# Floating IPs

A Floating IP is a public IPv4 address you hold and associate with a network interface. Learn how to use it, when it's released, and how it behaves inside its VPC.

A Floating IP is a public IPv4 address that you allocate to a project and associate with a network interface. The platform translates it 1:1 to the interface’s private IPv4 address, in both directions: the instance reaches the internet as that address, and the internet reaches the instance through it. The address stays yours, unassociated if need be, until you release it.

The states of a Floating IP you allocate:

| From | Command or event | To |
| --- | --- | --- |
| – | `allocate-floating-ip` | unassociated |
| unassociated | `associate-floating-ip` | associated |
| associated | `disassociate-floating-ip`, or the instance is terminated | unassociated |
| unassociated | `release-floating-ip` | released |

## Use a Floating IP [#use-a-floating-ip]

You work with a Floating IP through four commands:

- [`allocate-floating-ip`](/docs/network/reference/cli#allocate-floating-ip) takes an address from the platform’s public pool for your project. It requires a payment method; without one, it’s refused with `PAYMENT_METHOD_REQUIRED`.
- [`associate-floating-ip`](/docs/network/reference/cli#associate-floating-ip) points it at a network interface. A Floating IP serves one interface at a time; associating one that’s already associated is refused.
- [`disassociate-floating-ip`](/docs/network/reference/cli#disassociate-floating-ip) removes the association. Running it on an unassociated address does nothing.
- [`release-floating-ip`](/docs/network/reference/cli#release-floating-ip) gives the address back. It’s refused while the address is associated.

For example, to give a running instance a public address, find its interface with `list-network-interfaces` and run:

```sh
origin network associate-floating-ip --floating-ip-urn <floating-ip-urn> \
  --network-interface-urn <network-interface-urn>
```

The instance’s subnet must be in a VPC with an Internet Gateway, and its security groups and network ACL must allow the traffic. See [Internet access](/docs/network/internet-access).

## When an address is released [#when-an-address-is-released]

An address you allocated is never released for you. Terminating the instance it’s associated with only disassociates it, so it’s ready for the next instance.

An address the platform assigned at launch, because the subnet has auto-assign public IP turned on, is different: the platform releases it when you terminate the instance. To keep an address across instances, allocate one yourself. See [Default VPC](/docs/network/vpcs/default-vpc).

A released address isn’t allocated again for one hour, whether you released it or the platform did. DNS records, allow-lists and integrations that still name the address have that hour to expire or be updated before the address can belong to someone else. For the same reason, an address you’re allocated wasn’t someone else’s a moment ago.

## Reaching a Floating IP from inside its VPC [#reaching-a-floating-ip-from-inside-its-vpc]

An instance can connect to the Floating IP of another instance in the same VPC, or to its own, and gets the reply from that Floating IP. This happens when services in one VPC address each other by public DNS name, or when an instance checks itself through its public address. Two things differ from private-address traffic:

- The server sees a public source address. A caller with its own Floating IP appears as that address. A caller without one appears as the Floating IP it called. Security group rules that name a group, including the default group’s rule, match private addresses only, so they don’t admit this traffic and the connection hangs. Allow the port from the public addresses you expect, as you would for an external client.
- It works only from the Floating IP’s own VPC. From an instance in a different VPC, even one of yours, connecting to a Floating IP hangs. Reach that instance from outside the platform instead.

## When no address is available [#when-no-address-is-available]

The public IPv4 pool is shared by the whole platform, so `allocate-floating-ip` can be refused because no address is left. That’s separate from your organization’s and project’s public IP quota, which is refused with the limit you reached. Both messages say which one applies. Releasing Floating IPs you don’t need frees quota and pool space.

## Billing [#billing]

A Floating IP is billed for as long as it’s allocated to you, whether or not it’s associated. For prices, see [Pricing](/docs/pricing).

## Related [#related]

- [Give a private subnet internet access with a NAT gateway](/docs/network/internet-access/nat-gateways)
- [Network interfaces](/docs/network/vpcs/network-interfaces)
- [`allocate-floating-ip` reference](/docs/network/reference/cli#allocate-floating-ip)
- [`associate-floating-ip` reference](/docs/network/reference/cli#associate-floating-ip)
- [Limits](/docs/platform/reference/limits)