TransIP BYOIP: your own IP addresses in TransIP OpenStack

You send a short form, and TransIP contacts you to link the range to your project. The rest is settled in that conversation.

What TransIP accepts

From TransIP's IP Spaces page and its OpenStack price list, on the day we checked:

• Size. "Any routable subnet (/24 or higher)". The Dutch page says "/24 of groter": a /24 or larger.
• Who. Customers with "membership with a Local Internet Registry (LIR)". TransIP does not define this further.
• Product. OpenStack, which the English page also calls Public Cloud. TransIP lists BYOIP under OpenStack, and its VPS page does not mention it.
• Reverse DNS is optional: "Within Bring Your Own IP, you have the option for Reverse DNS."
• Price. BYOIP costs €250 setup and €52.50 a month; BYOIP rDNS, with reverse DNS, costs €300 setup and €62.99 a month. Both exclude VAT. The price list does not say whether they are per range or per /24.
• Not published. Which registries TransIP accepts, which ASN announces the range, whether it wants a ROA, a route object or a letter of authorization, where the range will be usable, and how long it takes.

Before you start

TransIP lists none of the usual paperwork, so have it ready for the conversation after the form:

• Your LIR details. Which registry, and the membership your organization holds, since TransIP makes LIR membership a condition.
• The registry record. The inetnum, or its ARIN or APNIC equivalent, and access to whoever can edit it.
• A ROA for TransIP's ASN, once TransIP names it. If the block has ROAs and none names that ASN, networks that validate RPKI drop the route (RPKI and ROAs). Set the maximum length to the prefix TransIP will announce.
• A route object with the same origin, if TransIP asks for one. Many networks build their filters from routing registry data.
• An OpenStack project at TransIP, since the form asks for its ID.

Step by step

TransIP documents two steps. The rest happens in the conversation that follows.

01Send the request form. On the IP Spaces page, click Request BYOIP. The form asks for your TransIP account name, the email address linked to your TransIP account, and the Project ID of your OpenStack project.

02Wait for TransIP. The form confirms: "We will contact you to link Bring Your Own IP to your OpenStack environment."

03Settle what the page leaves open, before you change any record:

Prefix:   203.0.113.0/24, RIPE NCC, registered to Example B.V.
LIR:      nl.example (Example B.V. is a RIPE NCC member)
Product:  BYOIP rDNS, OpenStack project <project ID>

1. Which ASN will originate the prefix?
2. Do you need a ROA, a route object or a letter of authorization?
3. Is the price per range or per /24?
4. Where will the range be usable, and from when?

04Update the registry and check it before TransIP announces, with the ASN TransIP gives you in place of <ASN>. RIPEstat should call the route valid:

whois -h whois.ripe.net -- "-T route 203.0.113.0/24"
curl "https://stat.ripe.net/data/rpki-validation/data.json?resource=<ASN>&prefix=203.0.113.0/24"

Pitfalls

• Two price tables that say BYOIP. On the OpenStack price list, the Dedicated IP Subnet rows are named "BYOIP rDNS /29 IPv4" up to "/25", but they are TransIP's own addresses, in its AMS2 region. Your own range is priced under "Bring Your Own IP (BYOIP) - Own IP-Ranges".
• Leasing before asking. The LIR condition decides whether a leased block qualifies at all; see below.
• Smaller than a /24. TransIP takes a /24 or larger, and networks across the internet filter anything smaller anyway. For a few addresses, TransIP's Dedicated IP Subnet rents you a /29 to /25 of its own space; to keep your own addresses, use a tunnel.
• The old announcement. If the block is announced elsewhere today, add a ROA for TransIP's ASN before the switch, and withdraw the other announcement once TransIP's is live. Two origins split the traffic.

If you lease the block

A lessee is usually not the LIR; the lessor is. TransIP's page makes LIR membership a condition of BYOIP and does not say whether a lessor's membership counts, so a leased block may not qualify. Ask TransIP before you sign a lease for this purpose, and get the answer in writing. If TransIP accepts it, the holder does the registry side, since only the holder can edit the records: the ROA for the ASN TransIP names, a route object if TransIP wants one, and any letter of authorization it asks for. If TransIP says no, a tunnel can still deliver the block to your TransIP OpenStack instance or VPS.

Where RTM Networks fits

We lease /24s and larger from our own RIPE NCC address space (lease IPv4), and sell blocks in the RIPE NCC, ARIN and APNIC regions. If TransIP accepts a block leased from us, we create the ROA and the route object for its ASN and sign the letter of authorization. If it does not, or you need fewer than 256 addresses, we announce a block and deliver it to your TransIP server over GRE or WireGuard, down to a single address (GRE and WireGuard tunnels). Other providers: BYOIP guides.