Prices net plus 19% VAT. locations: 5.
The following sections go through each service individually. This table tells you in advance what each is intended for and where you stand — including the one service we do not yet offer.
| Building block | What for | Status | Entry |
|---|---|---|---|
| Uplink and backbone | Guaranteed connection of every system to our own fibre optic network. | available | 1 Gbit/s included |
| Connect | Dedicated port between your data centre and our network edge. | available | from 10 Gbit/s |
| Private network (vRack) | Layer 2 segment across location boundaries, without routing through the internet. | available | 1 Gbit/s included |
| VPC | Routed, multi-tenant network with custom subnets, routing tables and rule sets. | in preparation | not yet available |
| Gateway | Outbound address translation for systems without their own public address. | available | three size classes |
| Load Balancer | Distribution of incoming connections on Layer 4 and Layer 7. | available | per instance and month |
| DDoS protection | Volumetric filtering at the network edge, permanently active. | available | Basic protection included |
| CDN | Delivery via 42 locations at the network edge, all under one address. | available | by volume |
| IPv4 and IPv6 | Additional subnets, IPv6 at no extra charge, self-service reverse DNS. | available | 1 × IPv4 included |
| Floating IP | Public address that moves between systems without touching DNS. | available | bound without charge |
| Own address block (BYOIP) | Announcement of your own prefix via our AS number. | available | without charge |
The entry column states the smallest expansion stage, not the final price of a configuration. The amounts are listed in the respective section, net plus 19% VAT.
The locations are connected to a counter-rotating fibre optic ring. If one section fails, the opposite direction takes over — switching takes milliseconds, not a maintenance window.
Peering means two networks connect directly and hand over their traffic to each other, without a third party in between. Transit means a third-party provider accepts the traffic for a fee and carries it further, on routes they choose.
Direct interconnection is the shorter route and the one we can measure ourselves. However, it requires both sides to be at the same node and willing. Transit, on the other hand, reaches every network — even those nobody peers with.
Therefore both, and neither of the two routes alone.
Every location is connected via two physically separate routes that feed in on different sides of the building. The routes are documented on maps and checked for route overlap with every expansion.
Segment routing works in the ring with pre-calculated backup paths; the switching time is under 50 ms.
FRA1 – FRA2 – MUC1 – BER1 – HEL1 – FRA1
Around 72 percent of traffic leaves the network via direct peering, the rest via four independent transit providers. No provider may carry more than 40 percent of the transit volume.
Private interconnects are available from 10 Gbit/s, requests go through the peering contact in the PeeringDB entry.
94 interconnections · DE-CIX Frankfurt, DE-CIX Munich, BCIX Berlin, FICIX Helsinki
Every connection is guaranteed, not overbooked. From 10 Gbit/s, the connection is a dual-port with LACP — two ports bundled into one connection — on two separate switches, so a switch restart does not cause an interruption.
1 Gbit/s included, up to 25 Gbit/s available
| Option | Surcharge / month |
|---|---|
| 1 Gbit/s guaranteedStandardUnmetered within the included traffic. | included |
| 2 Gbit/s guaranteedDoubled uplink capacity, identical fair use policy. | €100.83$116.96 |
| 3 Gbit/s guaranteedBasic connection of the FORGE series, included in the plan. | €150.41$174.48 |
| 4 Gbit/s guaranteedFor delivering large files from a single location. | €200.83$232.96 |
| 5 Gbit/s guaranteedIntermediate level for streaming and mirror servers. | €250.41$290.48 |
| 10 Gbit/s guaranteedFor storage replication and media delivery. | €500.83$580.96 |
| 25 Gbit/s guaranteedDual-port connection with LACP to redundant switches. | €1,250.41$1,450.48 |
Latency — the time a packet takes for the round trip — is the median of a week, measured from DE-CIX Frankfurt against a reference host at the respective location. The capacity specification describes the occupancy of the installed floor space, not the network load. The price factor applies to the net base price of each product, before term discount and VAT apply.
