Static IPs and port forwarding

#Who needs one

Only VMs in a VPC. A standard VPS comes with its own public IPv4 address and needs nothing here.

A VM in a VPC has only a private address. It can reach the internet through its VPC, but nothing on the internet can reach it until you give it a static IP or forward a port to it.

There are three ways to use an address, chosen when you reserve it:

Either way, an address makes a VM reachable, not open: traffic still has to pass the subnet's network ACL.

#Addresses are few

Public addresses are limited in each zone. Each VPC takes one for its outbound traffic, and each static IP takes another. When a VM only needs a port or two, such as SSH or a single web port, share one address with port forwarding rather than giving every VM its own.

Your organization can also hold at most 20 static IPs at a time by default, counting every use (one VM, shared with port forwarding, and load balancer) and detached addresses too. Past that, reserving another is refused (in the API, 403 PUBLIC_IP_LIMIT_EXCEEDED). Release an address you no longer need, share one with port forwarding, or contact support to raise the limit.

If the zone has none left, reserving one says so. Release an address you no longer need, or share one.

#Give one VM an address

The quickest way is from the VM: on its Networking tab, next to Public IPv4, press Add static IP.

Or from Static IPs, press Reserve static IP:

1. VPC: an address belongs to one VPC and can only reach VMs in it.
2. Use: One VM.
3. VM: choose the machine. Only VMs that do not already have an address are listed.

Confirm. The address's page follows the allocation, and once it is done the address shows on the VM's Networking tab and Overview. The VM keeps its private address as well.

#Reserve one for later

A One VM address does not need a VM yet. Leave VM empty and the address is reserved, detached, ready to attach when the machine exists. Use it to put the address in DNS or an allow-list before the server is built. A detached address is billed like any other: see what it costs.

#Move an address to another VM

A One VM address is not tied to the machine it points at. Detach it and it stays yours, with the same IP; attach it to another VM in the same VPC and traffic to the address goes there instead. Use it to:

• Replace a server without changing its address. Build the new VM, test it on its private address, then move the address to it. DNS records and anyone's allow-list keep working.
• Keep an address while you rebuild. Detach it, destroy the old VM, create the new one, attach it again.

To move an address:

1. Open the address from Static IPs.
2. Press Attach to VM and choose the machine. Only VMs in the address's VPC without a static IP of their own are listed. If the address points at another VM, it moves: that VM keeps running on its private address.
3. Confirm.

To take it off its VM without choosing another, press Detach on the same page. The address shows as Detached until you attach it again or release it.

While a change applies, which takes a few seconds, the address shows Applying (in the API, in_sync: false) and traffic to it may drop. Attaching an address to the VM it already points at, or detaching one that is already detached, changes nothing.

The rules:

• Only a One VM address moves. A shared address's forwards and a load balancer's targets are changed on their own pages instead (in the API, 409 PUBLIC_IP_NOT_STATIC_NAT).
• A VM has at most one static IP of its own. Detach or release the one it has before attaching another (in the API, 409 INSTANCE_ALREADY_HAS_PUBLIC_IP).
• The VM must be in the address's VPC (in the API, 422 VALIDATION_FAILED with INSTANCE_NOT_IN_NETWORK on instance_id).
• The address must be ready, and not being released (in the API, 409 INVALID_RESOURCE_STATE).

#With the CLI

With the CLI, name the address by its IP or its id, and the VM by its name or id:

$ pantech public-ips create --network prod$ pantech public-ips attach 102.211.122.80 --vm web-2$ pantech public-ips detach 102.211.122.80$ pantech public-ips list

create without --vm reserves a detached address. attach and detach wait until the change has reached the address; pass --no-wait to get the operation's id straight away. pantech public-ips list and get show which VM each address points at, or that it is detached, and whether a change is still applying.

#With the API

Using the pt and wait_op helpers from the API examples, with the address in $PIP and the new VM in $VM:

source pantech.sh

# Point the address at $VM. If it pointed at another VM, it moves.
OP=$(pt POST "/public-ips/$PIP/attach" "$(jq -n --arg v "$VM" '{instance_id: $v}')")
OPID=$(echo "$OP" | jq -r .operation_id)
[ -n "$OPID" ] && wait_op "$OPID"   # an empty operation_id means nothing changed

# Take it off its VM. It stays yours, with instance_id null.
OP=$(pt POST "/public-ips/$PIP/detach")
OPID=$(echo "$OP" | jq -r .operation_id)
[ -n "$OPID" ] && wait_op "$OPID"

pt GET "/public-ips/$PIP" | jq '{address, instance_id, in_sync}'

To reserve an address with no VM, leave instance_id out: pt POST /public-ips "$(jq -n --arg n "$NET" '{network_id: $n}')". See attach and detach in the API reference.

