# Dedicated IPs — Send outbound service traffic through fixed, reserved IP addresses.


> *Dedicated outbound IPs require a [Pro plan](platform-features-by-plan) or higher.*
>
> For details, see the [pricing page](/pricing).

*Dedicated IPs* let you create sets of static outbound IP addresses for your Render workspace. These IP addresses are exclusive to your workspace, enabling you to allowlist your services with external providers:

```mermaid
flowchart LR
    subgraph "<b>Your Render workspace</b>"
    direction LR
        web["Web Service"]
        private["Private Service"]
        ips{{"<b><code>203.0.113.10</code></b><br/><b><code>203.0.113.20</code></b><br/><b><code>203.0.113.30</code></b>"}}
        web edge1@--> ips
        private edge2@--> ips
    end
    subgraph "<b>External providers</b>"
        provider1["MongoDB Atlas"]
        provider2["Snowflake"]
        ips edge3@--> provider1
        ips edge4@--> provider2
    end
    edge1@{animation: slow}
    edge2@{animation: slow}
    edge3@{animation: slow}
    edge4@{animation: slow}
    class ips success;
```

## How it works

- Each dedicated *IP set* you create includes three IPv4 addresses:

    [image: A dedicated IP set in the Render Dashboard]

- All IPs in a set belong to the same region, which you select during creation.
    - Only services in the selected region can use the IPs for outbound traffic.
- You can scope an IP set to specific [environments](projects) in your workspace, or to your entire workspace.
    - An environment-scoped IP set always takes precedence over a workspace-level IP set, if both would apply to a particular service.
- A service's outbound requests might use any IP in its assigned set.
- Render bills your workspace monthly for each IP set. [See pricing](/pricing).
- By default, each workspace can have up to 4 dedicated IP sets.
    - If you need more, reach out to our support team in the [Render Dashboard](https://dashboard.render.com?contact-support).
- You can manage dedicated IP sets via the [Render Dashboard](https://dashboard.render.com), the [Render API](https://api-docs.render.com/reference/list-dedicated-ips), or the [Terraform provider](terraform-provider).

Workspaces _without_ dedicated IPs use Render's default [outbound IP ranges](outbound-ip-addresses), which are shared by other services in the same region.

## Creating an IP set

Workspace members with the [*Admin* role](team-members#member-roles) can create dedicated IPs with any of the following methods:

**Dashboard**

1. From your workspace home in the [Render Dashboard](https://dashboard.render.com), click *Networking > Dedicated IPs* in the left pane.
2. Click *+ Create Dedicated IPs* to open the creation form:

   [image: The dedicated IP creation form in the Render Dashboard]

3. Provide a *Name* for the IP set.
   - Optionally add a *Description* for your team's reference.
4. Select the IP set's *Region*.
    - Only services in the selected region can use the IPs for outbound traffic.
    - You can't change an IP set's region after creation.
5. Under *Scope*, choose which services will use the IP set:

| Scope | Description |
| --- | --- |
| *Workspace* | All services in the selected region will use the IP set, _unless_ they belong to an environment with its own assigned set. |
| *Limited Environments* | Only services in the selected region _that belong to a selected environment_ will use the IP set. |

    Environments with services in multiple regions are labeled *Mixed regions*:

    [image: An environment labeled Mixed regions in the dedicated IP creation form]

    Only services in the same region as the IP set will use it for outbound traffic.

6. Review the monthly total and click *Create Dedicated IP*.

That's it! Render provisions your new IP set within a few minutes. You can track progress on the [status](#ip-set-status) page, and Render sends workspace admins a confirmation email when the IPs become active.

**API**

Using the [Render API](api), send a request to the [Create Dedicated IP](https://api-docs.render.com/reference/create-dedicated-ip) endpoint.

Provide your workspace ID, region, and name in the request body:

```json
{
  "ownerId": "tea-abc123",
  "name": "Production IPs",
  "region": "oregon",
  "description": "Outbound IPs for production services",
  "environmentIds": ["env-def456"]
}
```

Include `environmentIds` to scope the IPs to specific environments, or omit it to scope the IPs to your entire workspace.

You can now add your new IPs to external allowlists to ensure uninterrupted connectivity.

## Checking your service's outbound IPs

After you [create an IP set](#creating-an-ip-set), you can confirm that your services are using it with the following steps:

1. From your workspace home in the [Render Dashboard](https://dashboard.render.com), click a service to open its details page.
2. Open the *Connect* dropdown in the upper right.
3. Switch to the *Outbound* tab. If your service is using a dedicated IP set, its name appears above the list of IP addresses:

   [image: Dedicated outbound IP addresses shown in the Outbound tab of the Render Dashboard]

## Managing IP sets

From your workspace home in the [Render Dashboard](https://dashboard.render.com), click *Networking > Dedicated IPs* in the left pane.

Here you can view each IP set's name, region, scope, [status](#ip-set-status), and IP addresses:

[image: A dedicated IP set in the Render Dashboard]

You can also list your dedicated IP sets via the [Render API](https://api-docs.render.com/reference/list-dedicated-ips).

