Back to blog
Business

Dedicated IP for Teams in China: When You Need One (2026)

When a team in China needs a dedicated IP (allowlisted admin panels, bank portals, jump hosts, vendor portals), when it doesn't, and the rules to follow.

Updated October 2026.

阅读中文版

The short answer

A dedicated IP gives your team's international traffic one fixed internet address instead of a shared one that changes. You need it when something checks your address: an admin panel with an IP allowlist, a firewall in front of a remote desktop, or a vendor portal. For everyday Google, Zoom and Slack, you don't.

Table of contents

What is a dedicated IP, in plain words?

Every connection to the internet leaves from an address, called an IP address. Your office line has one, given by your carrier. When your team uses a VPN, websites see the VPN's address instead of your office's.

Most VPN services, including Throughwire by default, send customers out through shared addresses that can change from one day to the next. A dedicated IP, also called a static IP, is a fixed address your connection uses every time. The admin panel you sign in to sees the same address today, next week and next month.

Two things to keep in mind:

  • An address is not an identity. Accounts are still protected by passwords and two-factor sign-in. A fixed address is an extra signal that a sign-in comes from the expected place.
  • It only applies to international traffic. With Throughwire's smart routing, WeChat, Alipay, DingTalk and other Chinese services go direct on your China line, so they see your normal China address, not the dedicated IP.

Why does your team's address matter?

Many business systems use the address a sign-in comes from as one of their checks.

  • Allowlists. Some admin panels accept sign-ins only from listed addresses. In Microsoft Entra, admins define "named locations" by IP range and use them in sign-in policies. Microsoft notes that with a cloud VPN, "the IP address Microsoft Entra ID uses while evaluating a policy is the IP address of the proxy," and that keeping an up-to-date list of a cloud VPN's addresses "is nearly impossible" (Microsoft Learn, updated April 2026). A fixed address removes that problem.
  • Code and admin tools. GitHub lets organisations on GitHub Enterprise Cloud restrict access to listed IP addresses, and it applies to every role, including owners (GitHub Docs).
  • Location checks. Microsoft lists "requiring multifactor authentication for users accessing a service when they're off the corporate network" as a common use of network locations. Banks and finance portals often ask for extra checks when a sign-in comes from an unfamiliar address. A changing address can trigger those checks more often.

When does a team in China need a dedicated IP?

SituationDo you need a dedicated IP?Why
An admin panel only accepts sign-ins from listed addressesYesAn allowlist needs an address that doesn't change
A firewall in front of a remote desktop or SSH jump hostYesYou open access to one known address, not the whole internet
A supplier or customer portal asks for your IP addressYesThey can add one address to their list
A bank or finance portal that asks for extra checks on new locationsOften helpsThe same address every day looks like the same place
Your company's one ad account or marketplace seller accountHelpful, not requiredConsistent sign-ins from one place; the platform's rules still apply
Several accounts on a platform that allows oneNo, and don'tIt breaks platform rules, and we don't support it
Gmail, Zoom, Slack, LinkedIn and YouTubeNoShared addresses work fine
WeChat, Alipay, DingTalk and TaobaoNoThey go direct on your China line
Netflix and other streaming servicesNoThey apply their own account and region rules

The common thread: you need a dedicated IP when a system outside China has to recognise your team by its address. The typical cases for a team in China are:

  • SaaS admin panels for HR, finance, CRM or cloud consoles that headquarters has locked to known addresses.
  • Bank and finance portals that flag new locations, used by a finance team in China working with accounts abroad.
  • Remote desktop and jump hosts, where a firewall only lets known addresses connect.
  • Vendor portals run by suppliers, logistics partners or customers who allowlist each partner.
  • The company's one ad or marketplace account, so the marketing team signs in from one consistent place.

When don't you need one?

  • Everyday international work. Google Search, Gmail, Zoom, Slack, Microsoft 365 and LinkedIn work on shared addresses.
  • Chinese apps. They go direct and never use the dedicated IP.
  • Streaming. A fixed address doesn't change a service's own account and region rules.
  • Tools that check devices instead of addresses. Microsoft notes that when a cloud proxy is in place, a policy requiring a compliant or company-joined device "can be easier to manage." If your tools already work that way, you may not need an IP rule at all.

What are the rules for using a dedicated IP?