| City | Description | Latency | Occupancy | Price factor | PUE |
|---|---|---|---|---|---|
| Frankfurt am Mainfra1 | Location Rhein-Main I | 3 ms | 71% | 1.00 × | 1.14 |
| Frankfurt am Mainfra2 | Location Rhein-Main II | 3 ms | 44% | 1.00 × | 1.09 |
| Berlinber1 | Location Spree | 6 ms | 58% | 1.00 × | 1.16 |
| Munichmuc1 | Location Isar | 5 ms | 82% | 1.00 × | 1.11 |
| Helsinkihel1 | Location Uusimaa | 21 ms | 36% | 0.94 × | 1.08 |
PUE — the ratio of the total power consumption of a data centre to that of its IT systems — is the annual average of the respective location. The price factor 1.00 designates the reference location Frankfurt am Main; all list prices apply there, net plus 19% VAT.
Connect attaches your data centre as a dedicated port to our network edge. The traffic then sees two networks — yours and ours — and not the twelve in between over which a tunnel runs through the open internet.
The port price corresponds to the surcharge for a guaranteed connection of the same speed; a dual-homed handover occupies the edge capacity twice and costs twice as much accordingly. Not included is the cross-connect in the meet-me room — the handover room of the data centre where network operators interconnect their lines. This is billed by the building operator, not us.
| Class | Optics | Configuration | Port / month |
|---|---|---|---|
| 10 Gbit/s | 10GBASE-LR, single-mode LC, 1310 nm | Single port. Maintenance on the edge router interrupts the link. | €500.83$580.96 |
| 2 × 10 Gbit/s | 2 × 10GBASE-LR, LACP | Two edge routers in separate fire zones, active/active. | €1,001.66$1,161.93 |
| 25 Gbit/s | 25GBASE-LR, single-mode LC, 1310 nm | Single port. For replication links with maintenance window. | €1,250.41$1,450.48 |
| 2 × 25 Gbit/s | 2 × 25GBASE-LR, LACP | Highest expansion stage, 50 Gbit/s total capacity. | €2,500.82$2,900.95 |
All amounts net, plus 19% VAT. minimum term 12 months, then cancel monthly. We do not offer Connect below 10 Gbit/s — there, an IPsec tunnel carries the same load at a fraction of the cost.
The cross-connect ends in the meet-me room of the respective location. From there, the link runs via two separate routes to two edge routers in different fire zones.
You reach all other locations via the same port: from the handover point, the traffic continues in our own backbone, not via transit.
3 locations with carrier-neutral meet-me room
| Property | Connect | IPsec over the internet |
|---|---|---|
| Route | Dedicated port on the edge router | Across any number of third-party networks |
| Packet latency | Guaranteed and measured | Dependent on the route of the day |
| Jitter | Under 0.2 ms | Single milliseconds to seconds |
| Throughput | Port speed, guaranteed | Remainder of the internet connection |
| Encryption | Optional, MACsec on the link | Mandatory, IPsec in the tunnel |
| Setup | 10 to 20 working days | Same day |
| Makes sense from | 10 Gbit/s continuous load | Any load below that |
A VPN is not a worse version of Connect, but the right answer to a different question. A dedicated port only pays off when latency and throughput must be contractually guaranteed.
Guaranteed are 2 ms packet latency on a monthly average to the edge router of the handover location and a packet loss of under 0.01 percent. For other locations, the backbone latency listed in the location table also applies.
The measurement runs every second against a reference point behind the port. The values are available in the customer account and are the same ones that result in a service credit under the Service Level Agreement.
Measured between handover port and edge router of the target region
After ordering, we will provide you with the port ID and the contact in the meet-me room. You order the cross-connect from the facility operator, we activate the port and test the link together with you for optical levels, MTU and LACP status before production traffic runs over it.
