10 ms·
Ask HN: Can I own an IP address and take it with me across providers?
We are providing a service to businesses whose customers are all running a firewall. The customers need to manually allow our services IP address in their firewall, which is something we want them to do only once upon onboarding. How can I get the most stable IP address for our reverse proxy that I will hopefully never have to give up?
- zakki 4y agoAnother solution you can consider I think is to create a proxy server in a hosting/cloud provider. All your customer will point to the IP of the proxy and then your proxy finds your original server by host name (DNS). edit: typo
- svennek 4y agoThe more secure solution is to become a LIR ("internet provider") yourself and use one of your own adresses (which is yours as long as you pay the fee to the RIR (registry)). But that is a very expensive solution. Think thousands of dollars up front and thousands of dollars a year. In practice the best possible way is likely to get a stable IP somewhere (local provider VPS or cloud "elastic ip" ) and host a vpn-router there yourself, that forwards traffic to the real server (this does not work very well if you service is high bandwidth).
- charcircuit 4y ago>and thousands of dollars a year. If you own a single /24 it is only $250 per year to ARIN. A /24 is going to cost $11-12k, but it will have good resale value so it isn't a huge deal.
- svennek 4y agoI am in Europe, and RIPE only has one fee regardless of your (ip-range) size... so YMMV...
- nik736 4y agoIt's still wrong. The regular RIPE fee is 1.400 EUR per year. They redistribute excess earnings though, so the invoices for me were never above 1.000 EUR per year.
- svennek 4y agoOkay, one-ish thousand dollars per year then... And, I for one does not expect the generous redistributions to continue due to both general price increases of ~10% per annum and a stop in the explosive growth of LIRs (i.e. the oversized budget contribution of signup fees)) due to the new /24 rules...
- somat 4y agothere is also the AS fee. also around $250 a year. if I remember correctly.
- dpifke 4y agoThe annual ASN fee is waived if you have IPv4 or IPv6 resources: https://www.arin.net/resources/fees/fee_schedule/#autonomous-system-numbers-asns https://www.arin.net/resources/fees/fee_schedule/#autonomous... (Not to sound harsh, but why comment if you didn't know and couldn't be bothered to look up the correct answer? It's literally the first hit for [arin fees]. The HN guidelines discourage "low effort" comments.)
- ThePhysicist 4y agoI usually pay less than 1.000 € / year for my RIPE membership and associated /22. RIPE actually gives back money they don't need to members, so in some years I get back a significant part of my base fee. And I get two free tickets to the RIPE conference, which is an excellent event and alone worth the price of membership.
- nullcipher 4y agoYes, see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoi...
- mobilio 4y agoYou can't take it. You must get IP range and move it.
- beardyw 4y agoWhatever solution you choose, remember that your customers will (should) be concerned that the IP address is not shared outside your organisation.
- lode 4y agoYes, you can get provider independent IP adresses, and then use one a 'Bring Your Own IP'-type service at your infrastructure provider. Most cloud providers support this: https://aws.amazon.com/vpc/faqs/#Bring_Your_Own_IP https://aws.amazon.com/vpc/faqs/#Bring_Your_Own_IP https://www.ovhcloud.com/en/network/byoip/ https://www.ovhcloud.com/en/network/byoip/ https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/BYOIP.htm https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/... https://www.alibabacloud.com/solutions/bring-your-own-ip-addresses https://www.alibabacloud.com/solutions/bring-your-own-ip-add... https://cloud.google.com/vpc/docs/bring-your-own-ip https://cloud.google.com/vpc/docs/bring-your-own-ip It's definitely not going to be as simple, fleible and cheap as getting a domain name though. Using hard coded IP addresses for this kind of use case is almost certainly going to be giving you unexpected issues in the long run. Is there any chance you can use a hostname instead of an IP address to provide to your customers?
