Add additional IPv4 addresses

Every server includes one dedicated IPv4 address and a routed /64 IPv6 subnet. When you need more IPv4, for virtual machines, separate services or a mail server with its own reputation, you can add addresses to the same server.

Order additional addresses

Request them from your dashboard: open the server, then choose Network. IPv4 addresses are scarce, so for blocks we ask for a short justification: a sentence or two on what the addresses are for, such as “eight VMs for separate customers, each with its own public IPv4”. All add-ons are listed on add-ons.

How the addresses reach your server

Additional addresses are routed to your server; the exact method and gateway are shown in your dashboard. In practice:

• You add each address to the main network interface as a /32, a single address, not with the netmask of your main IP.
• You do not add another default gateway. Replies leave through the existing default route, with the additional address as their source.
• New outgoing connections still use the main IP, unless a program binds to another address.

If your dashboard shows a different method or gateway for a block, follow the dashboard.

Configure the addresses

The examples add 198.51.100.25 and 198.51.100.26 to the interface enp1s0; ip -br link shows your interface name. To try an address first, add it live. This does not survive a reboot:

ip addr add 198.51.100.25/32 dev enp1s0

Ubuntu: Netplan

Add the addresses to the existing interface in your /etc/netplan/ file, after the main address:

network:
  version: 2
  ethernets:
    enp1s0:
      addresses:
        - 203.0.113.10/24
        - 198.51.100.25/32
        - 198.51.100.26/32
        - 2001:db8:1234:5678::1/64
      routes:
        - to: default
          via: 203.0.113.1
        - to: default
          via: fe80::1

The main address and routes shown are examples: keep yours as they are, with the main address first so it stays the default source for outgoing traffic. Apply with netplan try, which rolls back after 120 seconds unless you confirm.

Debian: ifupdown

In /etc/network/interfaces, add one stanza per address after the existing one for the interface:

iface enp1s0 inet static
    address 198.51.100.25/32

iface enp1s0 inet static
    address 198.51.100.26/32

Then add the same addresses live with ip addr add, as above, instead of restarting the interface over SSH.

AlmaLinux and Rocky Linux: NetworkManager

nmcli connection modify enp1s0 +ipv4.addresses 198.51.100.25/32
nmcli connection modify enp1s0 +ipv4.addresses 198.51.100.26/32
nmcli connection up enp1s0

Use the connection name from nmcli connection show if it differs from the interface name.

Test the new addresses

ip -br address show dev enp1s0
curl --interface 198.51.100.25 -sI https://www.debian.org

The first command lists the addresses on the interface. The second sends a request from the additional address: an HTTP response proves that traffic is routed both ways. From your own computer, ping 198.51.100.25 should answer as well, unless your firewall drops ping.

Bind services to an address

Most server software listens on all addresses by default. To dedicate an address to one service, bind it explicitly: listen 198.51.100.25:443 ssl; in nginx, for example, or smtp_bind_address = 198.51.100.25 in Postfix so that outgoing mail leaves from that address. An address that sends mail needs matching reverse DNS.

Firewall rules apply to every address unless you say otherwise. To open a port on one address only, name it as the destination:

ufw allow proto tcp to 198.51.100.25 port 443

With firewalld, use a rich rule such as firewall-cmd --permanent --add-rich-rule='rule family="ipv4" destination address="198.51.100.25" port port="443" protocol="tcp" accept', then firewall-cmd --reload.

Give additional IPs to virtual machines

Because the addresses are routed to your server, the host has to forward them to the VMs: put the VMs on a bridge without a physical port, enable IP forwarding, and add a /32 route per VM address. On a Proxmox VE host, in /etc/network/interfaces:

auto vmbr1
iface vmbr1 inet static
    address 203.0.113.10/32
    bridge-ports none
    bridge-stp off
    bridge-fd 0
    up ip route add 198.51.100.25/32 dev vmbr1
    up ip route add 198.51.100.26/32 dev vmbr1

echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-forwarding.conf
sysctl --system

Here 203.0.113.10 stands for the host’s main IP. Inside each VM, configure its address as a /32 and use the host’s main IP as the gateway, marked on-link. For an Ubuntu VM whose network card is ens18:

network:
  version: 2
  ethernets:
    ens18:
      addresses:
        - 198.51.100.25/32
      routes:
        - to: default
          via: 203.0.113.10
          on-link: true

Add your usual nameservers section as well. Addresses given to VMs this way must not also be configured on the host’s own interface. Install Proxmox VE covers the rest of the setup.

Next steps

Set a PTR record for each address that sends mail or needs a recognizable name, as described in Set reverse DNS. Every address is covered by the acceptable use policy, which rules out spam and other abuse. Still stuck? Open a ticket from Support with the output of ip -br address and ip route.