Your own route through the network
A private VPN endpoint for devices you control and traffic you understand.
Content revised · English
- Architecture to evaluate
- WireGuard / OpenVPN
- Prepared starting points
- 3 plans
- Responsibilities
- Application, rights and recovery
A fit shortlist, not installed software or live inventory.
Keep these in view.
- WireGuard / OpenVPN.
- Test the client’s privacy boundary.
- Give shared access a clear owner.
WireGuard / OpenVPN
WireGuard and OpenVPN provide different operational choices. Select a maintained configuration, separate each user’s credential and establish a route for revocation. Keep the administration channel reachable independently of the tunnel being tested.
Test the client’s privacy boundary
Check IPv4 and IPv6 routing, DNS resolution and behaviour when the VPN disconnects or the device reboots. A kill switch belongs to the client configuration and needs a test. Traffic that leaves the hosted endpoint still has a network path and legal context; a personal VPN is not a universal anonymity guarantee.
Give shared access a clear owner
When friends or colleagues share an exit, the operator must handle the resulting traffic and reports. A multi-region mesh needs explicit routing and access policies. Address rotation and migration are not connected actions in the current integration.
Define the privacy boundary
A VPN encrypts traffic between your device and the server. It shifts trust to the server and does not automatically hide your identity from websites, accounts or the hosting operator.
Size for concurrent use
Choose a region close enough for acceptable latency and estimate peak traffic, not just monthly transfer. CPU encryption performance, uplink capacity and the number of active devices all matter.
Manage access carefully
Use individual keys or profiles, restrict administrative ports and remove access when a device is lost. Monitor health without collecting more connection data than your purpose requires.
Capacity to consider.
Match these starting points to the representative application. Software installation and live inventory are not connected; the exact specification and period total come from the catalogue.
Umbra 1
Run a small Linux service on one AMD EPYC virtual CPU, 2 GB of ECC memory and 25 GB of NVMe storage with full root access on KVM. The configuration pairs a 1 Gbps port with 1 TB of monthly transfer, IPv4 and IPv6, and a 10 Gbps network mitigation tier.
- Compute
- 1 vCPU (AMD EPYC)
- Memory
- 2 GB DDR4 ECC
- Storage
- 25 GB NVMe SSD
- Transfer
- 1 TB / month
billed monthly
Umbra 2
Give web applications, containers or a private tunnel two AMD EPYC virtual CPUs, 4 GB of ECC memory and 60 GB of NVMe storage. Root access on KVM, a 1 Gbps port and 3 TB of monthly transfer provide more room than the entry configuration without moving to dedicated hardware.
- Compute
- 2 vCPU (AMD EPYC)
- Memory
- 4 GB DDR4 ECC
- Storage
- 60 GB NVMe SSD
- Transfer
- 3 TB / month
billed monthly
Umbra 4
Balance four AMD EPYC virtual CPUs and 8 GB of ECC memory with 120 GB of NVMe storage for several services or a growing application. This KVM configuration includes a weekly snapshot, 6 TB of monthly transfer on a 1 Gbps port and a 20 Gbps network mitigation tier.
- Compute
- 4 vCPU (AMD EPYC)
- Memory
- 8 GB DDR4 ECC
- Storage
- 120 GB NVMe SSD
- Transfer
- 6 TB / month
billed monthly
Before this workload goes live.
- Check the exact plan’s CPU, memory, disk, transfer and port.
- Choose a listed region and verify the workload’s permitted use.
- Test the representative application and an independent restore.
Questions, answered.
Does a VPS include a tested kill switch?
No. Routing, DNS-leak controls and disconnect behaviour belong to the chosen client/server configuration and need explicit tests.
Can I share the VPN with friends?
A shared exit makes the operator responsible for access and abuse handling. Give each user a revocable credential and check the proposed AUP before offering wider access.
Will the provider log no VPN traffic?
No zero-log operational claim is made for this catalogue. Review the future operator’s actual network and service retention, plus your own VPN logs.
Can I build a multi-region mesh?
It is an architecture to configure with compatible nodes, routing and access policy. Region selection does not automatically create a mesh or migrate addresses.
What is kept in my account workspace?
Your configuration, selected plan, image, location and billing term are kept with the order and payment request references. Quotes, payment-state reads and support conversations remain linked to your account. Read fulfilment details separately from payment status.