These are our rules, and they line up with what platforms expect:

  • One company, its own accounts, from one stable address: fine. That is what allowlists and consistent sign-ins are for.
  • Never use it to run extra accounts on a platform that allows one, to make accounts look unrelated to each other, or to hide who you are from a platform. We don't support those uses.
  • Follow each platform's own rules. For example, Google Ads' Circumventing systems policy prohibits creating new accounts to return after a suspension and "spreading ads that violate Google Ads' policies across 2 or more accounts", and its advertiser verification does not allow false information (Google Ads policy, checked 23 October 2026).
  • Treat an allowlist as an extra lock, not the only lock. Keep strong passwords and two-factor sign-in on every allowlisted account.
  • Don't use it to get around region rules. A fixed address is for recognition, not for changing where a service thinks you are.

How does Throughwire's static IP add-on work?

  • Price. $9 per month on top of your plan (October 2026). Add it at checkout or later from your account. If you cancel, it ends at renewal.
  • Shared by at most five accounts. The address is fixed, but it is not exclusive to one customer: up to five separate accounts can use the same address (October 2026), each with its own credentials. So an allowlist that contains it shows traffic came through our fixed address, not that it came from your company. Keep passwords and two-factor sign-in on, as you should anyway.
  • Location. The address you buy at checkout is in the United States, on our Los Angeles (High Speed) route. Your account shows the address once it is active.
  • Nothing to configure. It applies automatically to the account it is added to: in the Throughwire apps, and on a router set up from that account.
  • Whole office, one address. Add it to the account that sets up the office router, and every device on that Wi-Fi leaves from the same address for international traffic, with nothing to install.
  • Stay on the Los Angeles route. The Ultra routes (Osaka and Singapore) use their normal addresses, so a device switched to Ultra won't show your fixed address.
  • Chinese apps are unchanged. They keep using your China line.

How do you set up an allowlist safely?

  1. Add the dedicated IP at checkout or from your account, and wait until it shows as active with its address.
  2. Check the address. From a device on the office Wi-Fi, open any "what is my IP" page and confirm it matches the address in your account.
  3. Keep a second way in. GitHub warns that losing access to the addresses on your allow list can lock you out of your own organisation. Keep a second administrator, or a backup path, before switching the rule on.
  4. Add the address to the allowlist in each tool (a single IPv4 address, written as /32 where a range is asked for).
  5. Test both ways. Sign in from the office Wi-Fi, then confirm a phone on mobile data is blocked.
  6. Write it down. Note which tools use the address in your IT policy, so the next person knows why it matters.

When Throughwire isn't the right choice

  • Your allowlist must admit only your company. Our add-on is shared by up to five accounts. Use a fixed IP on your own office line or cloud gateway, or ask us about Enterprise.
  • Your policy requires an address registered to your company, or a range you control. Ask your carrier for a fixed IP on your office line, use your own cloud gateway, or contract a leased line.
  • You need the address in another country. Checkout offers a US address today; talk to us about Enterprise before buying.
  • You need the fixed address on a low-latency Ultra route, for example for remote desktop from Shanghai. Contact us first.
  • Your tools already use device-based access. You may not need an IP rule at all.
  • You want several accounts to look separate. We don't offer that, and platforms don't allow it.

Common questions

Is a dedicated IP the same as a static IP?

In everyday use, yes: both mean an address that doesn't change. Strictly, "dedicated" means only one customer uses the address. Throughwire's $9 add-on is a static address shared by at most five accounts, so if your security policy needs an address only your company uses, get a fixed IP on your own office line or ask us about Enterprise.

Does a dedicated IP make us anonymous?

No. It makes your address predictable, which is the opposite of anonymous. Platforms still know which account is signing in.

Will WeChat or Alipay see the dedicated IP?

No. Chinese services go direct on your China line and see your normal address.

Can the whole office share one dedicated IP?

Yes. Set up the office router from the account that has the add-on and keep it on the Los Angeles route. Every device on that Wi-Fi then uses the same address for international traffic.

Do we need one for Google Ads or Meta?

It isn't required. A company with one ad account may find a consistent sign-in address helpful, but it changes nothing about the platform's rules, which you still have to follow.

Details for your IT team

  • The fixed address is a single IPv4 address, shared by at most five accounts with separate credentials, used as the egress for the account's standard VLESS-REALITY connection on the US (Los Angeles) route. The Ultra routes keep their normal egress.
  • It is registered to our hosting provider, not to your company, so allowlist the single address rather than its surrounding range.
  • In Microsoft Entra, add it as an IPv4 named location and optionally mark it as trusted. On GitHub Enterprise Cloud, add it to the IP allow list before enabling the list.
  • Smart routing still applies: mainland China domains and IP ranges go direct and never use the address.
  • Zero-Trust Relay lets you run your own encryption (Tailscale, WireGuard, SSH or Cloudflare Tunnel) inside Throughwire. We carry it without access to its private contents.