- bwann 4y agoUsing a hostname will be an improvement, but not perfect. It's going to depend on the firewall implementation whether it resolves the hostname to IP address one time and remembers it forever, or periodically refreshes the mapping. I've been particularly burned recently where the firewalls were on the other side of the country and geolocation came into play. The client machines resolved a hostname to A.A.A.A, but the firewalls resolved it to B.B.B.B, thus it looked right at first glance but still blocked the traffic.
- Gasp0de 4y agoWe are using a domain name, but customer firewalls use fixed ip addresses.
- charcircuit 4y agoYou can buy a /24, get an ASN, and then peer with someone else to advertise the route to your servers.
- nik736 4y agoThe minimum announcable IP space is a /24. So you could either rent or buy a /24. Renting a /24 is currently at around $100-200/month while buying is around $10-15k. You can take that subnet to a provider with a "BYOIP" service.
- londons_explore 4y agoIf you only need a single IP from that /24, you can always sub-lease the other 252 usable addresses to other people in the same position as you. For example, you could set up a company to hold the actual /24 and then have 253 shares in the company, and each shareholder gets traffic forwarded for one IP address. I'd buy a share or two.
- sgjohnson 4y agoThe minimum usable subnet is /29 (4 addresses), and the minimum subnet that can be announced using BGP is /24.
- zakki 4y agoIf all of the users share the same /24 they can use all 254 IP Addresses.
- sgjohnson 4y agoYes, but how would you move the remaining addresses elsewhere? With a tunnel?
- londons_explore 4y agoYeah. Effectively set up a VPN/tunnel service and give credentials to each 'ip-holder'. With more cost and complexity, that /254 could be anycasted to avoid it being single-homed too.
- 4y ago
- rspoerri 4y agoHow about you get a server with hetzner.com ? I'd ask support whether they ever needed to change ip addresses of a existing customer. Alternatively how about using port 80/443 or any other commonly used network ports to circumvent the firewall?
- Gasp0de 4y agoWe are already a customer at hetzner.com, so this might be one way to go. I am wondering what product will give me a more stable IP though, a floating IP or a dedicated server which I exclusively use as a reverse proxy.
- c22 4y agoI've been renting the same IPs from my colo for the last 20 years. This still doesn't prevent the risk of having to change providers, though.
- worldsavior 4y agoWhy not use a domain?
- luch 4y agobecause firewalls filter at the IP/port level, not at DNS level
- Hikikomori 4y agoThere are firewalls with those features.
- tecleandor 4y agoDepending on what you want to do it's not applicable. You can only easily guess the domain from HTTP connections and maybe from other tcp stuff if you have TLS + SNI in front. For example, you can't guess the target domain for an ssh connection.
- Hikikomori 4y agoNo. They do a dns lookup and allow the IP addresses returned.
- efdee 4y agoBut some routers will let you set a rule on a domain name. They will then resolve that domain name to an IP and use that internally, and do periodic lookups to refresh the IP they're referring to.
- tecleandor 4y agoThing is, if you're sharing that IP with several different domains, then you can't route properly :(
- worldsavior 4y ago
- michaelt 4y agoConsider whether routing everything across HTTPS / websockets would fix this problem. In my experience, you only have to prostrate yourself before the firewall bureaucracy if you want to use something other than port 443. And if they do restrict port 443 they'll use some form of proxy or SNI whitelisting, granting access by domain name instead of IP address.
- Gasp0de 4y agoWe do have a solution like this for chinese customers, using stunnel and tinyproxy. However, it adds quite a bit of complexity to the customer side config which I would like to circumvent if possible. Also, this is in an industrial setting, so a random machine in a factory would also not be allowed to use port 443 normally.
- 28304283409234 4y agohttps://media-exp1.licdn.com/dms/image/C4E22AQF6SsTSSb4LtA/feedshare-shrink_1280/0/1669641043323?e=1672876800&v=beta&t=H7meh72A63PHT1FXbWPEt3eMp-oeE7vd2G3UeW-qH1o https://media-exp1.licdn.com/dms/image/C4E22AQF6SsTSSb4LtA/f... The waiting list is 10 months+ for a /24.