10 to 20 working days until the light signal
Servers, cloud instances and managed databases end up in the same broadcast segment — even if they are located in Frankfurt am Main, Berlin and Helsinki. The traffic never leaves the ENTRONYX CLOUD network.
| Option | Price / month |
|---|---|
| No private network | included |
| vRack 1 Gbit/sStandardIsolated Layer 2 network across all locations. | included |
| vRack 10 Gbit/sFor storage replication and database clusters. | €39.00$45.24 |
| vRack 25 Gbit/sDedicated fabric for HPC and hypervisor clusters. | €119.00$138.04 |
| vRack 50 Gbit/sFor distributed storage pools whose write path runs over the private network. | €219.83$255.00 |
| vRack 100 Gbit/sHighest expansion stage for clusters with synchronous replication between fire zones. | €421.49$488.93 |
All amounts net, plus 19% VAT.
Cluster software often expects a shared segment: Keepalived with VRRP, Proxmox-Corosync, database failover with a floating virtual IP. On a routed network, this only works with workarounds.
Technically, the vRack runs as a VXLAN overlay with EVPN: VXLAN encapsulates your Layer 2 frames into packets that travel through our routed network; EVPN distributes which address is at which location. What you see is a second network adapter in the system, unconfigured and without DHCP.
VXLAN with EVPN control plane
For storage replication and backups, the larger MTU — the maximum packet length a segment carries — brings measurable throughput because there are fewer packets and therefore fewer interrupts. Prerequisite: every system in the segment must have the same MTU.
A single host with 1500 bytes otherwise causes fragmentation and consequently hard-to-find timeouts. The MTU is therefore set per VLAN, not per system.
9000 byte MTU reduces overhead by about 4 percent
Instances in a private segment need to be able to fetch packages, renew certificates and send telemetry — without being accessible from the internet themselves. That is exactly what the gateway does: it translates outgoing connections to a shared public address and lets nothing in from the outside.
The class determines throughput and the number of concurrent translations. One translation corresponds to one connection: a build server pulling packages holds a few dozen, a crawler with a thousand targets holds correspondingly more. Switching between classes is seamless, as the state is transferred to the new pair.
| Class | Throughput | Concurrent translations | New per second | Price / month |
|---|---|---|---|---|
| Gateway S | 1 Gbit/s | 500,000 | 40,000 | €12.00$13.92 |
| Gateway M | 2 Gbit/s | 1,000,000 | 80,000 | €112.83$130.88 |
| Gateway L | 10 Gbit/s | 2,000,000 | 200,000 | €512.83$594.88 |
All amounts net, plus 19% VAT. The amount consists of the base fee for a managed network instance and the surcharge for the respective throughput class — the same as an uplink of the same speed costs. Outbound traffic via the gateway is not charged separately.
There is no port forwarding and no inbound rule. A connection from the outside finds no way back, because there is no entry for it in the translation table. If you need to be reachable inbound, use a Load Balancer or a public address on the system.
This makes the direction a property of the design and not a rule that someone accidentally reverses.
No forwarding from outside to inside
Each gateway runs as a pair. The translation table is continuously synchronised, so that existing connections survive a failover — they hang briefly instead of dropping. The public address does not migrate, it resides on the pair.
Maintenance work runs via the same failover: first the passive system, then the swap, then the second. A maintenance window is not required for this.
Active/passive across two fire zones · failover under 3 s
Because all systems behind the same gateway show the same source address, this single address can be provided to partners and added to access lists. The address is permanently assigned and does not change during a failover or when changing the size class.
A source address for allowlists
A load balancer can simultaneously pass through TCP ports and distribute HTTP requests by path. Both run on redundant hardware in at least two fire compartments.
Distributes TCP and UDP connections without looking into the content. The connection remains end-to-end encrypted, the load balancer only sees addresses and ports.
Terminates TLS, reads host and path and distributes accordingly. Headers can be set, removed and rewritten; redirects and rate limiting are part of the rule.
Checks are performed via TCP connection establishment or via HTTP request against a freely selectable path with an expected status range and its own host header. A backend is considered healthy after two successful checks and failed after three failed ones.
When removed, existing connections drain — 30 seconds by default, adjustable up to one hour. The backend no longer receives new requests from the first failed check.
