Public IPs
A public address is allocated to your organisation from a pool, then attached to a server. Two steps on purpose: an address you hold stays yours across rebuilds, and moving a service to a new machine does not change the address your users know.
Routed, not translated
Section titled “Routed, not translated”The address is configured on the virtual machine itself, as a second network interface. The edge router forwards the block toward the region and does not translate it.
Inside the guest, ip addr shows the real public address.
This matters more than it sounds:
- Protocols that embed addresses in their payload — SIP, FTP, some VPNs, some clustering software — work without special cases.
- Certificate validation and reverse DNS behave the way documentation says they do.
- There is no shared NAT pool, so your outbound traffic is attributable to you and not to a neighbour.
- Debugging is honest: what the machine thinks its address is, is its address.
What runs underneath
Section titled “What runs underneath”| Layer | Technology |
|---|---|
| Pool management | Control plane; addresses are materialised as rows when the operator defines a pool |
| Attachment | A second Proxmox network interface on the VM, plus guest configuration via cloud-init or cloudbase-init |
| Edge | The block is routed to the region by the edge device (FortiGate through an adapter). Policy lives there; zone9 programs only what it owns |
| Firewalling | Per-VM Proxmox firewall rules, scoped to the public interface — see Firewalls |
Pools, and one subtlety worth knowing
Section titled “Pools, and one subtlety worth knowing”An operator defines a pool as a CIDR block, and the panel creates one row per address. A pool is declared as one of two kinds, and the distinction changes how many addresses you get:
- Subnet — the block is a real subnet. The first (network) and last (broadcast) addresses are not usable, as in any subnet.
- Slice — the block is a slice carved out of someone else’s larger network and routed to you. Every address in it is usable, including the first and the last, because they are not a network and a broadcast address here; they are just addresses.
If you have been allocated an address that looks like a network or broadcast address and the platform still offers it, the pool is a slice and the address is genuinely yours to use.
Allocating and attaching
Section titled “Allocating and attaching”Allocation is usually done by your operator: Public IP in the panel shows what your organisation holds.
To attach: open the server, Public IP → Tak (Attach). If more than one free address is available you choose which; otherwise the first usable one is taken. Detaching returns the address to your organisation — it is not returned to the platform pool.
Over the API:
curl -X POST https://api.example.com/v1/servers/srv_…/public-ip \ -H "Authorization: Bearer $Z9_TOKEN" -H "Content-Type: application/json" \ -d '{"address_id":"pip_…"}'Omit the body to take the first usable address.
Where else addresses are used
Section titled “Where else addresses are used”- A gateway consumes one address; every subnet behind it leaves through it.
- A public load balancer consumes one. An internal load balancer consumes none — it is reachable only on its private address.
Both can be told which address to use rather than accepting an automatic choice.
Limits
Section titled “Limits”- IPv4 only.
- One public address per server.
- Addresses do not move between regions.
- Reverse DNS is an operator function, not a self-service one.