- gnfargbl 4y agoTo be able to port around an IP address, you need to be able to change the Autonomous System (AS) which advertises it. The minimum IPv4 range which can be advertised is a /24 (256 IPs), so you will need one of those for full portability. You can purchase a /24 IP range from a broker [1]. It used to be possible to get a "free" /24 from RIPE, but the waiting list is very long these days [2]. RIPE also run a listing service, but it is unwieldy and you would need to manage the escrow yourself, which might be a bit risky given that you'll be paying ~13k Euros for the block. To complete the purchase you either need to be a RIPE Local Internet Registry (LIR) yourself [3], or you need to find a local LIR [4] to sponsor your resource. (They will likely charge you a fee for this, but it will cost less than becoming an LIR.) To use the IP block, you can get your own AS Number from RIPE (again via your own LIR or a sponsoring LIR) and advertise it from your own router via a provider who speaks BGP [5] or by plugging in to an Internet Exchange Point (IXP). This probably also means co-locating your equipment in a datacenter where peers are already present. Alternatively, you can find a provider who will let you advertise your IP block from their AS. There are several providers who will do this including the large players like AWS [6] and smaller operations like Vultr [7]. If you started off by using your IP range with someone else's AS, there should be no reason you couldn't move it to your own AS later. [1] https://auctions.ipv4.global/ https://auctions.ipv4.global/ (there are others, I have personally used this one) [2] https://www.ripe.net/manage-ips-and-asns/ipv4/ipv4-waiting-list https://www.ripe.net/manage-ips-and-asns/ipv4/ipv4-waiting-l... [3] https://www.ripe.net/participate/member-support/become-a-member https://www.ripe.net/participate/member-support/become-a-mem... [4] https://www.ripe.net/membership/indices/DE.html https://www.ripe.net/membership/indices/DE.html [5] e.g. Deutsche Telekon, Lumen, Telia, Cogent, Zayo, Hurricane Electric ... [6] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoi... [7] https://www.vultr.com/features/bgp/ https://www.vultr.com/features/bgp/
- Gasp0de 4y agoThank you so much for the detailed answer! I will propose this as a possible solution, but seeing the costs and effort I assume a different solution than actually owning any IP addresses will be chosen.
- blahgeek 4y agoAside from what others already said about pricy ipv4 addresses, it’s much more cheaper for ipv6
- stevefan1999 4y agoYes. You can become a LIR and got yourself assigned an IPv6 block. As a LIR you have the right to create an Autonomous System which almost does what you want if you run BGP. You can still do manual peering though, and learning BGP is whole another level of pain and patient. I'm on my way to becoming such operator to fiddle around Calico with IPv6
- dusted 4y agoShort answer, is nope.. About 20 years ago, I had a /24, but no ISP I've ever had would let me use it.. Even if I paid the insane price for "public static ip" they'd not let me use addresses from my own block. You more or less need to be an ISP to do it.
- somat 4y agoThat is what I found, you have to get your isp to bgp peer with you, and they usually want around a thousand dollars a month for that sort of connection.
- dark-star 4y agoAs someone who recently did this: it's much easier (and cheaper) for IPv6. All you need is a PI subnet (PI = Provider Independent). There are providers that give you for example up to 5 such subnets (each a /48) for free. I use route48.org (not affiliated) but there are others. Next, you need an ASN. You can't get these as an individual directly, but only through a sponsoring LIR (Local Internet Registry). You can find LIRs through RIPEs homepage (e.g. https://www.ripe.net/participate/member-support/list-of-members/europe https://www.ripe.net/participate/member-support/list-of-memb...), I simply checked them out one after another to find out how/when/if they would sell ASN registrations to individuals. I settled with a nonprofit (IN-BERLIN e.V) that I joined, and who offer ASN registrations for a flat 50€. Then you need a peering, usually your LIR also offers that (ask them), but you'd probably need to host your hardware in their datacenter for that to work (additional costs/month). Then there are providers like the aforementioned route48.org who allow you to peer from anywhere through a WireGuard (or GRE) tunnel, which means you can host your BGP router at home if you want (mine runs on a RaspberryPi 1st gen and has the full BGP table, which, admittedly, is a bit smaller for IPv6 than it would be for IPv4) So yes, it's doable even for an individual, but my suggestion is to use IPv6.
