No. A VPN hides where a person's traffic comes from. This does the opposite: it makes a server's traffic always come from one address you own, so a partner can put it on an allowlist and leave it there. Both happen to use WireGuard, which is why they get confused.

Do I need to move my servers?

No. Nothing moves and we sell no servers. The address is delivered over a tunnel to machines you already run — EC2, a Kubernetes pod, a VPS, a laptop — and their default route is left alone.

Is the address shared with anyone else?

No. Every paid plan assigns addresses to one customer, and the allocator refuses to hand out an address that appears on a blocklist. Outbound mail is denied by default and opened per lease on request, so one sender cannot spoil a range everybody shares.

How many machines can sit behind one address?

Any number. One machine holds the address itself; everything else on the tunnel egresses through it, so your partner sees a single entry no matter how far you scale behind it.

AnchoredIP

Your app's outbound IP.
Permanent.

A dedicated IPv4 address your partners can allowlist, delivered over a tunnel to the servers you already run. EC2, Kubernetes, a VPS, a laptop.

Address space we hold ourselves and announce from our own AS — not a slice of somebody else's shared proxy pool.

Get your static IP See how it works

AS41800 · 194.0.108.0/22 · 2a05:d840::/29 · RIPE NCC member

“Send us your static IPs and we'll allowlist them.”

The sentence that stops an integration. Your bank, insurer or enterprise customer needs a fixed address. Your platform does not have one to give.

AWS Lambda, Cloud Run, Fargate

Outbound traffic leaves from a pool of shared addresses that changes without notice. Your customer cannot allowlist a moving target.

Kubernetes

Every node egresses as itself. Add a node, and the partner firewall you spent three weeks getting through starts rejecting you.

Heroku, Render, Railway

The platform sells no static outbound address, so the integration waits on infrastructure that is not theirs to give. What is on offer is a shared proxy pool bolted on beside it.

How it works

Four steps. None of them involve talking to us.

1
Order
Pick a plan. No sales call, no quote, no contract to negotiate.
2
Pay
Card, and a bank transfer on the larger plans. Access opens by itself when the payment clears.
3
Install
One config file. wg-quick up, and you are done.
4
Ship
Your traffic leaves as your address. It does not change again.

# on the machine that needs the address
sudo install -m 600 anchoredip-42.conf /etc/wireguard/aip0.conf
sudo wg-quick up aip0

curl -s --interface 194.0.108.99 https://api.ipify.org
194.0.108.99           # yours, and it stays yours

The default configuration routes only traffic from your leased address through us — that is why the address is named on the command above, and why your default route, your SSH session and everything else on the machine are left alone. Want no flags at all? Ask for a full tunnel instead and everything the machine sends leaves as your address.

What you get

A dedicated IPv4 address

Assigned to you alone. Nobody else sends traffic from it, so nobody else can damage its reputation.

An IPv6 /48 with every plan — under construction

65 536 subnets, delegated to you today, with reverse DNS you control. Not yet reachable from the public internet: our upstream does not carry the announcement. Your machines reach each other over it now, and the IPv4 address covers everything the internet has to reach.

A private network between your machines

Your app in Frankfurt and your worker in Singapore reach each other over the tunnel. Bind the service to that address and it is published to nobody.

Reverse DNS you control

PTR records set from the dashboard. Missing or wrong ones break more integrations than people expect.

WireGuard or AmneziaWG

Same crypto. AmneziaWG adds obfuscation, so the handshake is not recognisable to deep packet inspection.

Addresses that are checked before you get them

Every address is screened against blocklists before assignment, and re-checked daily afterwards.

Pricing

Published, fixed, the same for everyone. Free for seven days, then from $19 a month. Annual costs eleven months instead of twelve — see it on the pricing page.

Trial

$0/mo

1 dedicated IPv4
1 × IPv6 /48
2 machines
7 days, then pick a plan

Solo

$19/mo

1 dedicated IPv4
1 × IPv6 /48
2 machines

Team

$49/mo

3 dedicated IPv4
1 × IPv6 /48
6 machines

Business

$149/mo

8 dedicated IPv4
1 × IPv6 /48
20 machines

What is in every plan, and what happens if you lapse →

Where this is the wrong tool

Cheaper to read now than to find out after you have integrated.

One routing location, in Kazakhstan

Traffic through us adds a round trip to Karaganda — 78 ms to Frankfurt, 161 ms to Virginia, measured. For allowlisted API calls a few times a minute this is invisible. For a chatty database protocol between two continents it is not. Additional locations follow demand.

Machines reach each other through us, not directly

The private network is hub and spoke. Fine for job queues, control traffic and admin access; wrong for bulk transfer between your own machines.

One inbound address per lease

Every machine on a lease sends as the same address, but only one can receive connections on it. That is how IP routing works, not a limitation we chose.

Outbound mail needs a conversation first

Sending mail from a fresh address without warming it damages the block for everyone on it. Ask before you start, and we will tell you honestly whether it is a fit.

A tunnel needs a machine that will run one

Lambda, Cloud Run and a Heroku dyno do not give a container the network privileges WireGuard needs, so the tunnel cannot live inside them. What works is one small always-on machine or pod holding the tunnel, with those calls routed through it. If everything you run is serverless, that extra component is a real cost and an HTTP proxy may suit you better.

The first one is measurable, so we measured it: round trips from our edge to ten regions — with the arithmetic for working out what your own traffic pays.

The address space is ours, not resold

The address space is registered to us at the RIPE NCC and announced from our own autonomous system. There is no upstream who can decide tomorrow that your address belongs to someone else.

Autonomous system: AS41800
IPv4: 194.0.108.0/22
IPv6: 2a05:d840::/29
Registry: RIPE NCC

Your addresses are routed to you inside our /24 announcements over a point-to-point tunnel. Small blocks are not announced separately — that keeps the global routing table clean and your reachability predictable. If you want to run the routing yourself we will set up a BGP session — ask by email, it is not something to order and not something anybody else needs.

Weighing this against something else? Compared with QuotaGuard, Fixie and a managed NAT gateway — each says where the other one wins.

Questions people ask first

Is this a VPN?: No. A VPN hides where a person's traffic comes from. This does the opposite: it makes a server's traffic always come from one address you own, so a partner can put it on an allowlist and leave it there. Both happen to use WireGuard, which is why they get confused.
Do I need to move my servers?: No. Nothing moves and we sell no servers. The address is delivered over a tunnel to machines you already run — EC2, a Kubernetes pod, a VPS, a laptop — and their default route is left alone.
Is the address shared with anyone else?: No. Every paid plan assigns addresses to one customer, and the allocator refuses to hand out an address that appears on a blocklist. Outbound mail is denied by default and opened per lease on request, so one sender cannot spoil a range everybody shares.
How many machines can sit behind one address?: Any number. One machine holds the address itself; everything else on the tunnel egresses through it, so your partner sees a single entry no matter how far you scale behind it.

Landed here looking for a dedicated IP and not sure this is the one you meant? Two different products share that name — one question tells you which you need.

Stop explaining why your IP changed.

Pick a plan, pay, install one file. Nothing to schedule and nobody to call.

Get your static IP

Your app's outbound IP.Permanent.