IPv4 Residential Proxies: How They Work and How to Use Them

Why residential exits are IPv4, how to connect and verify one, what whitelisting gives up, where residential loses, and when datacenter is the better buy.

An IPv4 residential proxy is an exit address that a consumer internet provider assigned to a household, written as four numbers, and reached through that subscriber's connection. Every exit Node4 serves is IPv4: the residential gateway, the rotating gateways and the static datacenter addresses alike. If you need exits in the newer 128-bit address family, no Node4 product provides them.

People usually ask for IPv4 specifically for one of two reasons. A tool in the pipeline only accepts a dotted-quad address (a partner's whitelist form, a geolocation lookup, an old validation regex), or a target treated exits from the newer address family differently from everyone else's traffic. This guide explains why the address family matters, how to connect to the residential gateway and verify the exit, what whitelisting gives up, and when residential is the wrong purchase.

What "IPv4 residential" actually describes

An address is residential because of who it was allocated to, not because of what it does. Regional registries assign blocks to organizations, and a consumer internet provider announces its blocks from an autonomous system whose registered business is selling connectivity to households. A residential proxy exit is an address inside one of those blocks, reached through a real subscriber's connection. Every classification service, from the free lookups to the commercial feeds your targets buy, works from that registry data first and from traffic observations second.

"IPv4" narrows it to the 32-bit address space, the one written as four numbers. Consumer providers still hand most subscribers an IPv4 address, often a shared one behind carrier-grade NAT, because the equipment on both ends of the subscriber line was built for it and because much of the web still cannot be reached any other way. So an IPv4 residential proxy is not an exotic sub-category; it is what "residential proxy" has meant in practice for the whole life of the product. The distinction only matters when a provider mixes address families into one pool, and then it matters a great deal, for reasons the next section covers.

Datacenter versus residential explains the two categories side by side. This guide assumes you already know you want the residential column and are deciding whether an IPv4-only pool is a feature or a limitation.

Why the address family changes how a target treats you

Three things about a 32-bit address behave differently, and each is a reason people end up typing this query.

Reputation is per address, and the address is shared. Carrier-grade NAT puts many subscribers behind one public IPv4 address. A target that blocks it blocks a neighborhood, which is expensive for the target and is the entire reason residential exits survive checks that drop a hosting range on sight. It cuts the other way too: the reputation on a residential address is noisy, because the households behind it did whatever they did before your request arrived. A residential exit is not a clean slate. It is a plausible one.

Geolocation databases were built on it. The commercial IP-to-location databases hold decades of IPv4 observations and comparatively thin coverage of the newer family. When you pay for a city-targeted exit, the thing you are buying is a database agreeing with the label, and that agreement is far more consistent for IPv4. Country-level attribution is dependable; city-level attribution disagrees between databases routinely, and the database your target consults may not be the one you verified against.

Whitelists, forms and old code expect four numbers. A partner's whitelist, a fraud vendor's rule, a ^\d+\.\d+\.\d+\.\d+$ somewhere in a checkout flow. None of those care about elegance. They care that the string parses.

None of this makes the address family a disguise. A residential IPv4 exit gets you past the first filter, the one that rejects hosting ranges outright. It does nothing about the second and third: TLS fingerprinting, header consistency, request pacing and the behavioral telemetry that modern anti-bot vendors weight above the address. Request fingerprint shows what your client leaks beyond its IP, and if you have already been blocked, block replay will tell you whether the block was about the address at all.

Where the addresses come from, and what we own

Node4 does not own a residential network. Residential capacity comes from an upstream partner network and is resold. What we operate directly are the datacenter address blocks behind the static and rotating products, in the United States, Italy and Spain. The consequence for you is practical rather than moral: on our own ranges a bad exit is something we can look at on the network layer, and on residential it is something we escalate to the partner. Coverage on the residential side spans 170+ countries; the datacenter footprint is those three countries.

The sourcing questions worth asking any provider, Node4 included, are in the datacenter versus residential comparison.

Connecting to the residential gateway

There is one hostname and two ports: HTTP(S) on 8082, SOCKS5 on 1082. Unless you pin it with a session, the exit is chosen per connection: each HTTPS tunnel or SOCKS5 connection gets one exit for its life, and each plain-HTTP request gets its own.

curl -x "http://USERNAME:PASSWORD@gw-residential.node4.io:8082" https://ipinfo.io/json

Run it three times and expect three different addresses. Each run opens a new connection, which is an independent draw from the pool, so a repeat is possible; what you are checking is that the exit moves at all. The response tells you three things worth reading: the address itself, the org line (an autonomous system name, which for a residential exit should be a consumer provider rather than a hosting company), and the country. If org names a cloud or hosting business, the exit is not residential, and that is worth a support ticket with the output pasted in.

