Cloudflare BYOIP: Bring Your Own IP Addresses

By Savvas Bout, Founder of Prefixx. Last updated 15 September 2026.

Cloudflare Bring Your Own IP allows you to announce your own address space via Cloudflare’s network. This bring your own IP approach lets you run your IPs through Cloudflare's network, including DDoS mitigation, content delivery networking, and Zero Trust security, without third-party re-routing or giving up control of your announced prefixes.

The platform's inline inspection and filtering capabilities help protect infrastructure from DDoS attacks while maintaining performance for legitimate requests. Organizations retain full control over prefix ownership and routing policy decisions throughout the announcement process. Organizations maintain direct ownership of their address space throughout the process, avoiding the complications that can arise from third party re-assignments or transfers during migration.

The first question that typically comes up is, "Where do I get the public IP address blocks to route traffic?" The typical answer: you buy or lease them through the secondary market.

This article gives a good overview of how Cloudflare's BYOIP program works. It also describes the prefix requirements you need to meet before you can onboard your addresses from other systems. Before you acquire a block of IP addresses, you need to check a few things.

For example, a prefix with a dirty reputation, or missing registry records, can cause all sorts of problems that Cloudflare cannot fix or reconfigure for you. If you are sourcing IPs specifically for a Cloudflare deployment, the sourcing and paperwork decisions will matter as much as the technical configuration.

These issues become critical when your prefix is already in production and any announcement delay or filtering problem can disrupt live services. Many businesses discover these sourcing challenges only after committing to a migration timeline, which can force rushed decisions or costly delays.

What is Cloudflare BYOIP and how does it work

Cloudflare BYOIP lets enterprises announce their own IP prefixes across Cloudflare's global network instead of using Cloudflare-assigned addresses. Traffic is scrubbed, accelerated, or protected at the edge, but your IPs stay yours.

What does BYOIP mean for cloud migration providers?

BYOIP, Bring Your Own IP, means network engineers own IP address space but delegate its announcement to a third-party network.

Magic transit supported services when you bring your own IP

Cloudflare Magic Transit, Cloudflare Spectrum (TCP/UDP proxy) and Cloudflare’s content delivery services can accept BYOIP prefixes.

Hiring cloud IP services for migration and IP addresses continuity

When you do a cloud migration and keep your own addresses, there are no new firewall entries for downstream systems. Your cloud resources are still on the same IP addresses as before. Announcing the addresses on the Cloudflare network does not change your routing policy.

As Prefixx, we setup LOA, RPKI ROA and IRR route objects prior to BYOIP deployment of your own IPs to ensure that the prefix is delivered to the edge of the network fully documented and clean.

Working closely with your account team ensures that all registry documentation aligns with your deployment timeline and technical requirements. Prefixx coordinates registry resources and documentation workflows to streamline the onboarding process and reduce delays.

Why Cloudflare bring your own ips matters for network engineers

Migrating to Cloudflare as a network engineer leads to a recurring problem: You break trust as soon as you change IP addresses.

IP address space and why reputation travels with the prefix

Your IP reputation is tied to the IP address(es) you use, not to the underlying infrastructure. Therefore, if you hire a cloud IP services provider and accept provider-assigned IP addresses (as opposed to bringing your own IP address), you are starting from scratch, i.e. a new unproven IP prefix will be seen by spam filters, security appliances, etc. as well as by your partners in allowlists, etc.

Dependency on cloud providers and internet routing registry

Cloud providers typically assign IP addresses from their own ranges. If you then move to a different cloud provider, those IP addresses will be left behind. You choose the IP address range you want to bring. The cloud provider that you are targeting then announces the range for you. This BYOIP approach ensures that your addressing remains consistent regardless of which provider announces it, preserving continuity across infrastructure changes.

Organizations that own IPs retain the flexibility to switch providers or adopt multi-cloud architectures without renumbering their infrastructure or updating external integrations. The benefits of maintaining your own prefix include simplified disaster recovery planning and the ability to preserve established routing relationships across multiple deployment scenarios.

Why IP reputation causes Cloudflare to block your address

Cloudflare is able to block traffic from IP addresses that are listed in Cloudflare's threat intelligence feeds for things like abuse, bot traffic, and spam. This can be problematic for cloud services that have reused IP addresses from previous customers.

However, when you bring your own IP addresses (or prefixes), you have your own clean history with those IP addresses, rather than being hampered by the history of some previous customer. Organizations that bring their own prefixes avoid inheriting the negative reputation left by previous customers who may have used those addresses for malicious purposes.

NAT pain points BYOIP sidesteps

The problems of asymmetric routing, out-of-sync logs, and session tracking limitations all vanish when you own IPs announced through Cloudflare without Network Address Translation (NAT) in between.

If you need a clean, portable prefix before you migrate to Cloudflare but don't want to use your own IPs, Prefixx can source a vetted block of space from ARIN, RIPE NCC and APNIC, including LOA, RPKI ROA and IRR objects for the block prepared by the Prefixx team.

