====== Proxy an IP address from one VPS to another ======

**Unofficial, customer-managed guide:** BinaryLane does not currently support moving a public IPv4 address directly from one server to another. This guide describes one workaround: retain the existing server as a small proxy and forward traffic to its replacement. It is not an IP migration, and you are responsible for reviewing, operating, and securing the configuration.

Use this only where an existing public IPv4 address cannot yet be changed because it is referenced by DNS records, allowlists, customers, or other remote systems. Where possible, update those references to use the new server directly instead.

===== Before you begin =====

You need:

  * root or sudo access to the current server that holds the IP address;
  * root or sudo access to the destination server;
  * the public IPv4 address on the current/proxy server and the destination server; and
  * a plan for management access to the proxy after forwarding is enabled.

This example is for Ubuntu and IPv4. It assumes SSH runs on TCP port 22 and therefore keeps that port on the proxy. Change the rule before applying it if you use another SSH port.

===== When this makes sense =====

If the old server has only this purpose after the move, consider resizing it to a small plan and retaining it as a thin proxy. The proxy needs little CPU or memory, but it must remain online and have enough transfer allowance for all forwarded traffic.

If the old server has multiple IP addresses and still hosts other services, target only the additional IP address that needs to remain reachable.

===== How the proxy works =====

The proxy receives traffic at the existing public IP address, rewrites its destination to the new server, and rewrites replies so they return through the proxy.

<code>
Client -> existing/proxy IP -> destination server
Client <- existing/proxy IP <- destination server
</code>

The rules below use nftables destination NAT (DNAT) and source NAT (masquerade).

===== Configure the proxy =====

Run these commands on the server that currently has the IP address you want to retain.

Set the existing/proxy and destination addresses:

<code bash>
PROXY_IP="203.0.113.10"
DESTINATION_IP="198.51.100.20"
</code>

Replace the example addresses with your own values.

Install nftables, enable IPv4 forwarding, and start the nftables service:

<code bash>
sudo apt update
sudo apt install -y nftables

echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-ip-proxy.conf
sudo sysctl --system
sudo systemctl enable --now nftables
</code>

Create rules that forward TCP traffic other than SSH, plus UDP traffic, to the destination server:

<code bash>
sudo tee /etc/nftables.conf >/dev/null <<EOF
#!/usr/sbin/nft -f

flush ruleset

table ip proxy {
  chain prerouting {
    type nat hook prerouting priority dstnat; policy accept;

    ip daddr $PROXY_IP tcp dport != 22 dnat to $DESTINATION_IP
    ip daddr $PROXY_IP udp dnat to $DESTINATION_IP
  }

  chain postrouting {
    type nat hook postrouting priority srcnat; policy accept;

    ip daddr $DESTINATION_IP masquerade
  }
}
EOF

sudo nft -f /etc/nftables.conf
sudo nft list ruleset
</code>

If you do not use SSH on TCP port 22, change the exclusion before applying the rules. Otherwise, you may forward your management access to the destination server.

===== Forward only selected ports =====

Forwarding only the services you need is usually easier to review and maintain. For example, to forward HTTP and HTTPS only:

<code bash>
sudo tee /etc/nftables.conf >/dev/null <<EOF
#!/usr/sbin/nft -f

flush ruleset

table ip proxy {
  chain prerouting {
    type nat hook prerouting priority dstnat; policy accept;

    ip daddr $PROXY_IP tcp dport { 80, 443 } dnat to $DESTINATION_IP
  }

  chain postrouting {
    type nat hook postrouting priority srcnat; policy accept;

    ip daddr $DESTINATION_IP tcp dport { 80, 443 } masquerade
  }
}
EOF

sudo nft -f /etc/nftables.conf
sudo nft list ruleset
</code>

===== Test the forwarding =====

First verify that a service responds directly on the destination server:

<code bash>
curl -I http://DESTINATION_IP/
</code>

Then test through the retained IP:

<code bash>
curl -I http://PROXY_IP/
</code>

If the proxy is working, the request to the proxy IP should return a response from the service on the destination server. You can also inspect established TCP connections on the destination server:

<code bash>
sudo ss -tn state established
</code>

===== Limitations and security =====

  * The destination normally sees the proxy's IP address, not the original client address. If the application needs the client IP, use an application-level proxy such as Nginx or HAProxy, or PROXY protocol where the destination supports it.
  * The proxy must stay online. Cancelling, powering off, or misconfiguring it stops traffic to the retained IP from reaching the destination.
  * Traffic traverses both servers, which can add latency and consumes transfer on the proxy.
  * Firewalls on both servers must allow the intended traffic. If you use the BinaryLane External Firewall, ensure its rules match this traffic path.
  * IPv6 needs separate planning and IPv6-specific rules; this guide does not configure it.

===== Remove the proxy later =====

When you no longer need the retained IP, remove the forwarding rules and disable IPv4 forwarding:

<code bash>
sudo nft flush ruleset
sudo tee /etc/nftables.conf >/dev/null <<EOF
#!/usr/sbin/nft -f

flush ruleset
EOF

sudo rm -f /etc/sysctl.d/99-ip-proxy.conf
sudo sysctl -w net.ipv4.ip_forward=0
</code>

You can then cancel, resize, or repurpose the proxy server.

===== Support boundary =====

BinaryLane Support may assist with general platform and public API questions. Proxy setup, firewall and NAT policy design, operating-system maintenance, and troubleshooting within this configuration are customer-managed work.