Networking

Public networking

Each server receives one public IPv4 address and a /64 IPv6 range. Both are routed to the instance, not NATed. You can add extra IPv4 addresses for $2/month each.

Bandwidth is included per plan. Egress beyond the allowance is billed at $0.01/GB. Inbound traffic and traffic inside the private network are free.

Private networking

Create a private network in a region, then attach servers to it. Every attached server gets an address on that network and can reach the others without touching the public internet.

br networks create backend --region ruh1 --cidr 10.20.0.0/24
br networks attach backend api-prod
br networks attach backend db-prod

Private networks are region-scoped. For multi-region setups, route through a public endpoint with TLS, or ask us about private interconnects.

Cloud firewall

Firewall rules are applied at the network edge, before traffic reaches the server. Rules are allow-only and evaluated in order; anything not explicitly allowed is dropped.

1. Open Networking → Firewalls and create a firewall.
2. Add inbound rules for SSH (22) from your office IP, HTTP (80) and HTTPS (443) from anywhere.
3. Add an outbound rule allowing all traffic, or restrict it if you prefer.
4. Attach the firewall to one or more servers.

Keep port 22 restricted to known addresses. If you lock yourself out, the web console still works.

DNS

Domains registered with ByteRoast use our anycast nameservers automatically. For domains registered elsewhere, set your nameservers to the pair shown in the console, or create the records at your current provider.

IPv6

IPv6 is enabled by default. Add an AAAA record for the address shown on the server page. If your application binds to IPv4 only, check its configuration before assuming IPv6 is broken.