Skip to content

How many IPs does an Egress Server use?

One Egress Server consumes a small, fixed set of IP addresses: two public IPv4s (one for the Egress Server, one for its UDP ingress proxy), private IPv4s in its VPC's public subnet, and a pool of WireGuard peer addresses inside the wg0 tunnel network. The peer pool is what's visible to end-users in the Console.

IP allocation per Egress Server

What each IP is for

  • Egress public IPv4 — the address every destination sees. Unique to this Egress Server; never shared with another deployment. It's an auto-assigned public IP, not an Elastic IP, so a rebuilt Egress Server gets a new one.
  • Ingress public IPv4 (UDP proxy) — the WireGuard endpoint in every peer config, and the only address the local ISP sees. The proxy forwards UDP/51820 to the Egress Server's private IP.
  • Private IPv4s in the VPC — used by AWS internal routing and by VPC peering to the home region.
  • wg0 server address (10.0.0.1) — the inside-tunnel identity of the Egress Server itself.
  • wg0 peer addresses (10.0.0.2 upwards) — one per peer, assigned in order: user peers (1–20, chosen at provisioning), then Kasm peers (up to 10) if Kasm is enabled, then one Node peer if Node integration is enabled.

A typical Egress Server therefore shows destinations one public IP and hosts as many WireGuard peers as were requested when it was provisioned. Multiple Egress Servers are independent — each has its own tunnel network (they reuse the same 10.0.0.0/24 range), and they don't see each other's traffic.

See also