What a server gets
Every plan includes one dedicated IPv4 address. It is not shared and not behind NAT. It appears in the provisioning email and on the server's page.
LayerOne enforces source-address validation outside the guest: a server can send public traffic only from addresses allocated to it. This protection is automatic and cannot be disabled from the guest.
No IPv6
There is no IPv6 on this platform. Not dual-stack, not IPv6-only, not on request. If your application needs to be reachable over IPv6, put it behind a proxy that terminates IPv6 elsewhere.
Private-only servers
At deploy you can turn the public address off. A private-only server has no path to the internet at all: no inbound, and no outbound either, because there is no platform NAT. You reach it from:
- the browser console, or
- another of your servers on the same private network.
To give a private-only server internet access, route it through a firewall or router VM of your own that has a public address and does the NAT itself.
Addressing cannot be changed after deploy
You cannot add a public IPv4 address to a private-only server, and you cannot remove the public address from a server that has one. Addressing is chosen at deployment. To change it, deploy a replacement server.
Additional public addresses
Extra public IPv4 addresses are floating IPs, ordered separately and assigned to a server yourself.
What you can change afterwards
| Thing | Changeable? |
|---|---|
| Public IPv4 present or not | No |
| The public address itself | Not by you. Ask in a ticket |
| Reverse DNS (PTR) | Yes, under Network |
| Private network attachments | Yes, any time |
| Firewall rules | Yes, any time |
| Port speed | Only by deploying on a different family |