Activate and configure a Firewall for each Network Interface Card (NIC) to better protect your servers from attacks. IONOS Cloud Firewalls can filter incoming (ingress), outgoing (egress), or bidirectional traffic. When configuring firewalls, define appropriate rules to filter traffic accordingly.

Activate a Firewall

To activate a Firewall, follow these steps:

1. In the Workspace, select a Virtual Machine with a NIC.

2. From the Inspector pane, open the Network tab.

3. Open the properties of the NIC for which you want to set up a Firewall.

4. Choose either Ingress, Egress, or Bidirectional traffic flow type for which the Firewall needs to be activated.

Create a Firewall Rule

To create a Firewall rule, follow these steps:

1. In the Workspace, select a VM with a NIC.

2. From the Inspector pane, open the Network tab.

3. Open the properties of the NIC for which you wish to manages Firewall Rules.

4. Click Manage Rules.

5. Click Create Firewall Rule and choose from the following type of Firewall rules to add from the drop-down list:

• Transmission Control Protocol (TCP) Rule

• User Datagram Protocol (UDP) Rule

• Internet Control Message Protocol (ICMP) Rule

• ICMPv6 Rule

• Any Protocol

6. Enter values for the following in a Firewall rule:

• Name: Enter a name for the rule.

• Direction Choose the traffic direction between Ingress and Egress.

• Source MAC: Enter the Media Access Control (MAC) address to be passed through by the firewall.

• Source IP/CIDR: Enter the IP address to be passed through by the Firewall.

• Destination IP/CIDR: If you use virtual IP addresses on the same network interface, you can enter them here to allow access.

• Port Range Start: Set the first port of an entire port range.

• Port Range End: Set the last port of a port range or enter the port from Port Range Start if you only want this port to be allowed.

• ICMP Type: Enter the ICMP Type to be allowed. Example: 0 or 8 for echo requests (ping) or 30 for traceroutes.

• ICMP Code: Enter the ICMP Code to be allowed. Example: 0 for echo requests.

• IP Version: Select a version from the drop-down list. By default, it is Auto.

7. (Optional) You can add Firewall rules from an existing template by using Rules from Template. The Generic Webserver, Mailserver, Remote Access Linux, and Remote Access Windows are the types of Firewall rules you can add from the existing rules template.

8. Alternatively, you may import an existing rule set from the Clone Rules from other NIC.

9. Click Save to confirm creating a Firewall rule.

How-Tos

If you want to build a network using static IP addresses, IONOS Cloud offers you the option to reserve IPv4 addresses for a fee. You can reserve one or more addresses in an IP block using the DCD's IP Manager.

An IP address can only be used in the data center from the region where it was reserved. Therefore, if you need an IP address for your virtual data center in Karlsruhe, you should reserve the IP address there. Each IP address can only be used once, but different IP addresses from a block can be used in different networks, provided these networks are provisioned in the same region where the IP block is located.

Reserving and using IPv4 addresses is restricted to authorized users only. Contract owners and administrators may grant privileges to reserve IP addresses.

Reserve an IPv4 address

1. In the DCD, go to the Menu > Management > IP Management.

2. In the IP Manager, select + Reserve IPs.

3. Enter the following IP block information:

   • Name: Enter a name for the IP block.

   • Number of IPs: Enter the number of IPv4 addresses you want to reserve.

   • Region: Enter the location of the IONOS data center where you want your IPs to be available.

4. Confirm your entries by selecting Reserve IPs.

The number of IPs you have reserved are available as an IP block. The IP block details should now be visible on the right.

Return an IPv4 address

IP addresses cannot be returned individually, but only as a block and only when they are not in use.

Note: If you return a static IP address, you cannot reserve it again afterwards.

1. In the DCD, go to Menu > Management > IP Management.

2. Ensure the IPs you want to release are not in use.

3. Select the required IP block.

4. Select Delete to return the IP block to the pool.

5. Confirm your action by selecting OK.

The IP block and all IP addresses contained are released and removed from your IONOS Cloud account.

IONOS Cloud Networks enables IONOS virtual resources to securely communicate with each other, the internet, and on-premises networks. Our broad portfolio of networking products built using Software-Defined Networking (SDN) technology ensure customer workloads can scale and connect securely across both physical and virtual networks. Refer to our user guides, reference documentation, and FAQs to support your virtual networking needs.

