With ARIN, RIPE, and APNIC exhausted or near-exhausted, acquiring new IPv4 addresses through direct allocation is no longer realistic for most organizations. Leasing has emerged as a cost-effective path to get routable address space without the capital outlay of buying a block outright.

This article covers how IPv4 leasing works end-to-end, what due diligence looks like from a routing perspective, and the operational steps required to bring leased space online.

How IPv4 Leasing Works

In an IPv4 lease arrangement, an organization that holds ARIN- or RIR-registered address space (the lessor) grants another organization (the lessee) the right to use some or all of that space for a defined period, usually one to three years with renewal options.

Ownership of the block stays with the lessor. The lessee receives:

  • The right to announce the prefix via BGP
  • An LOA (Letter of Authorization) they can present to upstream transit providers
  • Optionally, SWIP or RIPE database reassignment records for abuse and WHOIS accuracy

Leasing does not transfer registration. If you need a permanent asset on your balance sheet, you want to buy, not lease.

Choosing the Right Block Size

Most leasing brokers and direct holders offer space in standard CIDR increments. Practical minimums for global routability are:

  • /24 (256 addresses) — the smallest prefix accepted by the majority of transit providers and the global BGP table
  • /23 or larger — required by some carriers and IX route servers that filter more aggressively

If your use case is outbound NAT for a small data center workload, a /24 is usually sufficient. For large-scale sending infrastructure, CDN POPs, or anycast deployments, consider leasing a /22 or /21 to give yourself room to segment and rotate prefixes without renegotiating the contract.

Verifying the Block Before You Sign

This is the step most engineers skip, and it is the most important one. A leased block with a dirty reputation or routing history can take months to remediate.

Check RIR Registration

Look up the prefix in the relevant RIR database:

  • ARIN: whois.arin.net
  • RIPE NCC: apps.db.ripe.net
  • APNIC: wq.apnic.net

Confirm the lessor is listed as the legitimate registrant. Mismatches between who is leasing you the space and who WHOIS shows as the org are a red flag.

Check Routability and BGP History

Use a looking glass or BGP route-intelligence tool to check whether the prefix is currently announced, and by whom. You want to see:

  • The prefix visible in the global table (or cleanly withdrawn if not in use)
  • The origin ASN matching what the lessor told you
  • No conflicting more-specific announcements from other ASNs

A BGP looking glass query across multiple vantage points will tell you immediately if the block has a hijack history or is being announced by someone other than the registered holder.

Check Reputation Databases

Run the block through:

  • Spamhaus DROP and SBL
  • Abusix Mail Intelligence
  • Cisco Talos IP Reputation
  • AbuseIPDB

A single listing is not necessarily disqualifying if the lessor can show the issue is resolved, but a block that appears in multiple blocklists will cause deliverability and connectivity problems from day one.

Announcing Leased Space via BGP

Once you have signed the contract and received your LOA, here is the typical bring-up sequence:

1. Register an ASN if You Don't Have One

To originate a prefix yourself, you need an Autonomous System Number. If you are multihomed or plan to be, get your own ASN from your RIR. If you have only one upstream, your ISP may originate the prefix on your behalf under their ASN.

2. Create or Update Route Objects

For RIPE-registered space, create a route: object in the RIPE database pointing your ASN as the origin. For ARIN space, ensure an ROA (Route Origin Authorization) is created in RPKI.

route: 192.0.2.0/24
origin: AS64496
descr: Leased block - Example Corp
mnt-by: MAINT-EXAMPLE

3. Create an RPKI ROA

If the lessor controls the resource certificates (which they should), ask them to create an ROA authorizing your ASN to originate the prefix. Without a valid ROA, your prefix may be marked RPKI Invalid and dropped by transit providers and peers that enforce ROV (Route Origin Validation).

4. Configure BGP and Present the LOA to Your Transit Provider

Add the prefix to your BGP configuration and submit the LOA to each upstream that requires one. Most transit providers will want to see the LOA before they accept the announcement.

! Example IOS-XR snippet
router bgp 64496
 address-family ipv4 unicast
  network 192.0.2.0/24

5. Verify Propagation

After announcing, use a looking glass with multiple global vantage points to confirm the prefix is visible from different regions. Check that the origin ASN is correct and that no RPKI invalids are showing.

Operational Considerations

  • Contract terms: Ensure the lease explicitly allows BGP announcement and SWIP/reassignment if you need it.
  • Renewal risk: Build renewal lead time into your operations. Losing a /24 mid-deployment is painful.
  • Monitoring: Set up BGP monitoring alerts for unexpected withdrawals or origin changes on your leased prefixes. A good route-intelligence platform will notify you if the prefix disappears or gets hijacked.
  • SWIP/RIPE reassignment: If you are hosting customers on the space, proper reassignment records keep abuse complaints routed to you rather than the lessor.

IPv4 leasing is a legitimate and widely used mechanism. Getting the routing hygiene right from the start saves significant remediation time down the road.