Once the right block has been sourced and checked to avoid address conflicts, the space can be verified and the account can be onboarded through Cloudflare's verification and onboarding process. The Prefixx team coordinates with registry officials to ensure all documentation and technical resources are properly configured before the block is transferred to your account.

Cloudflare BYOIP use cases: magic transit, spectrum, and CDN services

Cloudflare custom IP announcement allows you to announce your own prefixes on Cloudflare’s network, allowing the world to know about your IP space while you benefit from Cloudflare’s services. Most use cases of BYOIP are driven by three different service contexts: Magic Transit, Spectrum and CDN.

Magic transit and full control DDoS protection

Magic Transit routes all your network traffic through Cloudflare before it reaches your infrastructure. Cloudflare announces your prefixes via BGP, scrubs inbound packets, and tunnels clean traffic back to your edge. Existing firewall entries and ACLs stay intact because the source IPs never change.

Spectrum: proxying tcp/udp under your own ips

Spectrum sits in front of TCP and UDP applications such as gaming servers and VoIP platforms. Within Spectrum, Cloudflare then proxies each connection to the relevant application under your prefix. For example, within Spectrum, a bring your own IPs setup for cloud services means a Spectrum application is typically defined per port or protocol, and then Cloudflare's proxy layer handles the rest of the connection to the application.

Can I create my own or use leased IPs?

IP addresses are assigned by the five Regional Internet Registries and therefore cannot be generated. However, IP address blocks can be purchased on the secondary market and then allocated as if they were your own IP addresses. BYOIP on Cloudflare enables prefix announcements by users, and Prefixx sources vetted IP address space blocks on ARIN, RIPE NCC and APNIC marketplaces.

Prefixx also assists in preparing the LOA, RPKI ROA, and IRR objects needed to bring that space to Cloudflare as part of the migration process. Organizations may acquire leased IPs through the secondary market when they need address space but do not require permanent ownership of the block. When organizations acquire new IPs from the secondary market, they gain portable address space that can be announced through any compatible provider's infrastructure.

CDN services and brand continuity

When you run content delivery network under your own prefixes, end users will resolve to IPs that you as an organization control. Your reputation history will therefore be tied to your block of IP addresses. Also, your web application firewall and caching rules will apply as normal. Network traffic will be served from Cloudflare’s edge but all IP addressing will be done under your own prefixes.

The next section will outline the different prerequisites, including reachable prefixes, that Cloudflare looks for before onboarding can begin.

How Prefixx prepares your IP prefixes for Cloudflare BYOIP

Before Cloudflare IP prefix bring-your-own onboarding can begin, IP prefixes must be Clean, Transfer-Eligible, and Fully-Documented. Prefixx sources the best vetted blocks from the secondary market for onboarding to Cloudflare Bring Your Own IP feature. We run Tixx quality control to validate blocks before creating the LOA, RPKI ROA, and IRR route objects your network architects need for onboarding to Cloudflare. We handle the paperwork layer so you can get on with configuring Cloudflare.

• Tixx QC on every block: ownership verification, blacklist scans, routing hygiene, and RIR standing checked before transfer.
• Full documentation prepared: LOA, RPKI ROA, and IRR route objects ready for your target cloud provider.
• Multi-cloud BYOIP support: we broker own IP addresses onto Cloudflare, AWS, GCP, Azure, and OCI.
• Inter-RIR transfers handled: ARIN, RIPE NCC, APNIC, and LACNIC facilitated end to end.
• Clean IP reputation: 12 DNSBL scans included, so your own IPs arrive with a clean reputation.

If you are evaluating cloud IP hosting or planning a cloud migration, explore our BYOIP service or reach out to our team for a personalized assessment. A well-structured cloud deployment preserves IP continuity while enabling you to leverage advanced edge capabilities without disrupting existing integrations.

Organizations that preserve their existing IP reputation through BYOIP realize operational benefits that extend beyond technical migration, including maintained trust relationships and reduced onboarding friction. Organizations serving customers through established IP addresses can maintain those relationships without requiring partners to update firewall rules or security policies.

Cloudflare own IP addressing allows infrastructure engineers to send their own prefixes through Cloudflare’s network, without giving up their IP reputation, geolocation, and BGP control. Your account team will need a Letter of Authorization, RPKI ROA configuration, and IRR route objects for the prefix to go live.

If your block hasn't been through a pre-transfer quality check, or if your LOA, ROA, IRR objects, or generic routing encapsulation tunnel configs aren't in order, Cloudflare's cloud services onboarding team will send you back to the start. Resolving documentation gaps or registry inconsistencies after submission can be time consuming and may delay your deployment schedule significantly.

Whether you're buying a new block or bringing existing space, the white-glove service covers every routing document before your prefix touches Cloudflare's edge. The service coordinates all necessary resources to ensure your prefix meets technical and administrative requirements before announcement begins.