To buy global IPv4, you acquire the registration rights to an address block through a transfer recorded by a Regional Internet Registry (RIR), such as ARIN, RIPE NCC or APNIC.
The purchase agreement sets the terms, but the block only becomes yours once the registry records the transfer under its own policies.
For industrial sites, that public block usually sits at the edge of the plant, not inside it. This guide covers where public IPv4 fits in an industrial network, the buying process and how the transfer and route origin steps differ across ARIN, RIPE NCC and APNIC.
Key Takeaways
- Plant networks run on private RFC 1918 addresses; public IPv4 belongs at the boundary, in the industrial DMZ.
- Buying a block means acquiring registration rights, and the RIR must record the transfer.
- Each RIR has its own transfer rules, such as APNIC’s five-year restriction on space delegated from 103/8.
- Route Origin Authorizations (ROAs) are created in each RIR’s portal, with different menus and steps.
- Vet the block’s registration, routing history and reputation before closing.
Where Public IPv4 Fits in a Plant Network
Inside the plant, controllers, drives and HMIs run on private addresses from the three RFC 1918 ranges: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Outbound connections to cloud services can usually reach the internet through NAT, without a dedicated public block.
Public IPv4 earns its place at the boundary, for services such as VPN gateways, supplier remote-access endpoints and tightly controlled partner connections.
NIST SP 800-82 Rev. 3 describes an industrial DMZ between enterprise and plant systems, and that DMZ is where these public-facing services belong. Controllers should never be exposed to the internet directly.
Before buying, map which services actually need inbound reachability and how much space they require. Mapping traffic before devices is the same approach that guides plant network sizing as automation grows, and it keeps the request to the smallest block you can justify.
The Buying Process, Step by Step
The steps are broadly the same in every region, even though the policies behind them differ.
- Size the request. Match the block to the boundary services you mapped. In the ARIN region, pre-approval confirms the size you can justify before you negotiate.
- Confirm the region and transfer path. Identify which RIR holds the block and which policy applies. A transfer between regions has to meet both registries’ rules.
- Verify the registration. Query the exact prefix through RDAP and check that the registered organization matches the seller on the sale documents.
- Review routing history and reputation. Use tools such as RIPEstat to check past BGP announcements, and check Spamhaus listings such as SBL, XBL and DROP. A prefix-level DROP match should pause the deal until it is resolved.
- Agree the contract and escrow. Name the exact prefix and each party’s cleanup duties, and tie escrow release to the recorded transfer rather than a letter of authorization.
- Complete the registry transfer. Both parties supply the documents the RIR requests. The block is yours once the registry records the change.
Record the block in your address inventory as pending until the transfer completes, and keep it out of service until routing authorization is in place.
How the Process Differs Across Each RIR
If your sites span several regions, the transfer and route origin steps use different rules and terms at each registry. The ROA details below come from the Number Resource Organization’s comparison of RIR portals.
RIPE NCC’s dashboard also lists your BGP announcements with their validity status, which helps when you replace a seller’s ROAs. APNIC warns you when a ROA is created without a max length.
Using a Marketplace or Broker
Teams without registry experience often buy through a marketplace or broker rather than negotiating directly with a holder. A marketplace such as IPv4 Connect lists blocks from /24 up to /12 at fixed prices, paid by secure wire or escrow. Each listed subnet comes with a free blacklist report covering more than 100 global blacklists.
The company also removes old BGP announcements, route records and DNS entries before a block transfers, and it offers geolocation support. Transfers are fully managed, with pre-approval assistance in the ARIN, RIPE and APNIC regions, which covers several of the steps above.
Whichever provider you use, keep the deal file in your own hands. Repeat the important registration and reputation checks independently, and confirm who prepares the recipient documents and handles any problems after closing.
After the Transfer: ROAs and Record Cleanup
Once the registry records the transfer, bring the routing records in line before the block carries plant traffic:
- Re-query RDAP and confirm the registration shows your organization.
- Create ROAs in your RIR’s portal for your origin ASN, with a max length no wider than the prefixes you plan to announce.
- Create matching Internet Routing Registry route objects and confirm the seller’s old objects are removed.
- Set up reverse DNS delegation for the boundary hosts that need it.
- Repeat the reputation checks and compare them with your pre-closing results.
Then bring the boundary services online in stages, starting with one /24 where your allocation allows it. Keep the previous addressing available until VPN gateways and supplier access pass reachability tests.
Keep the Public Block at the Edge
For most plants, public IPv4 is a small, deliberate addition at the boundary, not a change to how the plant itself is addressed. Size the block to the services that need it, follow the transfer rules of the registry that holds it and set up ROAs in that registry’s portal before announcing it.
Record every step in your address inventory, from the pending transfer through to the final route objects. That record makes the next audit, expansion or vendor handover much easier.
FAQ
What does it mean to buy global IPv4?
You acquire the registration rights to a public IPv4 block through a transfer recorded by the responsible RIR, such as ARIN, RIPE NCC or APNIC.
Does an industrial plant need its own public IPv4 block?
Often not. Plant devices run on private addresses, and outbound cloud traffic usually works through NAT. A dedicated block is mainly needed for boundary services such as VPN gateways or supplier access.
Can I transfer APNIC space from 103/8?
Only after five years have passed since the space was delegated, so check the delegation date first.
Where do I create ROAs after the transfer?
In your RIR’s portal: Routing Security at ARIN, the RPKI Dashboard at RIPE NCC and RPKI under Route Management at APNIC.
Should controllers ever use public addresses?
No. Keep controllers on private addresses inside the plant and place public-facing services in the industrial DMZ.
