Ask HN: Can I own an IP address and take it with me across providers?
We are providing a service to businesses whose customers are all running a firewall. The customers need to manually allow our services IP address in their firewall, which is something we want them to do only once upon onboarding. How can I get the most stable IP address for our reverse proxy that I will hopefully never have to give up?
60 comments
[ 2.5 ms ] story [ 106 ms ] threadBut that is a very expensive solution. Think thousands of dollars up front and thousands of dollars a year.
In practice the best possible way is likely to get a stable IP somewhere (local provider VPS or cloud "elastic ip" ) and host a vpn-router there yourself, that forwards traffic to the real server (this does not work very well if you service is high bandwidth).
If you own a single /24 it is only $250 per year to ARIN.
A /24 is going to cost $11-12k, but it will have good resale value so it isn't a huge deal.
And, I for one does not expect the generous redistributions to continue due to both general price increases of ~10% per annum and a stop in the explosive growth of LIRs (i.e. the oversized budget contribution of signup fees)) due to the new /24 rules...
(Not to sound harsh, but why comment if you didn't know and couldn't be bothered to look up the correct answer? It's literally the first hit for [arin fees]. The HN guidelines discourage "low effort" comments.)
https://aws.amazon.com/vpc/faqs/#Bring_Your_Own_IP https://www.ovhcloud.com/en/network/byoip/ https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/... https://www.alibabacloud.com/solutions/bring-your-own-ip-add... https://cloud.google.com/vpc/docs/bring-your-own-ip
It's definitely not going to be as simple, fleible and cheap as getting a domain name though.
Using hard coded IP addresses for this kind of use case is almost certainly going to be giving you unexpected issues in the long run. Is there any chance you can use a hostname instead of an IP address to provide to your customers?
For example, you could set up a company to hold the actual /24 and then have 253 shares in the company, and each shareholder gets traffic forwarded for one IP address.
I'd buy a share or two.
With more cost and complexity, that /254 could be anycasted to avoid it being single-homed too.
How is this going to be competetive? You can get a Elastic IP from AWS for $3.50 per month when not in use, $0 when in use, and the cheapest EC2 instance is $3/month. And there'd be no $50 upfront cost per IP.
Perfect scenario for a blockchain
Alternatively how about using port 80/443 or any other commonly used network ports to circumvent the firewall?
For example, you can't guess the target domain for an ssh connection.
In my experience, you only have to prostrate yourself before the firewall bureaucracy if you want to use something other than port 443. And if they do restrict port 443 they'll use some form of proxy or SNI whitelisting, granting access by domain name instead of IP address.
Also, this is in an industrial setting, so a random machine in a factory would also not be allowed to use port 443 normally.
The waiting list is 10 months+ for a /24.
You can purchase a /24 IP range from a broker [1]. It used to be possible to get a "free" /24 from RIPE, but the waiting list is very long these days [2]. RIPE also run a listing service, but it is unwieldy and you would need to manage the escrow yourself, which might be a bit risky given that you'll be paying ~13k Euros for the block.
To complete the purchase you either need to be a RIPE Local Internet Registry (LIR) yourself [3], or you need to find a local LIR [4] to sponsor your resource. (They will likely charge you a fee for this, but it will cost less than becoming an LIR.)
To use the IP block, you can get your own AS Number from RIPE (again via your own LIR or a sponsoring LIR) and advertise it from your own router via a provider who speaks BGP [5] or by plugging in to an Internet Exchange Point (IXP). This probably also means co-locating your equipment in a datacenter where peers are already present.
Alternatively, you can find a provider who will let you advertise your IP block from their AS. There are several providers who will do this including the large players like AWS [6] and smaller operations like Vultr [7]. If you started off by using your IP range with someone else's AS, there should be no reason you couldn't move it to your own AS later.
[1] https://auctions.ipv4.global/ (there are others, I have personally used this one)
[2] https://www.ripe.net/manage-ips-and-asns/ipv4/ipv4-waiting-l...
