> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sfcompute.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IP Addresses

> Give an instance a public IPv4 address for internet access

<Warning>
  This feature is in [public preview](/preview/roadmap).
</Warning>

Instances can have a public IPv4 address for internet connectivity. Public IPs are enabled or
disabled when creating an instance and cannot be changed afterward. IPv6 is not yet supported.

## Enabling a public IP

Set `--public-ipv4` when [creating an instance](/preview/instances#create-an-instance) to assign a
public IP address:

```bash theme={null}
sf instance create --public-ipv4
```

The public IP is auto-assigned when the instance is created and released when the instance is deleted. IPs are not shared between instances.

Without `--public-ipv4`, the only inbound port open on the instance is SSH (TCP port 22); nothing
else is reachable from the internet. Connect with `sf instance ssh`.

## Internet connectivity

Instances reach the internet via IPv4 using TCP, UDP, and ICMP; other layer 4 protocols are blocked.
Outbound SMTP (TCP and UDP port 25) is blocked—contact SFC if you need this restriction removed.

Inbound traffic is governed by [firewall rules](/preview/networking/firewalls). Source CIDRs are
restricted to public IPv4 addresses, and because internet source IPs are
[spoofable](https://en.wikipedia.org/wiki/IP_address_spoofing), firewall rules should be treated as
[security hardening](https://en.wikipedia.org/wiki/Hardening_%28computing%29), not as a security
mechanism. Additionally, all traffic to an instance's UDP or TCP port 68 is blocked to prevent DHCP
attacks.

## Finding an instance's IP

An instance's IP is available through `sf instance get` and `sf instance list`.

```bash theme={null}
sf instance get --name worker-1
```

The response includes the `public_ip` field (if enabled).

{user.groups?.includes("internal") && (
<>
## Private IPs

Every instance gets a private IP in its subnet's CIDR range. Instances in the same subnet can reach each other via private IPs. See the [Subnets](/preview/networking/subnets) documentation.
</>
)}