What we do · Network
Managed perimeter firewalls
Public-facing services in Athens sit behind redundant, stateful firewall pairs with a per-host default-deny policy, threat-intelligence and country-level blocking, and the option to open a service to one country only. Every rule is named after the host it protects, every change goes through an API with a backup first, and every firewall reports to our central logging.
What it is
A managed perimeter: the firewalls in front of your public addresses, run by us as part of the network rather than as a box you configure alone. You tell us what each service needs to expose and to whom. We build it as named, documented policy, keep it current and prove it from the outside.
How we build it
- High availability by design. OPNsense firewalls run as active and standby pairs. CARP virtual addresses cover both the upstream side and your gateway, and pfsync replicates connection state between the nodes, so a node failure is a sub-second stateful failover.
- A policy that documents itself. Every onboarded host gets its own named alias and its own rules.
- An ordered block stack. Traffic first meets a combined threat-intelligence list built from several reputation feeds, then a unified country block list, then a block of abusive hosting ranges, and only then the per-host allows. If your audience is in one country, you can have an allow list of that country's address space instead.
- Tuned for real attacks. Packet processing is spread across CPU cores with thread counts matched to each appliance. UDP-heavy public services are handled statelessly so they do not exhaust the connection table, and SYN-flood defence uses adaptive cookies and timeouts sized from the state-table arithmetic.
- Changed through the API, never by hand. Every change is made through the OPNsense REST API and the result is checked from an external vantage point.
- One-way backup paths. Production has no network path to backup infrastructure. Backup systems pull; production never pushes. This is enforced with deny rules on the firewall appliances themselves, not on the hosts.
- Logging that cannot go quiet. A watchdog re-asserts each firewall's logging configuration on a timer, so a firewall can never stop reporting to Graylog unnoticed.
We run both Cisco Firepower and OPNsense, and when we move a segment from one firewall platform to another we follow a written, phased method: the new firewall joins routing announcing nothing, then takes over one VLAN at a time with a scripted cutover and an automatic, ping-gated rollback.
What it protects you from
- Brute-force and scanning traffic from known-bad sources, and from countries you have no audience in.
- A firewall failure dropping every session.
- Connection-table exhaustion from UDP or SYN floods.
- Undocumented rules that nobody dares to remove.
- A security log that quietly goes nowhere until the day you need it.
In practice
A CRM open to one country only. A retail customer's CRM and test environment was onboarded with web and admin access allowed only from the country it serves, everything else denied, and verified on both firewall nodes. When the business needed two more countries, we added them the next day.
Why EuroVPS
- Redundant pairs with stateful failover, not a single firewall.
- Per-host, named, default-deny policy you can read.
- Threat intelligence, country blocking and single-country allow lists as standard options.
- API-only changes, and central logging that is itself watched.
- Backup networks that production cannot reach, enforced at the firewall.
FAQ
Can I restrict my service to visitors from one country? Yes. We replace the default block stack with an allow list of that country's address space, and can add countries later.
What happens if a firewall node fails? The standby takes over the virtual addresses and the existing connection state, typically in under a second.
Can I see or request rule changes? Yes. Rules are named per host, so we can show you exactly what is open for each service and change it on request.
Do you block attacks automatically? Yes. Threat-intelligence, country and abusive-range lists are applied ahead of your own rules and kept up to date.
If you want your public services behind a perimeter that is built and watched like this, talk to an engineer.
Your next infrastructure partner
Let’s look at
your setup.
Tell us what you run today and what needs to improve. An engineer will review your brief and help you plan the next step.
+357 222 32280
who will look after your infrastructure.
Let’s start with your setup.
A little context helps us start the right conversation.