What Is BYOIP? A Practical Guide to Bringing Your Own IP Addresses

Moving an application to a new infrastructure provider is often easier than moving the public identity surrounding it.

An IP address may be embedded in customer firewall allowlists, DNS records, VPN policies, licensing systems, security rules, monitoring platforms and reputation databases. Changing that address can create work not only for the organization moving its infrastructure, but also for every customer and partner that depends on it.

Bring Your Own IP, commonly shortened to BYOIP, allows an organization to use an IPv4 or IPv6 prefix it controls inside another provider’s network. The provider validates the organization’s authority over the range, provisions it within its infrastructure and, when authorized, announces the prefix to the Internet.

The address space does not physically “move.” Instead, the Internet’s routing system is instructed to reach that prefix through a different network. That single distinction is the central idea of everything below: BGP is the protocol autonomous systems use to exchange reachability information, while RPKI provides a cryptographically verifiable way for a legitimate resource holder to authorize an ASN to originate a prefix.

BYOIP in plain English

BYOIP means retaining control of your public IP address space while allowing a cloud, hosting, CDN, edge or network provider to use and advertise it for your workloads.

In practice, BYOIP normally changes:

• The network originating the route
• The infrastructure using the addresses
• The operational control plane

It does not necessarily change:

• The registered holder of the prefix
• Existing customer allowlists
• Application-facing IP addresses
• The historical identity of the range

Why moving an IP address is different from moving a server

A server can be rebuilt anywhere. A public IP address, by contrast, accumulates dependencies that live outside your infrastructure entirely:

• Firewall and SaaS allowlists
• Site-to-site VPN configuration
• Partner integrations
• DNS records and hard-coded endpoints
• Email sending reputation
• API access restrictions
• Compliance and monitoring systems
• Customer contracts that specify source ranges

This is why BYOIP matters to people who are not network engineers: it preserves the identity that the rest of the business already depends on.

A short history of BYOIP

Portable address space existed before the cloud

The ability to originate portable address space through different networks predates the term BYOIP. BGP and provider-independent address space supplied the underlying routing capability; cloud platforms later turned the process into a managed customer feature.

RPKI added verifiable route-origin authorization

Early practice relied on registry database records and Letters of Authorization. The industry then moved toward Route Origin Authorizations (ROAs) and Route Origin Validation, which let a resource holder cryptographically state which ASN may originate a prefix.

Hyperscalers productized the process

How BYOIP works step by step

Every provider differs in the details, but the onboarding shape is consistent. One cloud might use a DNS TXT record, another a PTR record, another a signed authorization message or X.509 certificate.

Ownership, leasing and authorization are not the same thing

One of the most valuable distinctions in BYOIP is that these four concepts are independent:

• Ownership or registration identifies the recognized holder or resource organization.
• Right of use may be delegated contractually or through registry mechanisms.
• Route authorization specifies which ASN may originate the prefix.
• Cloud authorization allows a particular platform or account to provision it.

BYOIP does not mean that a cloud provider becomes the owner of the range.

Why organizations use BYOIP

1. Migration continuity. Move workloads without changing customer-facing addresses.
2. Vendor portability. Reduce dependence on addresses allocated by one infrastructure provider.
3. Stable allowlists. Preserve addresses trusted by partners, customers and security systems.
4. Reputation continuity. Maintain the history associated with carefully managed address space.
5. Cost and capacity control. Use owned or properly delegated space instead of relying exclusively on provider-assigned inventory.

For AWS specifically, the economic case changed in February 2024: AWS introduced a charge of $0.005 per public IPv4 address per hour but exempted addresses brought through BYOIP.

What BYOIP does not solve automatically

BYOIP is a routing and provisioning capability, not a cure-all. It does not, by itself, fix:

• Poor IP reputation
• Incorrect geolocation data
• Routing leaks
• Invalid or overly restrictive ROAs
• Reverse DNS delegation
• Application-level migration
• DDoS protection
• Provider-specific service limitations
• Legal authority to use the address space
• Safe withdrawal from the previous origin

Common BYOIP misconceptions

Did you know?

• An IPv4 /24 contains 256 addresses.
• AWS permits all addresses in an imported IPv4 range to be used, including the addresses traditionally treated as network and broadcast addresses.
• Google Cloud can subdivide imported IPv4 space into blocks as small as /28, or 16 addresses.
• Provisioning is not always immediate: Google Cloud estimates roughly two weeks for a regional v2 public advertised prefix and about four weeks for older v1 configurations.

References

• RFC 4271 – A Border Gateway Protocol 4 (BGP-4)
• RFC 6480 – An Infrastructure to Support Secure Internet Routing (RPKI)
• AWS – Bring your own IP addresses (BYOIP) to Amazon EC2
• Google Cloud – Bring your own IP addresses
• AWS – New public IPv4 address charge