How are extra public addresses assigned to each service?

Sold one at a time, not as a block

The order records an extra count, not a prefix length. Four extra addresses means the number 4, and monthly rent rises by $8. Twenty means $40 more a month. Those addresses join the machine, the disks, the bandwidth, and the system in one monthly rent, then the month count applies. Quarterly is three times the monthly rent. No further discount applies.

Because a whole routed block is not handed to the machine to be split later, planning does not start from “buy a /28 and divide it inside.” The count is fixed when the order is placed. The remaining work is which address answers which name after the addresses arrive.

See them in the system first

The primary address is usually already on the NIC that faces the network. The host name or address in the console matches that address. Extra addresses may appear as aliases on the same NIC, or they may be listed in the delivery note and still need to be added to the configuration. The output of ip addr is the check. The count on the order is not enough by itself.

Count global-scope IPv4 addresses. The count should equal 1 plus the extra quantity purchased. If it is short, stop there and open a ticket. Do not borrow an address from another machine. A test address that is not on this order is not written into a site configuration either.

Three common assignments

Several sites can share one address and be told apart by name. A separate address is typical when a certificate, mail, a payment callback, or someone else’s allow-list must lock to a different source address. Extra addresses can be fewer when the only change is more websites and none of those constraints apply.

If a virtual machine is bridged, the public address is configured inside the virtual machine, and the host does not also hold that same address. If the host forwards, the host holds the public address and sends the port to the virtual machine’s inside address. The two methods are not stacked on one address, or an inbound connection has no single place to land.

The port tier is a separate line

Extra addresses do not raise bandwidth. 250M, 1G, and 2G are another item, and all three are unmetered. Ten addresses still share one port. The reverse is the same: raising the port to 1G adds $248 a month and leaves the address count unchanged.

The 128GB machine is $455 a month and already includes 1 IPv4 and 250M. Each address beyond that adds $2. The 256GB machine is $612 a month, with the same address rule. Choosing 256GB of memory does not include more addresses.

Checks while assigning

1. List each address and its use

   One table names the site, virtual machine, or service for each IPv4. An unused address stays on the table. It does not have to be bound to a process first.

2. Configure the NIC or the virtual machine

   Write the configuration into a file that survives reboot, not only into the current session. After reboot, ip addr still shows the same set.

3. Reach each one from outside

   Send one request to each address that is about to be used, and confirm the response is the expected site. If the firewall allows by address, the rules match this table.

4. Align the reverse record and the certificate

   For mail, or for a service that needs reverse lookup, the pointer and the name on the certificate refer to the same address. A site that does not send mail can skip this step.

The machine is in Tokyo, Japan. Sign-in is still SSH or RDP, and the primary address is written in the console. Extra addresses carry workload traffic. They do not replace the login details in the console. There is no setup fee. The ceiling is 255 extra addresses, plus the 1 included, 256 in all.

Names, the firewall, and outbound move together

After an address is on the NIC, the name still has to point at it. Changing only the NIC leaves outside traffic on the old address. Changing only the name, before the address is configured, makes the visit fail. Change both, and keep a short overlap: the new address already answers before the old name is moved.

If the firewall allows by source or destination address, each new public address for a service gets a matching rule. When a virtual machine is reached by forwarding, the rule sits on the layer that holds the public address. It is not written only as the virtual machine’s inside address while the host’s forward is forgotten. After the change, test once from a network outside the facility. A curl of the machine’s own address from the machine itself often stays on the local loop and does not show whether the outside path is open.

The outbound address is checked the same way. Payment callbacks, mail, and someone else’s allow-list often look at the source address. If a service leaves from the primary address while the other side allows only the newly added address, the connection is refused. Bind that service to a chosen source address, or give it its own exit in the routing table, then ask the other side to confirm the source it sees.

Once the count is on the order, the monthly rent includes those addresses. An address that is not fully used is not deleted from the NIC while a name still resolves to it. When an address is truly finished, remove the name and the firewall reference first, watch for a while with no visits, then remove it from the configuration. Each extra address is $2 a month. Twenty are $40 a month, prepaid with the machine’s term. That adds to the bandwidth charge. It is not a choice between the two.

On Proxmox, keep a table: public address, bridge or forward, virtual-machine id, name. When the table and ip addr disagree, the address actually configured in the system wins, and the table is corrected afterward. The count on the order says how many were bought. It does not say which one is bound to which virtual machine. Every address on the table that should be open to the public network must be reachable, from outside the facility, on the expected page or port. If it is not, check the NIC configuration and the firewall first, then whether the name still points at the old address.