The same credential from Python:

import requests

proxy = "http://USERNAME:PASSWORD@gw-residential.node4.io:8082"
r = requests.get("https://ipinfo.io/json", proxies={"http": proxy, "https": proxy}, timeout=30)
print(r.json()["ip"], r.json().get("org"))

Set a timeout. A residential exit is a household connection, and a request that hangs on a device that just went offline will otherwise hold a worker indefinitely. The proxy connection builder writes the string and a snippet for curl, Python, Node and Scrapy from your host, port and credentials, which is the quicker route the first time.

Targeting rides in the username

Country, state, city and session are not account settings. They are hyphenated segments appended to the username on each request, so two requests a second apart can exit from two countries. USERNAME-country-us-city-chicago asks for a Chicago exit, and a location with no exits is refused rather than quietly served from somewhere else. The full grammar, the format each segment accepts and how they intersect are in residential targeting; the one rule to carry from here is that each segment is a filter, and filters only ever shrink the candidate set.

Sticky sessions on residential are best effort. Add -session-<id> and requests carrying that id reuse the same exit for up to 30 minutes from first assignment. The exit is a household connection, though: if its device goes offline first, requests on that id fail until the window passes, so switch to a new id after repeated failures instead of waiting. Design multi-step flows to detect a failed or changed exit and restart the step, not to assume the hold. Sticky versus rotating sessions covers binding a session to a worker and handling expiry.

Whitelisting on residential drops targeting

IP whitelisting works on every product, residential included, but on residential it changes what you can ask for. Register your machine's public IPv4 address under Auth & IP Access, then connect to the residential gateway with no username and no password at all. You get an untargeted exit that rotates freely across the whole pool.

That is the whole option. There is no empty-password halfway on residential, unlike the rotating gateways, because residential targeting lives entirely in the username: if you send no username, there is nowhere for -country- to go. Any request that pins a country, city or session still authenticates with credentials. The mistake to avoid is whitelisting a server, deleting the credential from its config to be tidy, and then wondering why every exit is in a random country.

The address you register is the one your machine uses for IPv4 traffic, which is not always the one a browser shows you: a dual-stack machine reaches this site over the newer family, so the what is my IP tool, like any echo opened in a browser, can show an address the proxy will never see. Ask over IPv4 explicitly, curl -4 https://node4.io/api/tools/ip, and register the address that prints. IP whitelisting best practices covers the sharing set behind an address and how to read the 407 you get when a line drifts.

Metering, caps and stacking

Residential is billed per gigabyte and it is metered. A plan hard-stops at its cap and returns 407 to every request until the period renews or you top up. Two things reduce the surprise. Same-type plans stack, so a second residential subscription sums its allowance with the first rather than replacing it. And auto top-up is opt-in: turn it on and the account recharges at a threshold you choose, before the stop rather than after it, which is the difference between a job that finishes overnight and one you find dead at seven in the morning. Bandwidth top-ups explains both.

Bandwidth discipline matters here in a way it does not on a flat-rate dedicated address. Every image, font and analytics script your scraper downloads through a residential exit is metered. Block them at the client and the per-gigabyte number stretches considerably; a scraper that fetches only the document it parses often moves a fraction of the bytes a browser would.

Where residential loses

When datacenter is the better buy

If your target does not refuse hosting ranges, residential is paying per gigabyte for a property you do not need. The test is cheap: send the same request through a datacenter proxy and through the residential gateway, and let the response decide. Static datacenter addresses run on Node4-owned blocks, carry no data cap on the dedicated plan, and the right buy for bulk work against targets that only rate-limit.

The pattern that usually wins is mixed: bulk fetching on datacenter, residential reserved for the handful of targets that actually drop the range. One account holds both, and the entitlement follows the products you hold rather than the credential you use.

Using the gateway from code and from the API

The gateway is the integration surface. There is nothing to provision per request, and exit selection happens because you connected. The REST API sits beside it for the account side: /gateways/endpoint returns ready-to-use proxy strings for a country, state, city or sticky session, so your code never hand-assembles a targeting username; usage and bandwidth are at /usage/bandwidth, the whitelist at /ip-whitelist, and /webhooks sends a usage.threshold_reached event to your alerting instead of your inbox. The management API documents every endpoint and the per-key rate limit.

Plans and current coverage are on the residential proxies page. Prices are on residential pricing, which is why nothing in this article quotes one.