How to Buy IPv4 Addresses for a VPN Service
VPN operators have some of the most demanding IP reputation requirements in the hosting industry. Exit IPs that appear on any abuse list will be blocked by major content platforms, banking sites, and enterprise firewalls - directly impacting the quality of service you can offer customers. Getting the right block of IPs, in the right region, with a clean history, is critical to VPN operations. This guide covers the full process.
How many IPs does a VPN service typically need (block size guide)
VPN IP requirements depend on your deployment model. There are two common architectures: shared exit IPs (multiple customers share one exit IP via a shared VPN server) and dedicated exit IPs (each customer or session gets a unique exit IP). The second model requires significantly more addresses but produces much better results for customers trying to access geo-restricted or anti-proxy-protected content.
For shared exit architecture, a /24 (256 addresses) per geographic region is a reasonable starting point for a small VPN. With good server management, you can support thousands of simultaneous users across a few hundred active exit IPs.
For dedicated IP architecture, you need roughly one IP per paying customer who subscribes to a dedicated IP option. A VPN with 10,000 dedicated IP customers needs at minimum a /18 (16,384 addresses). Many VPN services offer this as a premium tier.
Beyond exit IPs, account for: server management IPs, load balancer addresses, monitoring infrastructure, and IP rotation reserves. A typical VPN operator maintains a reserve pool for rapid rotation when IPs become blocked.
RIPE vs ARIN vs APNIC - which region to buy from
Geographic diversity is a core product requirement for VPN services. Customers expect to connect through exit nodes in dozens of countries. Your registry choice should follow your server locations.
For European exit nodes, RIPE space is required - European ISPs and content platforms expect RIPE-allocated exit IPs from European locations. ARIN space from a European server location creates routing anomalies that sophisticated detection systems will flag.
For North American exit nodes, ARIN space is appropriate. For Asia-Pacific nodes, use APNIC. Matching registry region to geographic location creates the most natural routing profile and is hardest for geo-detection systems to flag as proxy traffic.
If you are launching a new VPN and building out coverage gradually, start with RIPE space for your European nodes (where privacy demand is typically highest) and expand from there.
How to verify a clean IPv4 block before buying
IP reputation is everything for a VPN operator. A block purchased without thorough verification will result in immediate blocks from Netflix, Disney+, banking services, and enterprise security gateways. Once blocked, getting removed from detection databases is extremely difficult.
Run all candidate IPs through dedicated VPN/proxy detection databases in addition to standard blacklists. Tools like IPQualityScore and Maxmind’s proxy detection database maintain lists of IPs historically associated with VPN services. Blocks previously used by other VPN providers are almost certainly already in these databases and will be ineffective for bypassing geo-restrictions.
Check Spamhaus SBL, XBL, PBL, and the Spamhaus DROP list. Query AbuseIPDB for any recent abuse reports. Use BGPView to check routing history - IPs that have been unused for a long time may have clean abuse records but are still detectable as proxy ranges by machine learning-based detection systems that track announcement patterns.
Ask the seller explicitly whether the block has ever been used for VPN, proxy, or anonymization services. A reputable seller will disclose this. Consider requesting the last 3 years of abuse reports filed against the block.
Broker vs direct transfer - risks and benefits
Direct transfers save the broker fee but require you to perform all due diligence independently. For a VPN operator purchasing a /24 or smaller, the time cost of managing a direct transfer may exceed the broker fee.
For larger purchases, the stakes of acquiring a contaminated block are high enough to justify professional assistance. A broker who specializes in the IP market will have access to block history and can identify ranges previously used for VPN or proxy services that a standard blacklist check would miss.
DCXV is an approved broker with RIPE NCC, APNIC, and ARIN. We advise VPN operators on block selection with attention to proxy detection history, not just standard blacklists. Contact ipv4@dcxv.com for a consultation. https://dcxv.com/ipv4
Current market pricing and timeline (ranges only)
VPN operators often need IPs urgently to expand capacity or replace blocked ranges. Pricing varies by block size, registry region, and how quickly you need the transfer completed. The secondary market for IPv4 is liquid enough that /24 blocks are generally available within a few weeks.
RIPE transfer timelines are typically 2-4 weeks. For VPN operators who need faster turnaround, expedited options may be available depending on seller cooperation and RIR workload.
For current pricing and a timeline estimate, contact ipv4@dcxv.com. https://dcxv.com/ipv4
