Dedicated inbound IP: the add-on

When to add a dedicated IP

• Start with a tunnel. A hostname route on the shared pool needs no IP of your own and fails over between two nodes.
• Add a dedicated IP when a partner must allowlist one address that is yours alone, or when your traffic must arrive only at your address.
• Add one when the origin is a host the node dials, such as a server with a public address. A shared route always takes a connector origin.
• Add one for your own host names on 443, routed by SNI. See your own names.

The add-on changes where a route is placed, not what it is. A dedicated route has the same kinds, partners, logs, and webhooks as a tunnel, and fm routes placement moves a route between the two. See Move a route.

Before you start

• The add-on, on Pro and up at $9 per IP-month, billed by the hour for each dedicated IP while it holds a route, on top of the plan. Each plan's dedicated inbound IPs are in Limits. A plan without it refuses a dedicated route with route.dedicated_not_entitled (402).
• Tunnels are on Pro and up, and a plan without them refuses every route with route.tunnel_not_entitled (402).
• A dedicated IP of the app, in the region your partner expects. fm ips list prints its id and address.
• An origin for your partner's traffic, as a host name with an A record or a public IPv4 address, and its port. Private, loopback, link-local, CGNAT, multicast, and metadata addresses are refused, and so are Fixedmark's own addresses and the mail ports 25, 465, and 587.
• The partner's source addresses, as IPv4 addresses or CIDRs. Ask the partner for the list they publish for outbound traffic.

Create the route

Name the app, the dedicated IP, the origin, and every partner range. Repeat --partner for each one. Leave out --port and the route takes the lowest unused port from 20000.

fm routes create --app APP_ID --kind tcp --name db \
  --dedicated-ip IP_ID \
  --origin app.example.com:5432 \
  --partner 198.51.100.0/24

curl -X POST "https://api.fixedmark.com/v1/apps/APP_ID/routes" \
  -H "Authorization: Bearer $FIXEDMARK_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"kind":"tcp","name":"db","placement":{"mode":"dedicated","ip_id":"IP_ID"},"origin":{"kind":"host","host":"app.example.com","port":5432},"partner_cidrs":["198.51.100.0/24"]}'

The API answers 202 with the route and a job_id. fm prints the route, then watch it with: fm jobs watch JOB_ID. Send the same Idempotency-Key again to repeat a create safely.

Wait for the route to open

fm jobs watch JOB_ID
fm routes list --app APP_ID

The job checks the origin, writes the route, pushes it to the node, and waits for the node's listener. GET /v1/jobs/JOB_ID/events streams the same steps. The route's state then reads:

Give the partner the address

Send the partner the IP's address and the route's port, such as 203.0.113.10:20000. From one of the listed source addresses, the partner checks the port opens:

nc -vz 203.0.113.10 20000

A dedicated tcp route also gets a hostname that points at your IP, such as db.<org-slug>.<zone>, so a partner may dial the name instead. The connection reaches app.example.com:5432. Your connection log shows an ingress row with peer set to the partner's address, such as 198.51.100.7, and result ok. A source outside the list is dropped by the node's firewall before the proxy sees it.

Change the partner list

Setting partners replaces the whole list. Nodes apply the new list within seconds.

fm routes partners set --app APP_ID db \
  --partner 198.51.100.0/24 --partner 192.0.2.44

curl -X PUT "https://api.fixedmark.com/v1/apps/APP_ID/routes/ROUTE_ID/partners" \
  -H "Authorization: Bearer $FIXEDMARK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"partner_cidrs":["198.51.100.0/24","192.0.2.44/32"]}'

Health, alerts, and logs

• Fixedmark checks the route's listener from outside the node and its origin from the node, and shows the placement's health beside the route: healthy, listener_down, origin_down, ip_down, or unknown. The route's own health is the roll-up: healthy, degraded, down, or unknown.
• Each change of the roll-up sends the webhook route.health to endpoints that subscribe to it.
• Partner connections are in your connection logs with direction=ingress. Filter by peer, listener_port, or route_id.
• Inbound bytes count toward your plan's inbound allowance, separately from outbound.

When a node fails

A dedicated route is never moved to another IP, since its partners allowlist that one address. It follows its IP. What holds the IP during a node failure depends on the region's provider. These values are provisional until Fixedmark's failover measurements on each provider are published. A tunnel fails over by DNS between two nodes instead.

Limits

• TCP routes use ports 20000 to 29999, one route per port on each IP.
• A route admits 1 to 256 partner entries, IPv4 only. An entry inside another one on the same route is refused.
• A connection idle for 5 minutes closes. The node gives the origin 10 seconds to accept.
• Your plan sets how many routes, hostnames, and dedicated inbound IPs you can hold. See limits.

Refusals

fm exits 2 on a malformed request (400 or 422) and prints every problem. It exits 1 on any other refusal, such as 402, 409, or 503, and prints the code. The API answers with the code in error.code.

Delete a route

fm routes delete --app APP_ID db

The node closes the port within seconds. For TLS traffic to your own host name on port 443, use your own names instead of a TCP port.