Do sites share one address, and why does new outbound traffic still leave from the first?

Separate inbound from outbound

Putting several sites on one machine is a separate question from how addresses are assigned. This note covers two things: which list line a request arrives on, and which line the machine uses when it opens a connection of its own.

The console splits addresses into lines. The first line is for SSH or RDP. Every other line is an IPv4 bought on its own, not an empty slot inside a subnet. Add each line to the NIC and keep it across reboot by following adding each extra IPv4 on the NIC, then assign the lines to sites.

Inbound follows DNS and the listen address. The client connects to whichever line the A record names. A program that listens only on the first line does not answer the same port on any other line.

Outbound depends on who opened the connection. After someone connects to a given line, replies on that session leave from that line. A connection the machine opens itself — an update, an API call, outbound mail — uses the first line, the one that holds the default route, when the program does not choose a local address.

Several sites share the first line

When every site is a website on ports 80 and 443, and the hostname is enough to tell them apart, point all of them at the first line. A new domain does not require another address.

Each name gets one A record, and every value is the first line. The web service listens on 0.0.0.0 port 443, or on port 443 of the first line only. The hostname selects the site directory and the certificate. Certificates follow the name, not the number of address lines. On a shared line, SNI separates certificates on the same port.

server {
    listen 443 ssl;
    server_name a.example;
}
server {
    listen 443 ssl;
    server_name b.example;
}

Neither block pins an address, so both listen on every address of this NIC and then split on server_name. Changing them to listen 203.0.113.10:443 ssl admits only port 443 on the first line. Port 443 on an extra address does not enter these blocks.

IIS makes the same split with a host header. Bind the IP to the first line, or to All Unassigned, put each domain in the host name, and keep port 443. A new site is a new binding and a new A record, not a new address line.

Two programs still cannot both own the same port on the same line. The second bind fails. When a workload must own that port, move one of them to another line, as in the next section.

One site takes one line

Split by line in the cases below. The test is the port and the source address, not the number of sites by itself.

Two processes both need the same port and cannot be separated by hostname. Two listeners that each require port 25, or each require the same custom port, are the usual case. One line can have only one listener on that port. The second process goes on the next line.

A service whose A record must be its own address, different from the other sites, points that name at another line on the list. The process listens on that line, or on 0.0.0.0 so the line is included.

Outbound mail, a callback, or an API call should appear as a chosen line rather than the first. That line must already be on the NIC, and the program must bind its local address to it. Changing only the A record does not change the source of a connection the program opens.

server {
    listen 203.0.113.10:443 ssl;
    server_name a.example;
}
server {
    listen 203.0.113.21:443 ssl;
    server_name b.example;
}

203.0.113.10 and 203.0.113.21 are documentation addresses. Replace them with two lines from the list. The first block accepts only the first line. The second accepts only the extra line. Both lines must already be on the NIC as /32. The A record for b.example is 203.0.113.21, not the first line.

A program listening on 0.0.0.0 also answers lines added later. When a site must appear on one line only, write that line in listen and do not leave 0.0.0.0. The reverse is also true: a program bound only to the first line does not answer a line added afterwards.

When the address is handed to a virtual machine, that line exists only on the guest NIC. Do not also configure it on the host bridge or physical port. When the site runs on the host, leave the line on the interface that already holds the first address.

Use this table to decide how many to buy

The included first line counts as one address that can be assigned. Each further address that must be occupied on its own is one extra IPv4. Names that share the first line do not increase the count.

Four websites that can share an address need zero extras. Four websites that must each have a line need three extras. Together with the included address, the list has four lines. Do not buy “about a /29” because there are four sites. A /29 is the notation for an eight-address block. Addresses here are not sold as a block, and there is no network address or broadcast address to configure.

Each extra address is $1.6 a month, up to 255 more, and the included address plus the extras stay within 256. Five extras are $8.0 a month. Add that into the monthly rent, then multiply by the number of months in the term. Monthly multiplies by 1, quarterly by 3, semiannual by 6, and annual by 12. None of the terms is discounted.

The 128GB tier is $454.8 a month and the 256GB tier is $612.7. Memory is DDR4-3200 ECC RDIMM and cannot be added later. The processor is an AMD EPYC 7543P, 32 cores and 64 threads, 2.8 to 3.7 GHz. The default pair is two 1TB NVMe drives, each attached directly, with no hardware RAID, and usable capacity is the sum, about 2TB. Bandwidth starts at 250 Mbps and is unmetered. 1 Gbps adds $245.0 a month and 2 Gbps adds $742.7. There is no setup fee. The machine is deployed in Tokyo, Japan. Linux uses SSH. Windows uses RDP. Both commands use only the first line.

