Network & Network Security
Network & Network Security
This domain covers how OVHcloud addresses services publicly and privately, and which controls filter or absorb traffic. Expect vRack, IP management, anti-DDoS, firewalls, security groups and load balancing.
Core building blocks
- vRack - a private Layer 2 network that spans eligible services and datacentres. You assign VLANs and configure interfaces; OVHcloud does not configure the guest.
- Failover / additional IPs - routed to your services and movable between them for high availability; the guest OS must own the address.
- Anti-DDoS - always on for OVHcloud public IPs, with scrubbing (VAC) during attacks; game-specific protection applies latency-tuned mitigation to game protocols.
- Edge Network Firewall - a per-IP filter managed from the control panel, useful in front of dedicated servers.
- Security groups - stateful OpenStack rules for Public Cloud instances and networks.
- Load Balancer and OVHcloud Connect - traffic distribution and private on-premises interconnection respectively.
Worked example
Two dedicated servers in different datacentres must share private traffic, and one public IP must follow the active node. The design is: attach both servers to the same vRack on the same VLAN for private traffic; order a failover IP and move it to the standby node during failover; open only required ports with the network firewall. Reasoning: private L2 → vRack; IP mobility → failover IP; exposure reduction → firewall. DNS TTL should be low if names are used.
Traps
vRack is not plug-and-play: interfaces and VLANs must be configured on both ends. Security groups do not protect dedicated servers. A failover IP that is moved but not configured in the OS is dead. Anti-DDoS mitigation can alter latency, which matters for real-time traffic.