Dora NodaAsk a team migrating off a PaaS what they priced first, and the honest ones will not say dynos. They will say the allowlist. Somewhere in the migration spreadsheet sits a partner bank, a data provider, or an enterprise customer's firewall team that will only open its doors to a fixed set of source IPs — addresses that must survive every redeploy, reschedule, and scale event without a change ticket. On May 19, 2026, Render turned that line item into a checkbox: dedicated outbound IP sets at $100 per month, three static IPv4 addresses per set, scoped to a workspace or specific environments in one region.
The interesting question is not whether $100 is fair. It is what the same guarantee costs to build by hand on machines you own: a NAT gateway tier with fixed floating IPs, per-tenant SNAT rules, and a real failover story for the day the egress node dies. This post prices both sides on the same typical fleet, down to the fully-loaded total most comparisons skip.
The cost table, up front
| Approach | Monthly infra | What survives a redeploy | What survives an egress-node death | Scope |
|---|---|---|---|---|
| Render dedicated IP set | $100 per set | Yes — IPs are workspace-scoped, not deploy-scoped | Yes — managed by Render | 3 IPv4s, one region, workspace or environments |
| Self-hosted HA NAT pair (2 gateways + floating IP) | ~$14 | Yes — floating IP is fleet-scoped | Yes, after seconds-to-minutes failover with in-flight TCP reset | As many tenants as your SNAT rules cover, one region |
| Self-hosted single NAT box | ~$9 | Yes | Nothing — egress is down until the box recovers | Same, minus redundancy |
| QuotaGuard Static proxy | $19 (2 shared static IPs) | Yes — proxy IPs are stable | Yes — managed failover | HTTP/SOCKS proxy hop; app must route through it |
All self-hosted rows use Hetzner Cloud list prices converted at €1 = $1.08, excluding VAT. The QuotaGuard row is the single closest proxy alternative (Static starts at $19/month); its compliance tier with TLS passthrough is a separate product. The rest of this post shows its work: the exact Render scope, the gateway design, the bill of materials, the labor the table above does not yet include, and the failover fine print.
The fleet this post prices
Every number below traces to one typical fleet, so nothing is cherry-picked per section:
- 3 worker nodes running tenant workloads in one region
- 2 tenants that each need a distinct allowlist IP to hand to outside partners
- ~200 GB/month of egress — meaningful API and webhook traffic, but noise against Hetzner's 20 TB included allowance, so bandwidth never enters the math
- Private worker nodes: no public IPs on the workload machines themselves
If your fleet is bigger, the per-IP scaling section extends the same arithmetic to five tenants. If it spans regions, multiply the egress tier per region on both sides — Render bills per regional set, and a floating IP does not cross regions either.
What Render's $100 actually buys
Before pricing the alternative, pin down the product. Render's dedicated IPs documentation and the May 19 changelog entry define a narrow, honest scope:
- Each set holds three IPv4 addresses in a single region, billed at $100/month per set, available to Pro workspaces and higher.
- A set scopes to your entire workspace or to specific environments. Services outside the scope keep using Render's shared outbound IP ranges — broad CIDR blocks shared across every service in the region, which is exactly what partner firewalls refuse to allowlist.
- Dedicated IPs cover outbound build traffic such as package downloads, but Docker image pulls still exit through the shared ranges. Services in the Oregon region on workspaces created before January 23, 2022 do not support dedicated sets at all.
That is the whole product: exclusive addresses, no shared-pool neighbors, no proxy code in your app, failover and maintenance absorbed by Render. The two exceptions matter for the comparison because the self-hosted design has no equivalent carve-outs — once traffic exits through your gateway, all of it carries your IP, image pulls included.
The self-hosted design, part by part
Reproducing that guarantee on owned Hetzner machines takes five components. None is exotic; the cost is in operating them as one tier.
Private worker nodes. The three workers live on a Hetzner private network with no public IPs. Their default route for 0.0.0.0/0 points at the gateway tier through an hcloud_network_route, so no workload can accidentally egress with a node identity that changes on the next machine replacement. This is the standard recipe from Hetzner's NAT gateway community tutorial.
A NAT gateway pair, not one box. Two small dedicated servers (CX22 class: 2 shared vCPUs, 4 GB RAM) run iptables MASQUERADE, rewriting every private source address to the gateway's public identity. Two boxes because one box is the single-NAT row in the table — cheaper, and down with no story when it dies.
One floating IPv4 as the allowlist identity. Hetzner charges €3.00/month for a floating IPv4, and that address — not either gateway's own public IP — is what partners allowlist. It can be reassigned between servers over the Hetzner API, which is what makes failover possible without ever calling the partner's firewall team.
keepalived plus API-driven failover. The pair runs keepalived for health detection; on master failure, the standby claims the floating IP via the Hetzner API. The pattern is well-trodden — community keepalived failover scripts and Hetzner's own HA load-balancer walkthrough both implement exactly this handoff. Note the asymmetry with managed cloud load balancers: the failover is API-driven reassignment, not gratuitous ARP on a LAN, so it takes seconds to minutes and drops in-flight connections. More on that below.
