# Turning off the public IP: making a server private-only

https://www.gyrohosting.com/en/knowledgebase/article/gyro-cloud-istanbul-turn-off-public-ip

- **What you will learn**: How to turn off the public IP of a server that should not be exposed to the internet (such as a database), the prerequisites and how to turn it back on.
- **Time**: 5 minutes
- **Who is it for**: Sysadmins.
- **What you need**: A Gyro Cloud Istanbul server attached to a private network.

## 1. Check these first

> **Warning**
> 
> Once the public IP is off you **cannot connect to the server directly from the internet**, and (if NAT is off on the VPC gateway) the server **cannot reach the internet either.**

- The server must have at least one **`ready` private network card** ([attach guide](https://www.gyrohosting.com/en/knowledgebase/article/gyro-cloud-istanbul-attach-server-private-network)).
- If the server must reach the internet (updates, package installs, external APIs), enable the **VPC gateway with NAT** on the VPC ([VPC gateway guide](https://www.gyrohosting.com/en/knowledgebase/article/gyro-cloud-istanbul-vpc-gateway-nat)). With NAT off you must give an extra confirmation to proceed.
- If you have an **additional IPv4**, remove it first; turning off is refused on a server with additional IPv4s.
- Decide how you will connect: from another server in the same VPC or through a port forward on the gateway. The **web console** on the service page works independently of the network and is always available.
- On older servers without the guest agent, turning off is refused (the routing cannot be applied inside the server); newly created servers are fine.

## 2. Turning off from the panel

1. **My Services →** your server → **Private network (VPC)** tool.
2. Choose **Turn off public IP**.
3. To confirm, **type the server's current IP address** and confirm.

The operation moves the server's default route to the gateway in the private network, then disconnects the public network card. The IP address **stays reserved for your server.**

While it is off: the only private NIC cannot be removed, the operating system cannot be reinstalled, additional IPv4s cannot be added and the VPC gateway cannot be turned off.

## 3. Turning back on

In the **Private network (VPC)** tool choose **Turn on public IP**. The same IP address returns to the server.

## 4. Command line and API

```
gyro server public-ip get 12345
gyro server public-ip off 12345 --confirm-ip <current-IP>
gyro server public-ip on 12345
```

```
curl -X DELETE https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/public-ip \
  -H "Authorization: Bearer $GYRO_TOKEN" -H "Content-Type: application/json" \
  -d '{"confirm_ip":"<current-IP>"}'
```

The operation returns 202. To turn off while gateway NAT is off, add `"allow_no_egress": true` to the request (the server will not be able to reach the internet).

| Error | Meaning |
| --- | --- |
| `confirm_mismatch` | The IP you typed does not match the server's IP. |
| `extra_ips` | Remove the additional IPv4 addresses first. |
| `no_private_network` | There is no ready private network card. |
| `no_egress` | Gateway NAT is off; confirm with `allow_no_egress` if you do not need egress. |
| `already_off` / `already_on` | Already in the requested state. |

## 5. Good to know

- **Network Firewall** rules are for the public IP; they are not applied while it is off and come back when you turn it on again.
- If you use the VPC gateway for NAT, the gateway fee applies separately (about TRY 277.79 per month (4.99 €), metered hourly from prepaid balance).

## Next step

- [VPC gateway: internet egress and port forwarding](https://www.gyrohosting.com/en/knowledgebase/article/gyro-cloud-istanbul-vpc-gateway-nat)
- [Security on the private network](https://www.gyrohosting.com/en/knowledgebase/article/gyro-cloud-istanbul-vpc-security)