#With Terraform

With the Terraform provider, instance_id on a static_nat address can change in place: point it at another VM to attach the address there, or remove it to detach the address. Terraform keeps the address rather than replacing it, and waits until the change has applied.

resource "pantechdynamics_public_ip" "web" {
  network_id  = pantechdynamics_network.main.id
  instance_id = pantechdynamics_instance.web_v2.id # was web_v1: the address moves
}

Leave instance_id out to reserve a detached address. in_sync is false while a change is still applying. A port_forwarding or load_balancer address takes no instance_id.

#Share an address with port forwarding

Port forwarding lets multiple virtual machines (or Kubernetes worker nodes) inside a VPC share a single public IP address by mapping different public ports to private machine ports.

To set up port forwarding:

1. Reserve a shared address: In the console sidebar, go to Network → Static IPs and press Reserve static IP.
   • Select your VPC.
   • Under Use, select Shared, with port forwarding.
   • Press Reserve static IP. The address is allocated from the region's public pool within seconds.
2. Open the address: On the Static IPs list, click the reserved address (for example 102.211.122.155).
3. Add a forward rule: In the Port forwarding card, press Add forward:
   • Target VM: Select the machine in the VPC (a standard VM or a Kubernetes worker node).
   • Protocol: TCP or UDP.
   • Public ports: The port exposed to the internet, such as 2222, 8080, or a range like 8000-8100.
   • To VM port: The internal port the service listens on on the machine, such as 22 for SSH or 30080 for a Kubernetes NodePort service.
   • Press Add forward.
4. Allow the port in the subnet's network ACL: Port forwarding directs incoming packets to the VM's private IP, but the traffic is still subject to the subnet's firewall. Go to Network → VPCs, click your VPC, select the subnet holding the VM, and ensure its network ACL has an ingress rule allowing traffic to the private port (for example, protocol TCP, port 30080, source CIDR 0.0.0.0/0).

With a forward from 2222 to a VM's 22, connect with (as ubuntu on Ubuntu, debian on Debian):

$ ssh -i ~/.ssh/ada-macbook-pro.pem -p 2222 ubuntu@<static-ip>

A range keeps its width on the VM: forwarding 8000-8010 to 9000 sends to 9000-9010.

Public ranges cannot overlap on the same protocol, but the same port on TCP and on UDP is fine. To remove a forward, press Delete next to the rule on the address's page.

#Put load balancers on an address

To spread a port across several VMs rather than send it to one, reserve an address with the use Load balancer, then create load balancers on it, one per public port. Such an address carries nothing else: no VM of its own, no port forwards. It is billed like any other static IP; the load balancers on it cost nothing more.

#What it costs

A static IP is billed monthly from the moment it is reserved until you release it, whatever it is used for and whether it points at a VM or not. Moving it between VMs does not bill it again: it is one address, billed once for as long as you hold it.

Prices exclude VAT, which is added to your end-of-period invoice.

A detached address is still billed. If you no longer need it, release it.

#Release an address

Releasing gives the address back to the shared pool, and you will almost certainly not get the same one back. Anything still pointing at it, such as DNS records or someone's allow-list, stops working. The VM keeps running on its private address. To keep the address for another VM, detach it instead; it stays yours, and billed, until you release it.

Delete a shared address's forwards first, and an address's load balancers first; until then, releasing it is refused (in the API, 409 PUBLIC_IP_HAS_PORT_FORWARDS or 409 PUBLIC_IP_HAS_LOAD_BALANCERS). Then on the address's page press Release, and type the address to confirm.

#Destroying a VM with an address

A VM that a static IP points at cannot be destroyed until the address is off it (in the API, 409 INSTANCE_HAS_PUBLIC_IP). Detach the address to keep it for another VM, or release it if you are done with it, then destroy the VM. The same goes for port forwards to the VM (409 INSTANCE_HAS_PORT_FORWARDS): delete them first. A VM that is a load balancer's target cannot be destroyed until you remove it from the load balancer's targets (in the API, 409 INSTANCE_BEHIND_LOAD_BALANCER).

#Errors