Seeking guidance on configuring a stable outbound (egress) IP

Questions / Help
1

Hi everyone,

I’m hoping someone can help clarify how outbound networking works in Fly.io.

We’re integrating with a third-party service that only accepts connections from a pre-approved source IP address.

Our Fly.io application has a dedicated IPv4 allocated, and we provided that address to the third party for allowlisting. However, requests from our application are still being rejected as if they’re coming from a different source IP.

Before we continue troubleshooting with the third party, we’d like to confirm our understanding of Fly.io’s networking model.

Specifically:

  1. Does allocating a dedicated IPv4 for an application also mean outbound requests originate from that same IP?
  2. If not, what is the recommended way to ensure all outbound requests present a single, stable public IP address?
  3. Is there a separate concept of a dedicated outbound (egress) IP?
  4. How can we verify the actual public source IP being presented to external services?
  5. Are there any common configuration issues or networking behaviors that typically cause confusion in IP allowlisting scenarios?

We’re trying to determine whether the issue is on our side or with the third-party allowlist, so any guidance on how Fly.io handles outbound IP addresses would be greatly appreciated.

Thanks in advance!

2

What you want are Static Egress IPs, which is separate from regular “dedicated IPs” for apps. The “dedicated IPs” are ingress IPs and are never used for egress purposes, because ingress IPs are anycast’d all over the world and using them for egress is very problematic for that reason. On the other hand, static egress IPs are scoped to apps and regions, which makes routing much more predictable, but that does mean you’ll need one for each region if your app is multi-regional. I do agree the naming can be a bit not obvious due to historical reasons.

To verify the egress IP, you can use common what-is-my-IP APIs, or you can rely on logs of your target service if they provide it.