Interval 2 to 60 s · standard 5 s
Certificates can be uploaded or automatically obtained and renewed via ACME — the protocol used by Let's Encrypt to issue certificates, for example. RSA-2048 and ECDSA P-256 are delivered in parallel per hostname, the client makes the selection via the cipher suite.
OCSP stapling is active — the server delivers the proof of validity of its certificate right away —, session tickets are rotated every six hours. On Layer 7, checking client certificates (mTLS) against a custom CA is also possible.
TLS 1.2 and 1.3 · up to 100 certificates per instance
A load balancer instance costs €12.00$13.92 per month. This includes the first forwarding rule, unlimited traffic and TLS termination. Each additional rule is billed by the hour at €0.0060$0.0070 per hour — this corresponds to €4.38$5.08 in an average month with 730 hours. Rules that you create during the day and remove again in the evening only cost the actual hours.
| Configuration | Base fee | Additional rules | Total / month |
|---|---|---|---|
| One rule (included) | €12.00$13.92 | none | €12.00$13.92 |
| 6 rules | €12.00$13.92 | €21.90$25.40 | €33.90$39.32 |
| 11 rules | €12.00$13.92 | €43.80$50.81 | €55.80$64.73 |
| 26 rules | €12.00$13.92 | €109.50$127.02 | €121.50$140.94 |
| 51 rules | €12.00$13.92 | €219.00$254.04 | €231.00$267.96 |
All amounts net, plus 19% VAT. The “Additional rules” column extrapolates the hourly rate to a full average month; billing is by the hour.
Filter capacity 1.2 Tbit/s — as much traffic as 48 systems with the largest bookable connection (25 Gbit/s) could generate together. At ENTRONYX CLOUD, the filtering runs permanently; it is not switched on.
Filter capacity 1.2 Tbit/s
Basic protection is included in every product and does not need to be switched on. It runs permanently, not just after a call to support.
Amplification attacks via DNS, NTP, memcached and SSDP, SYN and ACK floods, fragmented packets, attacks with spoofed source addresses. This class accounts for the vast majority of incidents.
Volumetric, Layer 3 and 4
Request floods against expensive endpoints, Slowloris — attacks that intentionally keep connections open —, distributed login attempts and attacks that behave like real users. These patterns cannot be cleanly separated volumetrically.
Layer 7 · from €49.00$56.84 per month, net
| Option | Price / month |
|---|---|
| Basic DDoS protectionStandardVolumetric filtering up to 1.2 Tbit/s. Included in every plan. | included |
| DDoS protection advancedLayer 7 analysis, behaviour patterns and individual mitigation rules. | €49.00$56.84 |
| DDoS protection gamingProtocol-specific filters for UDP game protocols with under 1 ms additional latency. | €89.00$103.24 |
All amounts net, plus 19% VAT.
A PoP is a delivery location at the network edge; Anycast means that all are accessible under the same IP address and every device ends up at the nearest one. One origin, one address, the same everywhere — routing is handled by the network and not a DNS trick waiting for expiring caches.
Rules apply to path patterns, file extensions, request methods, headers and query parameters. For each rule, you can define cache duration, handling of query strings, Vary headers and cookie forwarding.
Without a rule, the origin's Cache-Control applies. If this is also missing, nothing is cached — the CDN does not invent a shelf life.
Up to 100 rules per zone, evaluated from top to bottom
Invalidation can be done individually by URL, by prefix or via cache tags provided by the origin in the response header. A tag purge hits all objects with this tag, regardless of the path.
For deployments, the variant with tags is preferable: one call instead of a thousand URLs, and the counter stays low.
At all PoPs under 30 s · 5,000 requests per day
All PoPs fetch missing objects via an upstream intermediate layer. This typically reduces requests at the origin by 90 percent for a cold cache.
Stale-While-Revalidate — expired objects are delivered while the CDN renews them in the background — continues to deliver the last valid response for up to 24 hours in the event of an origin failure.
