Public IPs
A public IP is a public IPv4 address you allocate to your tenant and associate with an instance or load balancer to make it reachable from the internet — and move between resources as needed.
Allocate, associate, release
fm network public-ip allocate # reserve an address
fm network public-ip associate <public-ip-id> <instance-id>
fm network public-ip disassociate <public-ip-id> # frees it, keeps it allocated
fm network public-ip release <public-ip-id> # gives the address back — permanentresource "frostmoln_public_ip" "web" {}A public IP is available when reserved and in_use once associated. To use one with a load balancer, allocate it first and pass it when you create a public-scheme load balancer.
After associating, allow the relevant inbound ports in the resource's security group. It can take a moment for a newly attached IP to appear on an instance — reload the detail page if needed.
Move and release
Disassociating frees the address from the resource while keeping it reserved for your tenant, so you can re-attach it elsewhere. It is free and reversible.
An address that holds nothing can be released — but releasing is permanent: the address goes back to the platform, is handed out again to whoever asks next, and you cannot get it back. Check what is holding an address before you release it, rather than inferring it from a status:
fm network public-ip get <public-ip-id>A reserved public IP may be billed while held.
A public IP attached to a VPC's Gateway is in use, so it can neither be associated with an instance nor released — see Use a public IP as a VPC outbound address.
Public IPs and outbound traffic
A public IP is about inbound reach. Outbound is a separate resource: the VPC's Gateway. A VPC without one has no way out to the internet — and no DNS resolution or managed-service connectivity either.
The two travel the same path, so associating a public IP in a VPC that has no Gateway gives that VPC one. It then shows up alongside the VPC with the origin implicit_public_ip. For the same reason, removing a Gateway is refused while public IPs in the VPC still depend on it — disassociate them first, which is free, reversible and enough to clear the check. Releasing them also clears it, but releasing is permanent and gives the addresses up for good.
An instance that has its own public IP goes out through that address. The Gateway's address is the source only for traffic from instances that have none.
Use a public IP as a VPC outbound address
A Gateway goes out through an address the platform picks — unless you name a public IP of your own, which is what makes the VPC's source address stable and safe to publish.
# Reserve the address, then send a VPC's outbound traffic through it
fm network public-ip allocate
fm network gateway create --vpc-id vpc-abc123 --mode public-ip --public-ip-id pip-xyz789
# Or point an existing gateway at it — --yes confirms the interruption
fm network gateway set-mode --vpc-id vpc-abc123 \
--mode public-ip --public-ip-id pip-xyz789 --yesresource "frostmoln_public_ip" "gateway" {}
resource "frostmoln_gateway" "main" {
vpc_id = frostmoln_vpc.main.id
mode = "public_ip"
public_ip_id = frostmoln_public_ip.gateway.id
}In the portal, the choice is a picker in the VPC's Gateway panel under Network → VPCs.
Naming one is optional — but leaving it out does not allocate one for you. A gateway created without a named address uses the platform's address: it is in no list of yours, has no id, draws no quota and never reaches an invoice. It is also redrawn if the gateway or the VPC is rebuilt, so nothing outside the VPC should ever be told what it is.
Why name your own
Because the address is a resource of yours, it outlives the gateway. Remove the Gateway, or delete the VPC and rebuild it: the public IP stays allocated to your tenant, keeps its id and keeps its address. Point the new gateway at it and the VPC goes out through the same address as before.
That is what makes it safe to hand the address to a partner for their allow-list, to a customer's firewall, or to publish in DNS. The platform's default address makes no such promise, and neither did the withdrawn shared-address (nat) mode.
A named address is billed as a public IP and counts against your tenant's public IP quota — that is what you are paying for: an address that stays put.
If a gateway is already on the platform's address and that address has already been published, you can keep it: adopting turns that exact address into a public IP of yours without changing it. See Make the gateway's address your own.
While it is attached
- It cannot be associated with an instance — use a different address there.
- It cannot be released — releasing gives the address up for good, the one thing the gateway is there to prevent.
To find which VPC is holding it, ask the address itself:
fm network public-ip get <public-ip-id>Attached says what has it, and for an egress-bound address an Egress VPC line names the VPC whose Gateway to go and change.
Detach it first: point the gateway at a different public IP, or remove the gateway. The address then goes back to being an ordinary available public IP of yours — still allocated, still counting against your quota, until you release it.
Pointing the gateway back at the platform's address is done by removing the gateway and creating it again without naming an address — omitting the address on a change means "keep the one you have", never "give it back". See Give a chosen address back.