AnchoredIP

Managed platforms

Heroku, Vercel, Lambda, Render, App Runner — anywhere you cannot bring up a network interface. Read this before you buy.

The short answer

AnchoredIP delivers your address over WireGuard, and WireGuard needs to create a network interface. On a managed platform you do not have that, and no plan of ours changes it. So you cannot install the tunnel beside your application code on any of these:

  • Heroku dynos, Vercel and Netlify functions
  • AWS Lambda, Google Cloud Functions, Azure Functions
  • Render, Railway, Fly Machines without privileged networking
  • App Runner, Cloud Run, and most managed container services
  • Shared hosting, and hosts where you are not root
One question decides this, and it takes a minute: can you run ip link add — or install a WireGuard client — on the machine that makes the outbound calls? If not, you are on this page, and the rest of it is the way round.

The way round: one machine you do control

Put the tunnel on a small virtual machine, and have your application reach the internet through that machine. The lease lives on the VM; your platform never sees a tunnel at all, only an ordinary outbound proxy.

the shape of it

your app on Heroku/Vercel/Lambda
        │
        │  HTTPS_PROXY=http://your-vm:8888
        ▼
   one small VM  ──[ WireGuard tunnel ]──▶  AnchoredIP edge
                                                 │
                                                 ▼
                                        the partner who allowlisted
                                        your dedicated address

Any provider will do and the machine can be the cheapest thing they sell — it moves your API traffic, not your users'. A $4–6 a month instance is the usual size.

Setting it up

1. Create the tunnel in your dashboard, choosing named destinations and listing the hosts your application must reach as your leased address — the partner API, the bank, the payment gateway. That mode routes only those, so the VM keeps its own default route and your SSH session is undisturbed.

2. Install it on the VM exactly as on any Linux box. The steps and the reboot-safe unit are on the Linux page.

3. Run a proxy on the VM and let it listen only where your application can reach it. Anything ordinary works — tinyproxy is the smallest:

on the VM

sudo apt install tinyproxy
# /etc/tinyproxy/tinyproxy.conf
#   Port 8888
#   Listen 0.0.0.0
#   Allow <the address your platform connects from>
sudo systemctl restart tinyproxy
An open proxy is found within hours and will be used to send whatever its finder likes from your dedicated address — the one thing on this product you cannot afford to have listed. Restrict it to the source you expect, put it behind your provider's firewall, or require a credential. Do not skip this step because it is the last one.

4. Point your application at it, which on every platform above is an environment variable and no code change:

on your platform

HTTPS_PROXY=http://your-vm:8888
HTTP_PROXY=http://your-vm:8888

Check it worked

From the VM first, naming a destination you listed in step 1. Then from your application, through the proxy:

on the VM, then from your app

curl -s https://api.ipify.org
curl -s --proxy http://your-vm:8888 https://api.ipify.org

Both should print your leased address. If the first does and the second does not, the proxy is reaching the internet directly rather than through the tunnel — check that api.ipify.org is one of the destinations you listed, because in this mode nothing else is carried.

What this costs you, honestly

  • A machine to keep alive. It needs updates and it can die. One VM is a single point of failure in front of every outbound call your application makes.
  • One more hop. Your platform to the VM, then the VM to the destination through Karaganda. The second leg is measured on the latency page; the first is yours, and picking a VM near your platform keeps it small.
  • A proxy is now yours to secure. See the warning above. This is the part people get wrong.

When to use something else

If a fixed outbound address is the whole of what you need, your code runs on a managed platform, and you have no other reason to want address space of your own — then a hosted HTTP proxy is a better fit than this, and we would rather say so than sell you a month of workaround. QuotaGuard and Fixie exist for exactly this shape, and we compare ourselves to them honestly.

Where this pattern earns its keep is when you already run servers of your own, or want the address to outlive any one provider, or need more than HTTP — because a proxy carries HTTP and this carries packets.

Not sure which you are? Write to support@mail.anchoredip.com and describe where your code runs. We will tell you if the answer is somebody else, which costs us a sale and saves you a month.