The network behind your servers

Every server on AS55285 includes DDoS mitigation at the network edge. It is part of the network layer, not a separate product line: there is nothing to add to a cart and nothing to switch on after the server is already live.

Mitigation sits inline, in front of the server, filtering attack traffic before it reaches the host. Legitimate traffic keeps flowing without you having to repoint DNS or stand up a separate scrubbing endpoint. Every metro has its own Corero NTD1100 appliance in the path, so an attack is dropped in the metro it lands in.

Because the filter is already in the path there is no redirect to wait for: attack traffic is dropped in under a second.

Because protection is built into the network rather than layered on afterward, it covers a server from the moment it's provisioned, including during OS installs and first boot.

Servers connect through dual uplinks, each landing on a different switch, so one failed link or interface does not take a server offline on its own.

From there, traffic crosses diverse paths through our network fabric rather than a single chokepoint. We reach the rest of the internet through a blend of transit providers and settlement-free peering, so no single upstream is the only way to reach a given destination. Every one of those transit uplinks is a 100 Gbit/s port or faster.

When a path fails, whether an uplink, a fabric link, or an upstream session, routing reconverges onto the next available path automatically.

Every server ships dual-stacked, with IPv4 and IPv6 enabled together by default, so IPv6 is not a separate request or a paid add-on.

If you run your own routing, we support BGP sessions with customers who want to announce their own IP space through our network (BYOIP) instead of using address space we assign.

What we announce is registered, not just claimed: our IRR AS-SET, AS55285:AS-ALL, lists the prefixes we originate, checkable against the same public IRR and PeeringDB records any route-server lookup would use.

A private network is a layer 2 network between your own dedicated servers, carried inside our network instead of across the public internet, so traffic between them stays off their public interfaces. Its VLAN can be extended to your servers in our other datacenters, which lets a web cluster answer visitors in two metros and keep its sessions and cache in step over one private network. Database and Proxmox clusters stay inside a single datacenter.

Jumbo frames at 9000 MTU are supported, you pick the VLAN tag, and you manage the network from the cloud console or by API. Private networks and their extension between datacenters are available at no cost.

Firewall groups cover the public side. A firewall group is a named set of allow and block rules, by protocol, port range and source network, that you apply to any number of your public IP addresses, also at no cost. The rules run on the access switch each server plugs into, so traffic a rule blocks is dropped before it reaches the server's port. They are stateless and filter inbound traffic only, and traffic that matches no rule is allowed, so a host firewall still does the stateful filtering. Firewall groups do not filter traffic on a private network.