### Editing a set

> If you change the scope of a dedicated IP set, services that no longer match that scope revert to using Render's default [outbound IP ranges](outbound-ip-addresses).

**Dashboard**

1. Click the *•••* menu on the dedicated IP set you want to edit.

   [image: The options menu for a dedicated IP set]

2. Click *Settings*. The page displays your current configuration.

3. Click *Edit* to modify the *Name*, *Description*, or *Scope* of your dedicated IP set.

4. Click *Save* to apply your changes.

**API**

Use the [Update Dedicated IP](https://api-docs.render.com/reference/update-dedicated-ip) API endpoint. All fields are optional, and any omitted fields are left as is:

```json
{
  "name": "Updated name",
  "description": "Updated description",
  "environmentIds": ["env-abc123", "env-def456"]
}
```

To switch from environment-scoped to workspace-scoped, pass `"environmentIds": []`.

You can't change an IP set's region after creation. To move an IP set to a different region, delete the existing set and recreate in your desired region.

### Deleting a set

> *Deleting an IP set reverts affected services to Render's default [outbound IP ranges](outbound-ip-addresses).*
>
> If external systems allowlist your dedicated IPs, update those allowlists before deleting the set.

**Dashboard**

1. Click the *•••* menu for the dedicated IP set you want to delete and click *Delete Dedicated IP*.

   [image: The delete option in the dedicated IP set menu]

2. Follow the on-screen instructions to confirm the deletion.

**API**

Use the [Delete Dedicated IP](https://api-docs.render.com/reference/delete-dedicated-ip) API endpoint with the dedicated IP set's ID.

If you delete an IP set in the middle of a billing period, Render prorates your bill accordingly.

### IP set status

The Render Dashboard displays one of the following statuses for each of your workspace's IP sets:

| Status | Description |
| --- | --- |
| *Provisioning* | Render is creating and assigning your dedicated IP addresses. |
| *Creating* | Render created your IP resources, but not all gateways are ready yet. |
| *Active* | Dedicated IPs are active and traffic is routed through them. |
| *Failed* | Provisioning was not successful. |
| *Deleting* | The IP set is being removed and traffic is transitioning back to [shared outbound IP ranges](outbound-ip-addresses). |

If a set remains in *Provisioning* or *Pending* for an extended period, verify that the region and scope you selected match your services. If the status does not change, please reach out to our support team in the [Render Dashboard](https://dashboard.render.com?contact-support).

## FAQ

###### Can I choose my dedicated IP addresses?

*No.* Render automatically provisions and assigns the IP addresses for each IP set.

###### How do I migrate from a third-party static IP proxy?

To migrate from a third-party proxy to dedicated IPs:

1. Purchase a set of dedicated IPs and wait for Render to provision them.
2. Add your new set's IP addresses to your external provider's allowlists.
3. Remove the proxy configuration from your application code.

Keep your old proxy IPs in external allowlists until you confirm your new dedicated IPs are working.

###### What if my environment has services in multiple regions?

Each dedicated IP set only applies to a single region. You can create a separate IP set for each region your services send outbound traffic from.

###### I have a workspace-level IP set and an environment-scoped dedicated IP set. Which set does my service use?

- If the service belongs to an environment with an environment-scoped IP set, it uses that set.
- Otherwise, it uses the workspace-level IP set.

###### Do service previews and preview environments use my dedicated IP sets?

*Yes.* Instances created as part of a [service preview](service-previews) or [preview environment](preview-environments) belong to the same environment as their base service, and they therefore use the same dedicated IP set.

###### What happens if I change the scope of a dedicated IP set?

Render updates the scope of a dedicated IP set, but propagating those changes across the network may take a while. If your external systems enforce strict allowlists, update those allowlists before or immediately after making changes to a dedicated IP set.

###### Can I apply multiple dedicated IP sets to the same region in the same environment?

*No.* Each IP set you create must apply to a unique combination of region and environment. If you try to apply a new IP set to the same environment and region as an existing set, the creation form indicates the overlap:

[image: An environment already managed by another dedicated IP set]

###### Which service types support dedicated IP sets?

All service types _except_ static sites support dedicated IPs. Static sites don't initiate outbound traffic, so dedicated IP sets don't apply to them.

###### Do dedicated IP sets affect inbound traffic?

*No.* Dedicated IPs control only _outbound_ service traffic to destinations outside of Render. You can restrict which IPs can send traffic _to_ your services by setting [inbound IP rules](inbound-ip-rules).

###### Do services use dedicated IP sets while building?

*Yes, with one exception.* Services use dedicated IP sets for any outbound build traffic, such as package downloads. The exception is Docker image pulls, which use Render's [shared outbound IP ranges](outbound-ip-addresses).


---

##### Appendix: Glossary definitions

###### region

Each Render service runs in one of the following regions: *Oregon*, *Ohio*, *Virginia*, *Frankfurt*, or *Singapore*.

Services in the same region can communicate over their *private network*.

Related article: https://render.com/docs/regions.md

###### static site

Deploy this *service type* to host a static website (HTML/CSS/JS) over a global CDN at a public URL.

Related article: https://render.com/docs/static-sites.md