[3] https://www.ripe.net/participate/member-support/become-a-mem...
[4] https://www.ripe.net/membership/indices/DE.html
[5] e.g. Deutsche Telekon, Lumen, Telia, Cogent, Zayo, Hurricane Electric ...
[6] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoi...
[7] https://www.vultr.com/features/bgp/
If you're looking for a more cost effective solution and are willing to accept a little bit of dependency risk, then "get a reserved IP address on AWS EC2 and don't ever change it" is probably a decent answer.
You more or less need to be an ISP to do it.
edit: typo
All you need is a PI subnet (PI = Provider Independent). There are providers that give you for example up to 5 such subnets (each a /48) for free. I use route48.org (not affiliated) but there are others.
Next, you need an ASN. You can't get these as an individual directly, but only through a sponsoring LIR (Local Internet Registry). You can find LIRs through RIPEs homepage (e.g. https://www.ripe.net/participate/member-support/list-of-memb...), I simply checked them out one after another to find out how/when/if they would sell ASN registrations to individuals. I settled with a nonprofit (IN-BERLIN e.V) that I joined, and who offer ASN registrations for a flat 50€.
Then you need a peering, usually your LIR also offers that (ask them), but you'd probably need to host your hardware in their datacenter for that to work (additional costs/month). Then there are providers like the aforementioned route48.org who allow you to peer from anywhere through a WireGuard (or GRE) tunnel, which means you can host your BGP router at home if you want (mine runs on a RaspberryPi 1st gen and has the full BGP table, which, admittedly, is a bit smaller for IPv6 than it would be for IPv4)
So yes, it's doable even for an individual, but my suggestion is to use IPv6.
Is there any other sponsoring LIR recommended? Thank you.
Joining gives you (in this case) also access to some "old-school" things like webspace, shell access, nntp, ftp, ... (similar to what for example SDF.org offers). They were originally there to help people getting access to the internet and building a website (think 90's internet), but they also do housing for individuals nowadays, and help educate people (locally in Berlin) on how the internet works, etc.
I have checked some other LIRs but they often only provide RIPE registration to their "customers" (what that means depends on the LIR but usually you have to have some hosting with them or have an ongoing project that they do for you, or something like that), so for individuals, I think non-profits or "Vereine" are probably the easiest to join
PS: yes, the website was a bit confusing for me too, basically you choose the cheapest offering ("IN BERLIN S" for 5€/month) and use the "Antrag für IN-Berlin S/M/L" from https://in-berlin.de/provider/antrag.html... However, as I understand it, they also require you to provide a "SEPA mandate" so that they can collect the fees directly from your bank account, and I think if you don't live in Germany that might prove difficult.
you have to get an AS number. then you can buy an ip block, go for ip6 here as ip4 is getting a bit expensive. iana fees will be about 500 dollars a year.
Now for the hard part, you have to convince your isp to bgp peer with you. A lot of times this is known as a direct internet connection. it is relatively easy to find in a data center but usually will cost you a couple thousand bucks a month if you want it on your doorstep, but hey at least it usually comes with a service level agreement.
I worked for a company that provided (private) hosted contact centre solutions and ended up getting into providing MS Teams Calling.
One DC in Melbourne AU, one DC in Sydney AU.
We needed to be able to fail over between Melbourne and Sydney and handle traffic on multiple ISPs and on IXs (IXs are small communities that ISPs create amongst themselves to send traffic between each other at little/no cost).
We created an account with APNIC, requested a /24 IP block (you can get less than 255 IPv4 addresses - a /24 block), paid about $1,500AUD and got setup (they gave us an ASN and an IPv6 block too)
That cost is each year.
You then go to an ISP and tell them to use your IP addresses and ASN.
You might need to peer (as others are saying), or they might just send the whole IP range to your firewall and you do whatever you want with it.
One thing to be aware of: if you start using more than one ISP in different locations, you may receive traffic from ISP1 and return it back via ISP2.. Be aware of this when dealing with firewalls (either your firewalls or your customers)