, and the standard 1 Gbit copper uplink is switched off.

Traffic is billed at €1 per TB on top, and each of the two /30 transfer networks at €6.00 a month plus €17.50 setup. All of these prices exclude VAT. Hetzner's prices change, so check the page linked at the top of this guide before you budget.

What you prepare

1. An AS number. If you do not have one, a sponsoring LIR can arrange it for you (ASN sponsorship).
2. A /24 or larger. Hetzner publishes no minimum for this upstream, but the rest of the internet filters anything smaller than a /24, so that is the practical floor.
3. A ROA naming your ASN for the prefix, with the maximum length set to what you will announce (RPKI and ROAs).
4. A route object for the prefix with your ASN as origin, and an aut-num object that lists Hetzner's network, AS24940, as your upstream.
5. A BGP speaker on your side: your router, or BIRD or FRR on a server.

The sessions

Ask Hetzner for the upstream through your account, giving your ASN and the prefix. Hetzner assigns the two transfer networks; you then bring up one session per uplink and announce only your prefix. A minimal session in BIRD 2, with documentation values (64500 for your ASN, 203.0.113.0/24 for your block, 192.0.2.1 for Hetzner's side of the first transfer network):

protocol bgp hetzner1 {
  local as 64500;
  neighbor 192.0.2.1 as 24940;
  ipv4 {
    import all;
    export filter { if net = 203.0.113.0/24 then accept; reject; };
  };
}

The second session is the same against the second transfer network. Check the announcement from outside, with a looking glass or an RPKI validator, before you move traffic onto it.

Option 2: a tunnel, for Hetzner Cloud and dedicated servers

If your servers are in Hetzner Cloud or on standard dedicated machines, there is no BGP session to have. You can still use your own addresses on them: a network that can announce the block does so, and a GRE or WireGuard tunnel carries its traffic to your Hetzner server and back. The server sees the addresses as if they were local (how the tunnel works).

Three things to get right:

• Replies go back through the tunnel. Add a policy route so that traffic from the block leaves through the tunnel, as the GRE guide shows. Sent straight out, it would carry a source address Hetzner never assigned to the server, and networks filter such traffic.
• Open the firewall for the tunnel. If you use the Hetzner Cloud Firewall, allow GRE (IP protocol 47) or WireGuard's UDP port from the far end of the tunnel.
• Set the MTU. 1,476 bytes for GRE, around 1,420 for WireGuard, with MSS clamping if the server routes the block on to virtual machines.

A tunnel also solves the problem BYOIP never does: it can deliver fewer than 256 addresses, down to a single one.

If you lease the block

With the BGP upstream, the holder of the block does the registry work: the ROA for your ASN, the route object, and, if Hetzner asks for one, a letter of authorization that names your ASN and Hetzner as the network carrying it. With a tunnel, nothing changes at Hetzner at all; the network at the other end announces the block, and the holder only needs to authorize that network.

Where RTM Networks fits

We lease /24s and larger with the ROA, the route object and the letter of authorization set up for your ASN, and we sponsor AS numbers for organizations that do not run their own LIR. For Hetzner Cloud and dedicated servers, we announce the block ourselves and deliver it to your server over GRE or WireGuard, in any size from a single address (GRE and WireGuard tunnels). Tell us which Hetzner product you run and how many addresses you need. More providers are in our BYOIP guides.