DNS setup: can I add A record for IPv4 if it is public (shared)?

[seb97]

I am not sure on the exact implications on having the ingress IPv4 as public (shared). Does this mean it can change?
With the IPv6 it is simple; I added a AAAA record to my DNS pointing api.example.com to the IPv6 address of my app (as listed by fly ip list)
However, I am not sure how to proceed with the IPv4. Should I just add a A record pointing to it?

Thanks for your help! I am new to all this

[greg]

Hi,

Yep, you are correct: you simply add an A record in your DNS pointed at that IPv4. That way you will have both an A record and an AAAA record.

No, the IPv4 won’t change. Being shared just means it is shared with other apps. That is better value for Fly and hence a shared IPv4 can be free.

The recommended approach is to use the shared IPv4 unless you need a dedicated one (which makes sense as you might as well avoid that extra fee unless you really need to be paying it). Whether you need a dedicated one depends on your usage. Check out this linked paragraph for the reasons why you might need a dedicated one and see if any apply. Generally they won’t:

Public Network Services

[seb97]

This was very helpful, thank you!
So with the IPv4 being shared, I am assuming fly has some internal way to route requests to the appropriate VM? This way a user can have confidence that a request doesn’t make its way to some other VM

[greg]

Hi,

No problem.

That’s right: they use the domain to decide which app to route a request to. Each app will have a unique domain.

If it’s a concern you can have a dedicated IPv4, even if you don’t actually need one. You just have to pay a monthly fee for it. It’s up to you.

[seb97]

From what I understand there is no way to have a static egress IP. This is a bit of a problem for users connecting to databases that specify network access by IP (For example I am using MongoDB)
Having said that, MongoDB does allow ranges of IP’s to be whitelisted; is there a range of egress IP’s that fly reliably uses? If so, I can improve DB security by restricting access to the range of egress IP’s fly uses.

[greg]

@seb97 Correct, that’s not currently supported.

There are several threads about that e.g

Set/get outgoing IP address for whitelisting on external APIs/Hosts

Hi there, I don’t think this is something that Fly currently does, but is there any way to set an IP address (or a list/range) that a fly app will use to make requests to external hosts? I’d really like to be able to reliably whitelist Fly apps by IP/list/range/whatever. I run reverse proxies, and occasionally one or more Fly IPs will get blacklisted by an external host. Since some requests go out through different Fly IP addresses to the external host, we get an intermittent “sometimes it mak…

This thread has some suggested ways to get an IP (if you scroll down). I haven’t tried any of them so I don’t know if they actually work:

Outbound IP Address

We still don’t have the plumbing to give people stable outbound IPs. For now, the simplest thing is either quotaguard.com or VMs from someone like DigitalOcean running a proxy (Smokescreen would be pretty easy: GitHub - fly-apps/smokescreen: An example of deploying Smokescreen on Fly.io)