Why large IP blocks need approval
IPv4 addresses are a scarce, regulated resource, so anything beyond a few static IPs has to be justified in writing.
Why can you not just ask for more IP addresses?
IPv4 addresses are handed out by regional internet registries, and there are no longer free ones to hand out. IANA exhausted the global pool in 2011, and ARIN, the registry for North America, ran out of its own free pool on September 24, 2015. Since then a provider gets IPv4 from a waiting list or by buying it on the transfer market, and registry policy expects documented need behind an assignment. A provider passing addresses to a customer inherits that obligation, so beyond a handful of static IPs there is paperwork.
How block sizes work
| Notation | Total addresses | Usable | Usually needs justification |
|---|---|---|---|
| /30 | 4 | 1 | No |
| /29 | 8 | 5 | Rarely |
| /28 | 16 | 13 | Sometimes |
| /27 | 32 | 29 | Yes |
| /24 | 256 | 253 | Yes, in detail |
What a justification asks for
- A count of the devices or services that each need a public address
- What each address is for: a mail server, a VPN endpoint, a firewall, a hosted application
- Why network address translation will not work for those services
- Your current utilization, if you already hold a block
- A growth estimate, with a timeframe rather than an open-ended number
How to make the request go smoothly
Inventory what genuinely needs a public address
Most internal devices do not. Count the services reachable from outside your network.
Write one line per address
A table of address, service, and reason is what gets approved. A total with no detail is what gets questioned.
Ask early
Justification review adds time to an order. Raising it at installation is how a cutover date slips.
Ask about IPv6 at the same time
Many providers issue IPv6 blocks with far less friction, because the scarcity that drives IPv4 policy does not apply.
Expect the assignment to be public
ARIN policy generally requires a provider to register reassignments of a /29 or larger in public directory records, so your organization name and the block are visible in Whois.
You own the use, not the addresses
Addresses assigned by a provider stay with that provider. They are not portable: switching providers means renumbering whatever was using them. Plan for that before you hard-code public addresses into firewall rules, DNS records, or third-party allow lists.
Ways to need fewer addresses
| Instead of | Consider |
|---|---|
| One public address per server | A single address with port forwarding at the firewall |
| A public address per site | A site-to-site tunnel between offices |
| Static addresses for outbound traffic only | Network address translation, since outbound traffic rarely needs its own address |
| A large IPv4 block | An IPv6 allocation alongside a small IPv4 block |
Registry policy and provider practice both change over time, the block sizes and thresholds given are typical rather than fixed, and each provider applies the rules slightly differently. Treat what your provider tells you about your own order as authoritative. For the single-address case, see static IP addresses.
Last reviewed September 13, 2026