Origin Shield at a location of your choice
Billing is based on the volume that the PoPs deliver to end devices. Retrieval from the origin is included, as are TLS, HTTP/3 and invalidation. The scale is sliding: you pay the price of the respective tier reached for each terabyte.
| Volume tier | Price per TB | Example 50 TB | Note |
|---|---|---|---|
| First 10 TB | €9.90$11.48 | €495.00$574.20 | Entry tier, no minimum commitment |
| 10 to 100 TB | €7.40$8.58 | €370.00$429.20 | Automatically upon exceeding the first tier |
| 100 to 500 TB | €5.20$6.03 | €260.00$301.60 | Typical tier for media libraries |
| From 500 TB | €3.90$4.52 | €195.00$226.20 | Above this on request with annual commitment |
All amounts net, plus 19% VAT. The comparison column calculates all 50 TB at the respective tier price so that the tiers remain comparable. Actual billing is tiered: the first 10 TB at the first tier, the rest at the second.
Every system comes with one IPv4 address and a /64 IPv6 prefix. Additional IPv4 subnets are possible, but are subject to the allocation rules of the RIPE NCC, the address registry for Europe. Below are the two special cases: the address that moves between systems, and the block that belongs to you.
| Option | Price / month |
|---|---|
| 1 × IPv4 + /64 IPv6StandardStandard configuration, included in the price. | included |
| /30 subnet (4 × IPv4)2 additional usable addresses. | €6.00$6.96 |
| /29 subnet (8 × IPv4)6 additional usable addresses. | €14.00$16.24 |
| /28 subnet (16 × IPv4)14 additional usable addresses. | €27.00$31.32 |
| /27 subnet (32 × IPv4)Proof of use required30 usable addresses. Justification required according to RIPE policy. | €52.00$60.32 |
All amounts net, plus 19% VAT. · no setup fee
IPv4 addresses have been exhausted since 2019; the RIPE NCC only allocates from returned space. Therefore, we require evidence of use from a /27 — which services need which address and why a shared address is not sufficient.
The review usually takes one working day. Unused allocations are reclaimed after 60 days; this is not harassment, but a condition of our own allocation.
Evidence required from a /27
A /64 is enough for one segment, a /48 for an entire network with 65,536 segments. Both cost nothing. You set reverse DNS records — the name an address returns in a reverse lookup — yourself in the customer account, for both IPv4 and IPv6.
We announce your own address ranges via our AS number — evidence, process and deadlines can be found below under own address block.
/64 included, /48 on request
A Floating IP belongs to the account, not the system. It can be switched from one instance to another within a location — during failover, version upgrades or when a server is replaced. The detour via DNS is eliminated, and with it the waiting time that every cache between you and the caller extracts from a TTL — the validity period of a DNS record.
As long as the address is attached to a running system, it is its included IPv4 address and costs nothing extra. Only the reservation without usage is billed — the case where a scarce address is occupied without working.
| Status | What applies | Billing |
|---|---|---|
| Bound to a system | Counts as the included IPv4 address of this system. | without charge |
| Reserved, not bound | The address remains allocated to you and is not available to anyone else. | €0.0024$0.0028 / h€1.73$2.01 per month |
| 60 days without binding | The allocation is withdrawn after notification — the same rule as for unused subnets above. | not applicable |
All amounts net, plus 19% VAT. The hourly rate is derived from the IPv4 scale: €52.00$60.32 for a /27 with 30 usable addresses results in €1.73$2.01 per address and month, divided by 730 hours. Calculations are unrounded, rounding only occurs on output.
If you already hold your own address block, you can bring it with you. We announce it via AS204812; the addresses remain yours, the allocation remains with your registry. For access lists with partners, for reputation in email delivery and for every contract that contains an address, nothing changes when you move.
You put together uplink, vRack, gateway, Load Balancer, DDoS level and IPv4 subnet in the network configurator; the amounts there are the same as in the tables above. Connect and the announcement of your own address block do not go through the cart — both require a cross-connect or evidence and therefore a conversation.
