Bring Your Own IP

Bring Your Own IP (often abbreviated BYOIP) is a networking practice in which an organization uses its own publicly routable Internet Protocol (IP) address ranges, rather than those assigned by a cloud or hosting provider. The organization's prefixes are imported and then advertised via the provider's network, while ownership remains with the organization. BYOIP enables continuity of addressing, retention of IP reputation, and compliance with contractual or regulatory requirements."Bring your own IP addresses (BYOIP) to Amazon EC2". Amazon Web Services. Retrieved 7 October 2025."Bring your own IP addresses". Google Cloud. 2025. Retrieved 7 October 2025."Custom IP address prefix (BYOIP) – Azure Virtual Network". Microsoft Learn. Retrieved 7 October 2025.

Terminology

Major providers use different terms for the same concept, for example Google Cloud's Public Advertised Prefix (PAP) and Public Delegated Prefix (PDP) resources, Microsoft Azure's Custom IP address prefix, and AWS's BYOIP "address pools"."Create and manage public advertised prefixes". Google Cloud. Retrieved 7 October 2025.

Background

Public IP address blocks and Autonomous System Numbers (ASNs) are allocated by the five Regional Internet Registries (RIRs). In the traditional hosting model, providers assign addresses from their own pools and originate those routes with their ASNs. BYOIP allows customer-owned prefixes registered with an RIR to be advertised by the provider, avoiding renumbering during migrations or hybrid deployments."Bring Your Own IP Address to the Cloud (BYOIP)" (PDF). Internet2 TechEX. 2022. Retrieved 7 October 2025.

Motivations include: maintaining continuity of service and configuration (DNS, firewall and allow-lists), preserving IP reputation (for example, email deliverability), meeting regulatory or contractual obligations that require organizational control over addresses, and enabling multi-cloud or hybrid deployments with consistent external IPs.

BYOIP differs from related concepts such as IP address leasing (temporary rental of prefixes), anycast (advertising the same prefix from multiple locations), and BYOD (unrelated to addressing).

Technical overview

Ownership and verification

The organization must be the registered holder of the IP block with an RIR and typically must demonstrate control via WHOIS/RDAP records."Prepare to bring your IP address range to your AWS account". AWS Global Accelerator. Retrieved 7 October 2025."Bring Your Own IP (BYOIP)". Oracle Cloud Infrastructure. 2025. Retrieved 7 October 2025.
Providers commonly require RPKI ROA records authorizing the provider's ASN to originate the routes.Snijders, Job; Maddison, Ben; Lepinski, Matt; Kong, Derrick; Kent, Stephen (2024). "RFC 9582 — A Profile for Route Origin Authorizations (ROAs)". IETF. Retrieved 7 October 2025.
Some providers also require publishing a cryptographic artifact (for example, a self-signed X.509 certificate) in the RDAP remarks for the prefix, which is used to verify an authorization message binding the prefix to a specific customer account.
Minimum prefix sizes (often IPv4 /24 and IPv6 /48) and a "clean history" may be enforced.

Routing and advertisement

After validation, the provider originates the customer's prefix to the global Internet using BGP, usually under the provider's ASN, though some environments also support customer ASNs.
Internet Routing Registry (IRR) route objects may need updating to reflect the correct origin ASN to avoid filtering by peers and transit providers.
Many providers prohibit overlapping or simultaneous advertisements of the same prefix from outside their network during onboarding to avoid routing conflicts (for example, Google Cloud disallows overlapping BYOIP announcements).

Security mechanisms

RPKI/ROA is widely recommended or required to validate prefix origin and reduce the risk of route hijacking.
Traditional Letters of Authorization (LoAs) may still be used by some networks to evidence permission to originate, but large platforms increasingly prefer automated, cryptographically verifiable methods tied to RIR data.

Constraints, timing, and service coverage

Typical minimums are IPv4 /24 and IPv6 /48.
IPv6 is supported across major clouds, though service coverage can differ by product/region.
Provisioning is not instant; for example, Oracle documents up to 10 business days for validation and provisioning.
Some platforms offer controlled transition ("live migration") where prefixes are advertised from both on-premises and the cloud to minimize downtime.

Use cases

Cloud migration and data-center consolidation while retaining existing public IPs.
Preserving IP reputation for mail, APIs, and security allow-lists (whitelists).
Compliance with regulations requiring stable addressing or geolocation controls.
Hybrid and multi-cloud architectures that need a consistent external network identity.
Anycast or edge deployments for performance and resilience.

Economics (time-qualified)

Cloud pricing and billing policies can affect BYOIP's economics and vary over time:

AWS: As announced July 2023 and effective 1 February 2024, AWS charges for public IPv4 addresses, but "you will not be charged for IP addresses that you own and bring to AWS using Amazon BYOIP.""AWS is Adding a Charge for Public IPv4 Addresses". AWS News Blog. 2023. Retrieved 7 October 2025.
Google Cloud: Documents no charges for idle or in-use BYOIP addresses.
Microsoft Azure: No separate charge for the Custom IP address prefix resource; standard egress and service rates apply (policies around SMTP/port 25 are discussed below).
Oracle Cloud Infrastructure (OCI): BYOIP import and usage are documented without an additional feature fee; normal resource billing applies.

