Hosting providers
Protect every customer on your network.
Stop upstream null-routes and keep your datacenters online. Orbitel Shield scrubs volumetric floods at the edge before they can fill your links or disrupt other tenants.
- Protect entire IP subnets (/24 IPv4 & /48 IPv6)
- Prevent upstream ISP null routes
- Multi-tenant peace of mind with flat monthly pricing
198.51.100.0/24
256 protected IPs • Customer VPS pool A
203.0.113.0/24
256 protected IPs • Dedicated server cluster
2001:db8:8000::/48
IPv6 native scrubbing
Subnet-level protection for modern datacenters.
Putting your subnets behind Orbitel Shield protects every customer, VM, and server on your network with a single routing configuration.
- 1
Announce your subnets
Orbitel Shield announces your IPv4 /24 or IPv6 /48 prefixes over BGP, routing inbound internet traffic through our scrubbing mesh.
- 2
Filter attacks at the edge
Multi-terabit volumetric attacks targeting individual tenant IPs are scrubbed before reaching your upstream transit carriers.
- 3
Isolate attacked customer IPs
Attacks are neutralized without collateral damage. Neighboring customer servers on the same subnet remain unaffected.
- 4
Deliver clean traffic to your racks
Clean bandwidth is returned directly to your core routers via high-throughput GRE or WireGuard tunnels.
Zero collateral damage when tenants are attacked.
When one customer is targeted, standard transit providers blackhole the entire IP or let your transit saturate. Orbitel Shield keeps all tenants online without interference.
Eliminate downtime for all tenants
Hosters often face cascading outages when a single customer draws a massive flood. Orbitel Shield stops carpet-bombing and volumetric floods at the edge.
Preserve customer retention
Frequent DDoS blackholing causes frustrated hosting clients to leave. Providing always-on mitigation turns protection into a competitive selling point.
Flat, predictable budgeting
Say goodbye to unpredictable bandwidth penalty fees from upstream transit providers during sustained DDoS campaigns.
198.51.100.0/24
256 protected IPs • Customer VPS pool A
203.0.113.0/24
256 protected IPs • Dedicated server cluster
2001:db8:8000::/48
IPv6 native scrubbing
Built for infrastructure operators.
Everything a datacenter or hosting company needs to deliver carrier-grade reliability to their customers.
Prevent upstream null routing
Upstream carriers blackhole attacked IPs to protect their own networks. Orbitel Shield scrubs the flood so your IPs stay live.
Multi-tenant isolation
An attack targeting one VPS or dedicated server never impacts neighbors in the same rack or subnet pool.
Full prefix protection
Every IP address in your /24 or /48 block is covered. You don't have to pick and choose individual IPs to shield.
Unmetered attack volume
No surprise bills or burst overage fees when a customer is hit by a massive flood. Attack traffic is never billed.
RouterOS, VyOS & Linux ready
Connect your core network in minutes using ready-to-paste configurations for MikroTik, VyOS, Cisco, or Linux routers.
Automation API
Full REST API enables programmatic prefix management, real-time telemetry extraction, and automated mitigation policies.
Technical specifications.
Subnet routing, BGP requirements, and tunnel encapsulation specs.
- Prefix sizes
- IPv4 /24 and IPv6 /48 blocks (larger blocks supported one /24 or /48 at a time)
- Transit integration
- BGP Anycast routing with RPKI ROA and IRR authorization
- Delivery tunnels
- High-capacity GRE or WireGuard to your datacenter edge routers
- Mitigation capacity
- Global multi-terabit scrubbing network designed for carpet bombing & floods
- Tenant limits
- Unlimited protected tenant hosts within your announced IP range
- Attack billing
- 100% unmetered. Attack traffic is never counted toward your bandwidth
Questions, answered.
Can’t find what you need? Talk to an engineer.
How does Orbitel Shield prevent upstream ISP null routing?
When your prefixes are announced through Orbitel Shield, attacks land on our scrubbing edge rather than your upstream transit providers. Because your transit providers never see the attack flood, they never trigger automated null-routes or blackholes against your IPs.
Do we need to buy new hardware for our datacenter?
No. Clean traffic is delivered directly over GRE or WireGuard tunnels to your existing edge routers (MikroTik, VyOS, Cisco, Juniper, or Linux).
Can we protect multiple customer subnets?
Yes. You can add as many /24 IPv4 and /48 IPv6 subnets as your organization owns or leases.
How are we billed for our hosting network?
You are billed a flat monthly rate based on your clean delivered traffic. Attack traffic is absorbed at our edge and is never counted or billed.