---
title: "Public IPv4"
description: "How public IPv4 works on Metalhost: opt-in at create time, default-deny posture, $2/mo per address. Plus always-on public IPv6."
url: "https://metalhost.net/docs/dashboard/guides/public-ipv4"
---

# Public IPv4

A public IPv4 attaches a routable internet address to a VM. By default it's locked down except for SSH — open more ports via [firewall rules](https://metalhost.net/docs/dashboard/guides/firewall.md). Note that every VM already gets a free [public IPv6](https://metalhost.net/docs/dashboard/guides/public-ipv6.md); IPv4 is the billed opt-in for v4 reachability.

## How it works

Every datacenter has a pool of public IPv4 addresses. When you create a VM with **Assign public IPv4** toggled on, one address is reserved from that pool and attached. The address persists across stop/start, restart, and resize — only deleting the VM returns it to the pool.

Without a public IPv4, the VM still has a tenant-private address reachable from other VMs in the same project. Outbound to the internet (apt update, package fetches, outbound API calls) works either way.

> **opt-in at create time only**
>
> Public IPv4 is attached during VM provisioning — there is no post-create attach. If you forgot the toggle, recreate the VM from a backup to keep your data, or clone the VM and tick the toggle on the clone.

## Pricing

Public IPv4 is billed per second the address is held, at a monthly anchor of **$2.00/mo**. The address is billed even when the VM is stopped (the IP is still reserved). Deleting the VM releases the address and stops the charge.

## Default inbound rule

The public NIC is default-deny. One rule is seeded at create so the VM is immediately reachable:

| Port | Protocol | Source | Why |
| --- | --- | --- | --- |
| 22 | TCP | anywhere (v4 + v6) | SSH — so you can log in immediately. |

Everything else inbound is dropped by default — add HTTP/HTTPS or any other port explicitly via [firewall rules](https://metalhost.net/docs/dashboard/guides/firewall.md). Outbound is unrestricted. The same firewall guards both this IPv4 and the VM's public IPv6.

> **lock SSH down to your own IP**
>
> The default `0.0.0.0/0` on port 22 makes the VM usable out of the box but exposes sshd to the world. If you don't need that, delete the default rule and add a narrower one — see [firewall rules](https://metalhost.net/docs/dashboard/guides/firewall.md).

## Attach at create time

On the VM create page, flip the **Public IPv4** toggle on. The right-rail quote updates to include the $2/mo address fee. After provisioning, the VM detail page shows the assigned address under *Networking*.

## Find the address again later

Every VM with a public IPv4 shows it on the VM detail page under *Networking*. The VM list in *Compute* shows it as a column too — useful for grabbing several at once.

## Release the address

There is no standalone "release IP" action. The address is released when the VM is deleted. To keep the data but stop paying for the address: take a backup, delete the VM, create a new one from the backup without the public IPv4 toggle.

## You may not need IPv4

Every VM already gets a free, routable [public IPv6](https://metalhost.net/docs/dashboard/guides/public-ipv6.md) address — no opt-in, no fee. If your clients can reach IPv6, you can skip the $2/mo IPv4 entirely. Add a public IPv4 when you need to be reachable from IPv4-only networks (still the common case for arbitrary internet clients).

## What's next

- [Public IPv6](https://metalhost.net/docs/dashboard/guides/public-ipv6.md) — the free, always-on address every VM gets.
- [Firewall rules](https://metalhost.net/docs/dashboard/guides/firewall.md) — open additional ports, restrict SSH to your IP.
- [Create a VM](https://metalhost.net/docs/dashboard/guides/vms-create.md) — full create flow.