IONOS BYOIP: bring your own IPv4 addresses to IONOS Cloud

You create a route object and a ROA that name IONOS's ASN, send IONOS Cloud Support a completed approval letter, and the block appears in IP Management. From the moment you ask, the block must not be announced anywhere else.

What IONOS accepts

From IONOS's documentation, on the day we checked:

• Size. "Each submitted subnet must be at least /24 (256 IP addresses minimum)." Smaller subnets are not eligible.
• IPv4 only. "IPv6 is currently not supported", although the overview on the same page mentions IPv6.
• Registry. The steps are written for the RIPE NCC. ARIN and APNIC are named as registries where the steps differ but the principles are the same.
• Rights. You must have the exclusive right to the range. PA, PI and legacy space are not mentioned.
• Who originates. AS8560, IONOS Cloud's ASN, or your own ASN, which IONOS calls BYOASN. Either way, IONOS "requires all BYOIP and BYOASN prefixes to be RPKI validated".
• Where. You name the data center. IONOS points to its list of locations: Berlin, Frankfurt, Karlsruhe, London, Worcester, Logroño, Paris, Las Vegas, Newark and Lenexa.
• Price. No fee for the onboarding is published. IONOS says there are no additional leasing or rental fees, bills the traffic at the rates of its own addresses, and covers the addresses with its DDoS protection.
• Timing. Up to five business days after IONOS receives the approval letter.

Before you start

The block withdrawn everywhere else. IONOS is strict about this: "the IP block must never be announced on the internet at the time of your request or at any point afterward." Withdraw it from every other network before you send the letter.

A route object and a ROA for the same ASN, with the ROA's maximum length at /24. If you have not used RPKI before, set up the certificate authority in the RIPE NCC's dashboard first (RPKI and ROAs). There is no token or certificate to add to the registry record.

IONOS's requirements page for its Private Cloud marks the aut-num step "BYOASN only".

The approval letter, and the details IONOS asks for: your full name and contract number, the prefix, the data center you want, and the registry the block is registered with. The requirements page links the letter as a PDF, a UK version addressed to IONOS Cloud Ltd., so ask IONOS Cloud Support which entity's version applies to your contract.

Step by step

IONOS lists the letter first and the registry work second. We do the registry work first, so that nothing waits on it.

01Create the route object. In the RIPE NCC's LIR portal, open RIPE Database, Create an Object, and choose route:

route:   203.0.113.0/24
origin:  AS8560
mnt-by:  YOUR-MNT
source:  RIPE

For BYOASN, the origin is your own ASN.

02Create the ROA. Under RPKI, ROAs, choose Create new ROA. Enter the prefix, a maximum length of /24 and AS8560 (or your ASN), then Save and Apply Now.

03For BYOASN, update your aut-num. Open the object, choose Edit in text area, and add a line with your ASN or route set:

export:  TO AS8560 ANNOUNCE AS64500

04Check the ROA from outside. RIPEstat should call the pair valid:

curl "https://stat.ripe.net/data/rpki-validation/data.json?resource=8560&prefix=203.0.113.0/24"

05Withdraw the block and send the letter. Stop every other announcement, then send the completed approval letter and the details above to IONOS Cloud Support.

06Wait. IONOS says processing can take up to five business days from receipt of the letter. The addresses then appear as a single IP block in IP Management, and you can use the block for any service.

Mistakes that cost a day

• A live block goes dark. The block cannot be announced when you ask, and IONOS can take up to five business days. A block in use elsewhere is unreachable in between, so move its services to temporary addresses first, or plan the outage.
• Waiting for a download. On the day we checked, the language tabs (EN, DE, ES, FR, UK) where IONOS's tutorial offers the approval letter still held no file. The PDF linked above, from the Private Cloud requirements page, is the one to use.
• Deleting the block. IONOS warns against deleting the IP block in the Data Center Designer (DCD) or through the API, to prevent its accidental loss. To release the addresses, contact IONOS Cloud Support.
• Expecting IPv6. The overview mentions it; the requirements rule it out.

If you lease the block

IONOS does not mention leased space. It asks for the exclusive right to the range, and not for the block to be registered in your name or for LIR membership. The holder does the registry side: the route object and the ROA, which the holder controls. IONOS's letter is signed by someone authorized to act for its customer, who confirms the exclusive right to use the range and responsibility for its registration and management with the registries. With leased space that registration stays with the holder, so if IONOS wants it confirmed, the holder adds a letter of its own.

Where RTM Networks fits

We lease /24s and larger from our own RIPE NCC address space, and sell blocks in the RIPE NCC, ARIN and APNIC regions. For space leased from us, we create the route object and the ROA for AS8560, or for your ASN with BYOASN (lease IPv4). You sign IONOS's approval letter as its customer. If IONOS also wants confirmation from the block's holder beside its approval letter, we send it a letter of our own. If you want the block announced from your own ASN and do not run an LIR, we sponsor the AS number (ASN sponsorship). For fewer than 256 addresses, we announce the block ourselves and deliver it to your IONOS server over GRE or WireGuard, in any size down to a single address (GRE and WireGuard tunnels). More providers are in our BYOIP guides.