Adoption and vendor implementations

All major cloud platforms document BYOIP, with provider-specific workflows and terminology (see Terminology). Independent trade press also covers the trend and related features, e.g., OVHcloud's complementary "bring-your-own-ASN" offering for customers that want deeper routing control.Brodkin, Jon (2024). "OVHcloud gives customers the keys to its backbone". The Stack. Retrieved 7 October 2025."AWS to charge customers for public IPv4 addresses from 2024". The Register. 2023. Retrieved 7 October 2025.

Research and operational challenges

Empirical studies of RPKI and Route Origin Validation (ROV)—mechanisms directly relevant to safe BYOIP operations—highlight gaps between ROA publication and enforcement:

The 2023 RoVista study (IMC'23) found that although ROA coverage is increasing, many networks still do not consistently enforce ROV, limiting protection against invalid announcements."RoVista: Measuring and Analyzing the Route Origin Validation (ROV) in RPKI" (PDF). ACM IMC 2023 / MANRS. 2023. Retrieved 7 October 2025.
APNIC Labs' measurements describe continued growth in ROA signing but uneven ROV filtering across ASes."How we measure: RPKI ROA signing and Route Origination Validation". APNIC Blog. 2023. Retrieved 7 October 2025.
An IFIP TMA 2021 paper using RIPE Atlas-style data plane inference reported that only a minority of ASes directly enforce ROV, leaving room for route hijacks and outages from misconfigurations."Revisiting RPKI Route Origin Validation on the Data Plane" (PDF). IFIP TMA. 2021. Retrieved 7 October 2025.
A 2024 SoK reported that roughly "almost half of global prefixes" were covered by RPKI while about "27% of networks" validated—indicating material but incomplete protection.^[1]

Operational implications for BYOIP include the need to manage ROAs carefully (to avoid accidental invalids that cause outages), monitor for RPKI/ROV deployment by peers, and plan change windows for advertisement or withdrawal.

Comparison with provider-assigned IPs

Compared with the traditional model where a provider leases addresses from its own pool to the customer, BYOIP:

preserves IP reputation that the customer has built over time (e.g., for email deliverability),
avoids renumbering costs and coordination (DNS, ACLs, partner allow-lists),
increases portability across providers, helping mitigate vendor lock-in,
but requires expertise in RIR policy, RPKI and BGP, and careful onboarding to avoid routing conflicts.

Implementation process (typical)

While details differ by provider, a common workflow is:

Ownership & prerequisites. Confirm the prefix is registered to the organization with an RIR and meets provider size/region constraints (commonly IPv4 /24, IPv6 /48).

Authorization. Create an RPKI ROA authorizing the provider's ASN to originate the prefix; where required, publish a provider-specified X.509 certificate or token in RDAP/WHOIS to bind the prefix to the requesting account.

Provisioning. The provider validates ownership/authorization (which can take hours to days; OCI documents up to 10 business days), then adds the range as a BYOIP "pool"/resource in the customer account.

Advertisement & use. The customer requests advertisement; the provider originates routes. Addresses from the imported range are then assignable to supported resources (VMs, load balancers, firewalls, etc.).

Criticism and controversies

IPv4 scarcity and "hoarding." With global IPv4 run-out, address blocks have become a tradable asset. Analysts report significant price spikes and an active transfer market, which some critics argue incentivizes speculation and hoarding—trends BYOIP can indirectly reinforce by raising the operational value of holding addresses."What happened to IP Addresses in 2024?" (PDF). APNIC Labs (Geoff Huston). 2025. Retrieved 7 October 2025."Opinion: IPv4 address markets". APNIC Blog. 2021. Retrieved 7 October 2025. Proponents counter that regulated RIR transfer policies and the gradual growth of IPv6 mitigate long-term scarcity.
Configuration portability and policy friction. BYOIP workflows and service coverage differ across providers—terminology (PAP/PDP vs. Custom IP Prefix), regional scopes, and product-specific support vary. For example, Google Cloud disallows overlapping advertisements during import, and Azure places well-documented restrictions on outbound SMTP over port 25 for most subscriptions, affecting mail server portability even when addresses are customer-owned."Troubleshoot outbound SMTP connectivity problems in Azure". Microsoft Learn. 2025. Retrieved 7 October 2025. Providers argue these policies protect IP reputation and platform security while offering alternative relays or exemptions in defined cases.
Security reliance on correct RPKI. BYOIP safety depends on correct ROAs and on third-party ROV filtering. Studies show inconsistent ROV deployment, so misconfigurations or hijacks may still propagate in parts of the Internet.

References

↑ Mirdita, Donika; Schulmann, Haya; Waidner, Michael (2024). "SoK: An Introspective Analysis of RPKI Security". arXiv:2408.12359 [cs.CR].

External links

Official website – Portal aggregating BYOIP provider documentation and resources

This article "Bring Your Own IP" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Bring Your Own IP. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.

[SoK-2024-1] Mirdita, Donika; Schulmann, Haya; Waidner, Michael (2024). "SoK: An Introspective Analysis of RPKI Security". arXiv:2408.12359 [cs.CR].

[1]