Per-tenant SNAT for distinct allowlist IPs. The fleet's two tenants need different source IPs. With Cilium as the CNI, a CiliumEgressGatewayPolicy per tenant selects that tenant's pods by namespace and SNATs their external traffic to that tenant's dedicated egress IP, routed through the labeled gateway node (Cilium Egress Gateway). Each additional distinct identity is one more floating IP at €3/month — no extra servers until throughput, not address count, forces it.
The bill of materials, then the real total
The infrastructure math is short. Current Hetzner list prices, excluding VAT: a CX22 server at €4.49/month, a primary IPv4 at €0.50/month, a floating IPv4 at €3.00/month.
| Line item | Qty | Monthly |
|---|---|---|
| NAT gateway servers (CX22) | 2 × €4.49 | €8.98 |
| Primary IPv4s for the gateways | 2 × €0.50 | €1.00 |
| Floating IPv4 (the allowlist identity) | 1 × €3.00 | €3.00 |
| HA tier total | €12.98 ≈ $14 |
That €12.98 is the title's "$14 tier": the full HA pair, at roughly $14 after conversion. The single-box variant drops to one server, one primary IP, and the floating IP — €7.99, roughly $9 — and buys no failover at all.
But infrastructure is the smaller half of "really costs." Price the labor at an explicit assumed $120/hour loaded rate: a careful first build — private networking, gateway pair, keepalived failover tested by actually killing the master, Cilium egress policies per tenant, monitoring, and a runbook — is about 16 hours, or $1,920. Amortized over 24 months, that is $80/month. Ongoing on-call and patching is the variable that drives the total, so here is the sensitivity instead of one convenient point:
| On-call load | Infra | Amortized build | On-call | Fully-loaded total |
|---|---|---|---|---|
| 2 hrs/month (quiet tier) | $14 | $80 | $240 | ~$334 |
| 5 hrs/month (typical small team) | $14 | $80 | $600 | ~$694 |
| 10 hrs/month (noisy quarter) | $14 | $80 | $1,200 | ~$1,294 |
The honest headline: self-hosting wins on infrastructure 7-to-1 and loses fully-loaded unless your on-call time is already sunk cost. A platform team that staffs on-call anyway prices the marginal tier near $14; a product team buying its first pager prices it near $700.
Per-IP scaling extends the same arithmetic. Distinct allowlist IPs are the scaling axis the TODO demands. On Render, a set holds three addresses, so five tenants needing distinct IPs take two sets: $200/month. Self-hosted, four more floating IPs cost 4 × €3 ≈ $13/month extra, for about $27/month in infra. The hosted side scales in $100 steps; the self-hosted side scales in $3 steps — which is precisely why teams with many tenants feel the managed price first, even though the labor column above still dominates either total.
The failover story, honestly
This is the section that decides the purchase, so no hand-waving. When the active gateway dies:
- keepalived's health checks notice within seconds — if you tuned them aggressively, at the cost of false positives during transient load.
- The standby calls the Hetzner API to reassign the floating IP. API-driven reassignment is measured in seconds to minutes, not milliseconds; it is a control-plane operation, and it can queue behind the same incident that killed your master if the problem is regional rather than single-box.
- Every in-flight TCP connection through the old gateway breaks. Conntrack state does not migrate; long-lived connections to partner APIs must reconnect and retry. Idempotent clients barely notice. Non-idempotent payment or provisioning calls need application-level deduplication — a requirement the gateway cannot fix for you.
- Return traffic follows the floating IP to the standby automatically, since the partner sees the same source address throughout. The allowlist never changes. That property — identity surviving the failure — is the one thing this whole tier exists to guarantee, and it holds.
What Render's $100 absorbs is items 1 through 3 as your problem: their failover, their connection draining, their 3 a.m. page. It does not absorb item 3's application half — your clients still need retries either way; the managed version just makes the event rarer and shorter.
If your partner integrations already retry with backoff (and allowlisted enterprise APIs almost always do, since they assume the internet), the practical gap between the two failovers is minutes of degraded egress a few times a year versus nearly none. Price that gap against the labor table above, not against $14.
Who should pick which
Take Render's checkbox if you are a solo developer or a product team with no on-call rotation. The fully-loaded math is not close at 5-plus on-call hours a month, and every hour spent nursing keepalived is an hour not spent on the product your partners actually buy. Multi-region fleets should also default hosted: each region needs its own set on both sides, but only the self-hosted side multiplies the pager load.
Build the NAT tier if you already staff platform on-call and run more than a couple of tenants needing distinct IPs. The marginal infrastructure is $14 plus $3 per extra identity, the design above is boring in the best sense, and the skills transfer to every other piece of egress policy — data-loss-prevention filtering, per-partner rate limiting, traffic mirroring — that a checkbox will never offer.
Take the proxy middle path (QuotaGuard Static at $19/month) if you need stable egress for a handful of HTTP integrations and can tolerate a proxy hop in the app. It is the cheapest managed answer, but it is per-integration configuration rather than fleet-wide identity: every new service repeats the setup, and non-HTTP protocols need the higher tiers.
Whichever you choose, keep the migration lesson this post opened with. The enterprise question — "what IP will this integration see?" — arrives before the pricing question, and the only wrong answer is discovering it during the migration. A team that can hand over three static addresses on day one, whether they come from a $100 checkbox or a $14 tier with a runbook, closes deals a team still allowlisting shared CIDR ranges does not.
Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. Star the repo on GitHub or deploy your first app today.
