Configure a secondary IP on a Linux VPS

Adding a secondary IP on a Linux VPS lets you separate uses, expose a service on a dedicated address or prepare a migration. The method depends on the provider, the network system in use and the routing announced with the address. This guide offers a cautious, reversible and verifiable approach for a virtualised VPS server.

Before you start

A secondary IP address is not an address picked at random. Request it from your hosting provider and check its netmask, gateway, IP family, bandwidth and routing mode. Also note the name of the active interface:

ip -br address
ip route
ip -6 route

Keep an SSH session already open during the tests. Do not apply a remote network change without a rescue access path or a console offered by your provider. The values below are examples: replace ens3, 203.0.113.25 and the prefix with the information you were actually given. A connection with a root or sudo account is required.

Add the address temporarily to test it

With the ip command, the addition is immediate but is not kept after a reboot. This step validates the address before editing the persistent configuration:

sudo ip address add 203.0.113.25/32 dev ens3
ip address show dev ens3
ip route get 1.1.1.1

The /32 prefix is only a common example for an individually routed IP. If your hosting provider gave you another prefix, use exactly that one. To remove the test:

sudo ip address delete 203.0.113.25/32 dev ens3

Make the configuration persistent

On recent Ubuntu, the configuration is often managed by Netplan. First identify the file present in /etc/netplan, then back it up before any change. In a Netplan configuration using an address list, the addition looks like this:

network:
  version: 2
  ethernets:
    ens3:
      addresses:
        - 192.0.2.10/24
        - 203.0.113.25/32

Do not copy this example without checking the gateway, the DNS and the renderer already used by your machine. Apply with care:

sudo netplan try
sudo netplan apply

netplan try is preferable during a remote intervention because it lets you confirm the configuration before it is kept. If your distribution uses NetworkManager, systemd-networkd or ifupdown, edit the layer that actually manages the interface, not an unused file. The procedure differs between Ubuntu and Debian: always check which network manager is actually active.

Check routing and services

An address visible with ip address does not guarantee that a service uses it. Check the outgoing path and the listening sockets:

ip route
ip route get 1.1.1.1
ss -lntup

For a service that must listen on this address, explicitly configure its listen address when the software allows it. This applies for example to an Apache or Nginx web server, FTP access, a MySQL database, a reverse proxy or an administration panel. A domain name and its DNS records must then point to the correct IP. Check from another network with a suitable tool, without assuming a port is reachable just because the IP responds.

Firewall and diagnosis

A UFW rule can target a local address, a port and a protocol. List the state before adding a rule:

sudo ufw status numbered
sudo nft list ruleset

A firewall can allow SSH on the old address while blocking the service on the new one. Also check the provider's rules, IPv4 or IPv6 routing and the network manager logs. If the address is present but does not respond, examine in order the interface, the prefix, the route, the local firewall, the DNS and the routing on the hosting provider side. Avoid disabling protection permanently to get around a diagnosis.

Use cases on a VPS server

A secondary IP can isolate a web server, an API, a mail server or an administration interface. It can also simplify a domain name migration, provided you lower the DNS TTL beforehand and keep verifiable backups. It replaces neither a backup, nor a security rule, nor sufficient CPU, RAM and SSD disk capacity. Before adding several services, monitor resources and bandwidth consumption.

On a virtual machine from a virtualisation infrastructure, the IP is generally declared by the hosting provider. A VPS plan can host several websites, a CMS, an API, databases or email. The SSL certificate, the SMTP server and the control panel must each be associated with the correct domain name and the correct address. This organisation differs from shared hosting, a physical private server or a dedicated server: document the limits of your environment.

For hosting with Plesk or another interface, the address must be declared in the panel if it manages the sites and certificates. For a Docker deployment, check the port binding and the container network. In all cases, document the association between IP, domain name, service and firewall rule so you can return to the previous configuration.

Remove the IP without causing an outage

Before deleting the address, move the services that use it and check the DNS records concerned. For a temporarily added address, use:

sudo ip address delete 203.0.113.25/32 dev ens3

For a persistent configuration, remove only the corresponding line in the file managed by your network system, then apply the change from a rescue console if you have the slightest doubt. Keep a copy of the previous configuration until it is fully validated.

Final checklist

• The IP, its family and its prefix come from the hosting provider.
• The interface and the route have been checked with ip.
• The temporary test was done before persistence.
• The configuration and the backup were saved before any change.
• The firewall rules, DNS and the services' listen address are consistent.
• A console or rescue session remains available.

To go further with administration, also see the first security settings for a dedicated server, the Docker on VPS guide, diagnosing an unreachable VPS, the network Looking Glass and Ubuntu VPS plans.