Static IPs for any workload
Tunnel traffic through a single egress gateway with a dedicated IP address.
No more worrying about IP addresses.
Stop managing NAT gateways, route tables, and security groups that are tied to a single provider or region. Grab a proxy and ship your application anywhere you want without the devops headache.
- 198.51.100.23 ✗
- 198.51.100.64 ✗
- 198.51.100.38 ✗
Attach a global VPC.
Enable the egress gateway on a VPCNetwork and the network gets a dedicated egress IP. Send traffic via SOCKS5 or automatically configure the kernel to funnel traffic through a tunnel.
Declare the network
Enable the egress gateway and you get a dedicated IP address. That's it.
Attach a machine
apoxy tunnel run dials out so it works from anywhere you can reach the internet.
Send traffic
Use a local SOCKS5 proxy or kernel mode to route your traffic. Anything that speaks SOCKS5 (curl, an SDK client, etc.) can go through the tunnel. On Linux, kernel mode takes over the egress for the whole machine so you don't have to change code.
# A VPCNetwork with the egress gateway on. apiVersion: vpc.apoxy.dev/v1alpha1 kind: VPCNetwork metadata: name: egress-demo spec: egressGateway: enabled: true # Apply it, then attach the machine that should use it. $ apoxy apply -f egress.yaml $ apoxy tunnel run egress-demo --socks-addr localhost:1080 & # Same box, same code, new source address. $ curl --socks5-hostname localhost:1080 https://ifconfig.me 203.0.113.42
Flexible deployment.
There are lots of options for static IPs. Ask for a free call with our solutions team to help find the approach that works best for you.
| Approach | Covers | Non-HTTP TCP | App changes |
|---|---|---|---|
| Cloud NAT gateway | One VPC, one region | Yes | None — route table |
| Platform static-IP add-on | That platform only | Platform-dependent | None |
| Apoxy Tunnel SOCKS Proxy | Any host that dials the local proxy | Yes, over SOCKS5 | Point the client at the proxy |
| Apoxy Tunnel Kernel Mode | Any Linux machine, any platform | All protocols | None — default route |
Questions we get.
What does a static egress IP cost?
Base pricing is $10 per month per IP, plus $0.05 per GB for traffic. Volume discounts are available for both IP ranges and high traffic use cases.
Does the IP survive a redeploy or a scale event?
Yes. The address is a property of the egress gateway, not of the instance that happens to be running. New instances send traffic through the same gateway and present the same source address when configured to use our tunnels for egress.
Does this work on Vercel, Lambda, or Cloud Run, where I cannot run a daemon?
Yes, but there is some additional set up required and you may have to change your code. We can support environments such as Lambda without code changes but for sandboxed serverless runtimes like Vercel, you will need to make code changes to use our SOCKS5 proxy. Our solutions team can help you set this up for free. Get in touch for more information.
Is it one address or a range?
By default you get a dedicated address per egress gateway, a /32. If you want separate identities per environment or per tenant and for all of these to be under a /24, we can configure your account to use a range of IP addresses. Contact us to set this up.
Can I buy a range of IP addresses?
Yes. If you are interested in purchasing an IP address range at a discounted rate, contact us. We offer allocations from a /24 up to a /16.
Can I ingress traffic to the same IP address?
Yes. Our team can configure this for you. Contact us to set this up.
Can machines in different regions or clouds share one address?
Yes. The address belongs to the gateway, and every machine attached to it egresses through that gateway. The tunnel client picks the nearest PoP for the transport hop, which changes the path, not the source address the upstream sees.
Does it carry database traffic or just HTTP?
Yes, our SOCKS5 proxy supports TCP but we recommend Kernel Mode for TCP and UDP traffic. You can connect to Postgres, MySQL, Redis, SFTP, SMTP, and anything else that is TCP or UDP through the tunnels. Obviously, it supports HTTP too.
Starting at $10/IP.
Free tier includes a shared static egress IP for your application so you can try the integration. Dedicated IPs are attached by request.