Enter the count from this table on the configure page. Zero means every shared site uses the included line. Adding a site directory, while the port and the source address stay as they are, does not increase the extra count.

New connections still leave from the first line

The default route is written at install time together with the first line. Addresses added later as /32 are secondary addresses on the same interface. When a program creates a socket and does not choose a local address, the kernel selects the source along the default route. That source is the primary address, the first line.

Ask the route table on the machine. There is no need to contact the target. 192.0.2.1 only makes the system show which default route it would use toward the public Internet, and which source line it would pick.

ip route get 192.0.2.1

The src in the output should be the first line on the list. via is the original gateway. If src has become a line added later, the default route was changed, or the first line is no longer the primary address on this interface. Restore the default route from the install, and leave the extra addresses on the interface as /32.

An inbound session that is already open is unaffected. A client that connected to 203.0.113.21 has a socket whose local address is 203.0.113.21, and the replies use that source. A browser opening a site on the extra address therefore sees that line. At the same time, apt, a scheduled job, and an HTTP client that does not bind an address still show the first line as src.

To send a particular program’s new connections out from an extra line, bind the local address inside that program. Mail, a reverse proxy, and API clients usually have a bind or interface setting. Put the chosen line there. The next command only checks the path. It assumes the source is already the extra line and asks whether the default gateway is still reachable. It does not change the system default, and it does not replace a bind in the program.

ip route get 192.0.2.1 from 203.0.113.21

Replace the address after from with the line under test. src is then that line. Without from, src should still be the first line.

Policy routing handles packets whose source is already the extra line. If the program never binds that line, the rule does not match, and new connections keep leaving from the first line. After a bind, if the egress gateway is wrong, send that source into its own table. Copy the gateway and device from ip route show default. Leave the default route in the main table alone.

ip rule add from 203.0.113.21 table 121
ip route add default via 203.0.113.1 dev eno1 src 203.0.113.21 table 121

Table 121 matches only packets that already use 203.0.113.21 as the source. Other programs stay on the main table and leave from the first line. Write both lines into the boot configuration. Otherwise the rules disappear on reboot and a program that binds the extra line loses the egress it had. Changing src on the main default route would move every new connection on the machine, including system updates. Do not do that.

On Windows, an extra address added with a single-host mask and SkipAsSource set to true also leaves new connections on the first line. When one program must originate from that line, set the local address in the program, or set SkipAsSource to false for that address and check src again. Do not add a second default gateway on the adapter.

Check mail, DNS, and certificates separately

Mail is where the two paths get mixed. An MX record, or the A record of the mail name, can point at an extra line, and the receiving process can listen there, so inbound mail lands on that line. A new delivery the machine opens itself still shows the first line as the source when the mail program has not bound a local address.

The address published in SPF has to be the source receivers actually see. If inbound mail uses an extra line and outbound mail still leaves from the first, SPF lists the first line. If outbound mail is already bound to the extra line, SPF lists that line. Do not publish a whole /29.

Check in this order.

1. 01 The number of lines equals 1 plus the extras purchased. Every line is still on the NIC after reboot.
2. 02 Each name’s A record points at the line it should land on. Names that share an address all point at the first line.
3. 03 The listen address covers that A record. A program bound only to the first line does not answer the others.
4. 04 From outside, open the service port on that name and confirm the request arrives on the expected line.
5. 05 On the machine, run ip route get 192.0.2.1 and confirm that an unbound new connection still has the first line as src. A program that must use another source binds that line itself.
6. 06 SSH or RDP still uses the first line. Do not move management so that it listens only on an extra address, or the command in the console will no longer match.

Certificates follow the hostname. On a shared line, SNI picks the certificate on one port. On separate lines, the listen address differs, and the certificate is still chosen by the name used for the visit. Moving an address does not require a certificate whose name is the address.

The firewall allows ports. An address can be on the NIC, and the A record can point at it, while a closed port still times out. Finish the six checks, then look at the firewall. When all six match, sites either share the first line by name or each occupy a line from the list, and unbound outbound traffic still leaves from the first line.