What we do · Network
Multi-site encrypted backbone: the DMVPN mesh
Our datacenters in Athens, Amsterdam and Toronto, our corporate headquarters in Cyprus and our regional points of presence are joined by a Cisco DMVPN overlay: encrypted tunnels with dynamic spoke-to-spoke paths and BGP routing on top. It carries management, monitoring, backup and inter-site traffic, and the same technology is used to build dedicated site-to-site networks for customers who need their own offices connected to their hosted platform.
What it is
DMVPN (Dynamic Multipoint VPN) is a Cisco architecture for building one routed, encrypted network across many sites. For you, it means two things: traffic between our sites never crosses the internet in the clear, and your own offices can join a private network that ends inside your hosted platform.
How we build it
- Strong, authenticated crypto. Multipoint GRE tunnels protected by IPsec with AES-256 and SHA-256, authenticated NHRP, and BFD for fast failure detection on every tunnel, with BGP routing on top.
- Redundant hubs in every datacenter. Standby hubs carry their own AS and a deliberate outbound de-preference, so they stay quiet until the primary is genuinely gone and then take over on their own.
- Two circuits, one router, both used. A site with two WAN circuits runs a second DMVPN cloud on the same router. The tunnel key separates the two clouds on one interface, so the second circuit needs no new public address, no new firewall rule and no change at the hubs. Both clouds share one routing table, and BGP multipath with a forwarding hash that includes ports spreads parallel flows across both circuits.
- Hardware where the traffic justifies it. We measured hardware routers side by side with virtual routers on identical live traffic. The hardware did many times more forwarding work per unit of CPU, so busy sites get hardware.
- Sized against reality. We size against what the encryption engine can really do, about 11 Gbit/s encrypted per hub, not against the number printed on a licence. When a customer needs more, we scale with equal-cost multipath across hubs to 30 to 40 Gbit/s.
What it protects you from
- A single WAN circuit or carrier failure isolating a site.
- Backup copies, replication and management sessions crossing the public internet unencrypted.
- A hub failure that needs someone to reconfigure every branch by hand.
- A second circuit you pay for that sits idle.
- A VPN sized by marketing numbers that falls over at the first real load.
In practice
A professional services firm's private network, moved between countries. A customer's private network, a hub plus several branch-office routers and remote staff access, had to move to a new country ahead of a hard deadline. We cloned the hub, brought it up in parallel in its new home and switched over. Every branch router re-registered on its own, with no change made at any branch office.
Both circuits, proven. On a site with two WAN circuits, a throughput test over the dual-cloud design measured more in each direction than either circuit could carry on its own. That is the only acceptable proof that multipath is working rather than merely configured.
Why EuroVPS
- Cisco DMVPN with AES-256, BGP and BFD, the way carriers and large enterprises build private WANs.
- Redundant hubs in every datacenter.
- Capacity: about 11 Gbit/s per hub, 30 to 40 Gbit/s with multipath when you need it.
- The same backbone and the same engineers serve our own sites and your private network.
- Your branch offices end up inside your hosted platform, not on the open internet.
FAQ
Can my offices join this network? Yes. We build dedicated site-to-site networks for customers, with your own hub and your branch routers, terminating inside your hosted environment.
Do my branches need reconfiguring if a hub changes? No. Branches register dynamically and routing runs over BGP, so a hub change or failover is handled at our end.
How much encrypted throughput is available? About 11 Gbit/s per hub. When a customer needs more, we spread traffic across several hubs with equal-cost multipath and reach 30 to 40 Gbit/s.
Can I use two internet circuits at a branch? Yes. Our dual-cloud design uses both at once and fails over between them automatically.
If you want your sites joined to your platform over a private, encrypted network, talk to an engineer.
Your next infrastructure partner
Let’s look at
your setup.
Tell us what you run today and what needs to improve. An engineer will review your brief and help you plan the next step.
+357 222 32280
who will look after your infrastructure.
Let’s start with your setup.
A little context helps us start the right conversation.