- YaBa 4y agoCould you provide more details about IN-BERLIN ? I've took a look at the website, it's confusing, and they ask registration via post/fax, explicitly saying they do not accept e-mail. Which form have you used? (probably my issue is with DE translation). Is there any other sponsoring LIR recommended? Thank you.
- dark-star 4y agoIN BERLIN is probably best suited for people in Germany. It is a "Verein" ("registered association", something that I don't think exists in many other countries) which is run by dozens of volunteers (hence the "non-profit" part). So basically you join the "Verein" for a (small) monthly fee and are expected to participate in the activities of the Verein. This is probably also why they require you to join via mail (running a "Verein" is serious business in Germany, you have to have a charter, appoint a treasurer, hold regular meetings/votes for board members, have someone type a protocol of these meetings, etc.)... If you want them to register anything with RIPE they will also require you to send them a scan/copy of a valid ID (although that can be done via E-Mail) but that is because of RIPE policies as I understand it. Joining gives you (in this case) also access to some "old-school" things like webspace, shell access, nntp, ftp, ... (similar to what for example SDF.org offers). They were originally there to help people getting access to the internet and building a website (think 90's internet), but they also do housing for individuals nowadays, and help educate people (locally in Berlin) on how the internet works, etc. I have checked some other LIRs but they often only provide RIPE registration to their "customers" (what that means depends on the LIR but usually you have to have some hosting with them or have an ongoing project that they do for you, or something like that), so for individuals, I think non-profits or "Vereine" are probably the easiest to join PS: yes, the website was a bit confusing for me too, basically you choose the cheapest offering ("IN BERLIN S" for 5€/month) and use the "Antrag für IN-Berlin S/M/L" from https://in-berlin.de/provider/antrag.html https://in-berlin.de/provider/antrag.html... However, as I understand it, they also require you to provide a "SEPA mandate" so that they can collect the fees directly from your bank account, and I think if you don't live in Germany that might prove difficult.
- somat 4y agoSort of: you have to get an AS number. then you can buy an ip block, go for ip6 here as ip4 is getting a bit expensive. iana fees will be about 500 dollars a year. Now for the hard part, you have to convince your isp to bgp peer with you. A lot of times this is known as a direct internet connection. it is relatively easy to find in a data center but usually will cost you a couple thousand bucks a month if you want it on your doorstep, but hey at least it usually comes with a service level agreement.
- jmurphyau 4y agoI love this question. I worked for a company that provided (private) hosted contact centre solutions and ended up getting into providing MS Teams Calling. One DC in Melbourne AU, one DC in Sydney AU. We needed to be able to fail over between Melbourne and Sydney and handle traffic on multiple ISPs and on IXs (IXs are small communities that ISPs create amongst themselves to send traffic between each other at little/no cost). We created an account with APNIC, requested a /24 IP block (you can get less than 255 IPv4 addresses - a /24 block), paid about $1,500AUD and got setup (they gave us an ASN and an IPv6 block too) That cost is each year. You then go to an ISP and tell them to use your IP addresses and ASN. You might need to peer (as others are saying), or they might just send the whole IP range to your firewall and you do whatever you want with it. One thing to be aware of: if you start using more than one ISP in different locations, you may receive traffic from ISP1 and return it back via ISP2.. Be aware of this when dealing with firewalls (either your firewalls or your customers)