You need static IP addresses if anything outside your office has to reach you at a fixed address: a VPN, a server, a camera system, or a bank or vendor that allow-lists your IP. Most business circuits include a small block. You need BGP only if you want your own IP addresses to stay reachable through two or more carriers at once and you have engineers to run it. Most businesses get the resilience they actually want from SD-WAN over two circuits instead.
These two sit near each other on quotes and get conflated. They solve very different problems at very different levels of complexity.
Static IPs
What a static IP is
Every connection to the internet has a public IP address. On most consumer and many small-business services, that address is dynamic: the carrier can change it, usually when equipment restarts. Some cellular and consumer services go further and put many customers behind one shared address, so nothing outside can connect in at all. A static IP is an address assigned to you that does not change.
When you need one
- Remote access and site-to-site VPNs that need a fixed address to connect to.
- Allow-lists. Banks, payment processors, software vendors and clients often restrict access to known addresses. A changing IP breaks that relationship at unpredictable moments.
- Anything you host: a mail server, a client portal, a file server, a building management system.
- Security cameras and access control viewed from outside the building.
- Phone systems where the voice provider authenticates your equipment by IP address.
If none of these apply, you may not need static IPs at all. If any do, they are inexpensive and worth having. Most dedicated internet circuits include a small block.
What block sizes mean
IP blocks are described with a slash number. A smaller number after the slash means more addresses. On a typical business circuit, some addresses in each block are reserved (the network address, the broadcast address and the carrier's gateway), so the usable count is lower than the total.
| Block | Total addresses | Typically usable by you |
|---|---|---|
| /30 | 4 | 1 |
| /29 | 8 | 5 |
| /28 | 16 | 13 |
| /27 | 32 | 29 |
A /29 covers most offices: a firewall, a VPN, a couple of hosted services. IPv4 addresses are scarce, so carriers may ask you to justify larger blocks and may charge for them. IPv6 addresses are plentiful and usually come in large blocks at no extra cost, though not every system you connect to will use them.
The catch when you switch carriers
Static IPs normally belong to the carrier that assigned them. Change carriers and you get new addresses, which means updating firewalls, VPN peers, DNS records and every partner allow-list. It is manageable with planning, and it is one of the real costs of switching covered in the renewal trap.
Putting static IPs to work
How they reach your equipment
The carrier routes your block to your firewall or router. From there, the firewall decides what each public address does: one might be the office's main outbound address, another might forward VPN traffic to a VPN server, another might map directly to a camera system. Your IT person configures this, and it is worth documenting which address does what, because nobody remembers three years later.
Security
A fixed address is also a fixed target. Anything you expose on a static IP will be found and probed by automated scanners, usually within hours. Only open what you need, restrict access to known addresses where you can, keep the firewall and exposed systems up to date, and review the rules once a year. See our cybersecurity services if nobody owns this.
Reverse DNS for email
If you run your own mail server, receiving servers often check that your IP address has a matching reverse DNS record. The carrier controls reverse DNS for the addresses it assigns you, so ask it to set the record, or to delegate it to you. Without it, your outbound mail is more likely to be marked as spam.
BGP
What it does
BGP (Border Gateway Protocol) is how networks on the internet tell each other which addresses they can reach. When you run BGP yourself, you announce your own block of addresses to two or more carriers. The rest of the internet learns that it can reach you through either. If one carrier fails, routes through it are withdrawn and traffic arrives through the other, and your addresses never change.
That is genuine carrier-grade redundancy for inbound traffic. It is also a commitment.
What it takes
- An AS number, which identifies your network, from a regional internet registry (ARIN in the United States and Canada).
- Address space that can be announced independently. In practice, IPv4 blocks smaller than a /24 (256 addresses) are widely filtered on the internet, so you need at least that. You can obtain space from the registry, usually via a waiting list or the transfer market, or in some cases announce space a carrier has assigned you, with its written permission.
- At least two carriers willing to accept your routes, on circuits that are physically diverse, or the exercise is mostly symbolic.
- Routers capable of running BGP and handling the routes you choose to receive.
- Good hygiene: route filters, registered route origin records (RPKI), and monitoring.
- People who can configure and troubleshoot routing, because a mistake is visible to the whole internet.
See our IP transit page if you already run your own network and need upstream capacity.
IPv6 in practice
IPv6 removes the scarcity problem: carriers commonly assign business customers a large IPv6 block, enough for every device you will ever own to have its own public address. Turning it on is worthwhile, because more of the internet uses it each year and some services perform well over it. But it does not yet replace IPv4. Many partners, vendors and allow-lists still expect an IPv4 address, so plan to run both side by side. If you do enable IPv6, make sure your firewall rules cover it too; a firewall that filters IPv4 carefully and IPv6 not at all leaves a door open.
Static IP, BGP or SD-WAN?
| Static IPs | BGP multihoming | SD-WAN over two circuits | |
|---|---|---|---|
| Solves | A fixed address for inbound access and allow-lists | Your own addresses reachable via several carriers | Automatic failover and path selection for outbound and site-to-site traffic |
| Complexity | Low | High | Moderate, lower if managed |
| Staff needed | Whoever manages your firewall | Network engineers | A managed provider or IT generalist |
| Typical user | Most businesses with a VPN or allow-lists | Service providers, hosting, always-on platforms | Offices and multi-site businesses that cannot go offline |
Worked examples
Hypothetical businesses, used only to illustrate the choice.
A 40-person accounting firm has a VPN for remote staff and its tax software vendor allow-lists its office address. It needs a /29 of static IPs on its primary circuit. It adds a coax backup with its own static address, asks the vendor to allow-list both, and uses SD-WAN to fail over. No BGP required.
A software company hosts a customer-facing platform in its own racks in a data centre, and customers connect to fixed addresses written into their systems. For it, BGP across two carriers is worth the engineering, because an address change or a single-carrier outage would take customers down.
Which do you need?
Static IPs: probably, if you host anything or get allow-listed. Cheap, simple, ask for them.
There is also a middle option some carriers offer: two circuits from the same carrier, running BGP between your router and theirs using the carrier's own addresses. It gives fast failover between the two circuits without your own address space, though both circuits still depend on one carrier. It can suit a single important site that wants more than a simple backup.
BGP: only if you are a service provider, run infrastructure that genuinely cannot go offline for inbound users, or already employ network engineers. For everyone else, SD-WAN across two circuits delivers the resilience you actually wanted with a fraction of the complexity. See SD-WAN explained and whether you need backup internet.
Questions to ask your carrier
- How many static IPv4 addresses are included, how many are usable, and what does a larger block cost?
- Is IPv6 included, and what size block?
- Will you accept BGP announcements of my own address space, and do you require registered route origin records?
- Can I announce addresses you assign me via another carrier?
- Do you offer a full routing table, a default route, or both?
- If I leave, how much notice do I get before my assigned addresses are reclaimed?
The question that settles it
Does your business have someone whose job title includes "network"? If not, you want SD-WAN, not BGP, and that is not a compromise; it is the correct engineering choice for your situation. Either way, we can quote circuits with the static IPs or BGP support you need across several carriers, free and with no obligation, usually the same day. Send us your address, or call 478-758-8091 or text (347) 870-0965.
