Network Security

Segmenting workloads takes direct control of the firewall and the VLAN layout. In KVPC, you write the edge firewall rules, define VLANs and subnets, and manage your own VPN connections. None of it is held back for a higher tier.

Common Network Security Bottlenecks

Firewall Changes That Wait in a Queue

When every rule change goes through a provider's ticket system, the firewall falls behind the workloads it protects. In KVPC, the edge firewall is yours: you add and change rules yourself.

Flat Networks

On a flat network, one compromised server can reach every other machine on it. KVPC lets you split workloads into VLANs with IDs you choose and isolated subnets, each behind firewall rules you set.

Exposed Remote Access

Publishing RDP or SSH on a public IP puts a login prompt in front of anyone scanning for it. With KVPC, administrators come in through VPN connections you manage, over IKEv2, OpenVPN, IPsec or WireGuard, and the public IP only exposes what your firewall rules allow.

Where Our Responsibility Ends and Yours Begins

Security on KASTERVO splits along a clear line. We operate the infrastructure: the hardware, the high-availability cluster and the platform, in a Digital Realty Tier 3 certified data center, with an underlay encrypted end to end. KASTERVO is PCI-DSS compliant as a Level 2 service provider. You own your environment: the firewall rules, the software on your servers and who has access to them.

How Traffic Reaches Your Workloads

One Way In: The Edge Firewall

Internet traffic to your public IP and traffic from your office over site-to-site VPN both enter through the edge firewall. From there, it routes traffic to your VLANs and compute instances, under your rules.

VLANs and Isolated Subnets

Behind the firewall, you decide the layout: which VLANs exist, which subnets sit on them, and how traffic is routed between them.

Websites on KPCH

If your website runs on KPCH, it includes Let's Encrypt SSL and TOTP two-factor sign-in, and Cloudflare CDN is available as an option.

In Practice

VLAN Numbering That Matches Yours

Use the same VLAN numbering plan as your existing network.
Private Database Segments

Keep database servers on an isolated subnet that only your application servers can reach.
EU Data Residency

Data in your KVPC stays in the EU under GDPR.
Backups with KEBS

Keep off-site copies of your Veeam backups in KEBS, billed separately from KVPC.