Developer Tools

Recommended How-To's

Learn More

Setting up a private network

helps you connect the elements of your infrastructure and build a network to set up a functional virtual data center. Without a connected internet access element, your network is private.

The quickest way to connect elements is to drag them from the Palette directly onto elements that are already in the Workspace. The DCD will then show you whether and how the elements can be connected automatically.

1. Drag the elements from the Palette into the Workspace and connect them through their .

2. In the Workspace, select the required ; the Inspector will show its properties on the right.

3. From the Inspector pane, open the Network tab. Now you can access NIC properties.

4. Set NIC properties according to the following rules:

• MAC: The MAC address will be assigned automatically upon provisioning.

• Primary IP: The primary is automatically assigned by the IONOS DHCP server. You can, however, enter an IP address for manual assignment by selecting one of the reserved IPs from the drop-down menu. Private IP addresses (according to ) must be entered manually. The NIC has to be connected to the Internet.

• Failover: If you have an HA setup including a failover configuration on your VMs, you can create and manage IP failover groups that support your HA setup.

• Firewall: Configure a firewall.

• DHCP: It is often necessary to run a DHCP server in your virtual data center (e.g. PXE boot for fast rollout of VMs). If you use your own DHCP server, clear this check box so that your IPs are not reassigned by the IONOS DHCP server.

• Additional IPs: In order to use "floating" or virtual IPs, you can assign additional IPs to a NIC by selecting them from the drop-down menu.

When ready, provision your changes. The will create a private network according to set properties.

Splitting LANs

1. To split a LAN, select the required LAN in the Workspace.

2. In the Inspector, open the Actions menu and select Split LAN.

3. Confirm by clicking Split LAN.

4. Make further changes to your data center and provision your changes when ready.

The selected LAN is split and new IPs are assigned to the NICs in the new LAN.

Merging LANs

1. To merge a LAN, select the required LAN in the Workspace.

2. To integrate this LAN into another LAN.

3. In the Inspector, open the Actions menu and select Merge LAN with another LAN.

4. In the dialog that appears, select the LANs to be merged with the selected LAN.

5. Select the checkboxes of the LANs you wish to keep separate.

6. Confirm by clicking Merge LANs.

(Optional) Make further changes to your data center.

7. Provision your changes

The selected LANs are merged and new IPs are assigned to the NICs in the newly integrated LAN.

Adding Internet access

Users who do not have the permissions to add a new internet access element, can connect to an existing element in their VDC, provided they have the permissions to edit it.

1. To add internet access, drag the Internet element from the Palette onto the Workspace.

2. Connect this element with Servers.

3. Set further properties of the connection at the respective NIC.

The DCD helps you interconnect the elements of your infrastructure and build a network to set up a functional VDC. Virtual networks work just like normal physical networks. Transmitted data is completely isolated from other subnets and cannot be intercepted by other users.

You cannot find any switches in the DCD by design. Switching, routing, and forwarding functionality is deeply integrated into our network stack, which means we are responsible for distributing your traffic. If you wish to route from one of your private networks to the next by means of a virtual machine(VM), the VM must be configured accordingly, and the routing table adjusted.

IP settings: By default, IP addresses are assigned by our DHCP server. You can also assign IP addresses yourself. MAC addresses cannot be modified.

Firewall: In order to protect your network against unauthorized access or attacks from the Internet, you can activate the firewall for each NIC. By default, this will block all traffic, and you need to configure the rules to specify what traffic can pass through. Ingress, Egress and Bidirectional firewalls are supported. For TCP, UDP, ICMP and ICMPv6 protocols, you can specify rules for individual source or target IPs.

Network Interface Cards

IONOS Cloud allows virtual entities to be equipped with network cards (“network interface cards”; NICs). Only by using these virtual network interface cards, it is possible to connect multiple virtual entities together and/or to the Internet.

The maximum external throughput may only be achieved with a corresponding upstream of the provider.

Compatibility

• The use of virtual MAC addresses and/or the changing of the MAC address of a network adapter is not supported. Among others, this limitation also applies to the use of CARP (Common Address Redundancy Protocol).

• Gratuitous ARP (RFC 826) is supported.

• Virtual Router Redundancy Protocol (VRRP) is supported based on gratuitous ARP. For VRRP to work IP failover groups must be configured.

External Network

Depending on the location, different capacities for transmitting data to or from the Internet are available for operating the IONOS Cloud service. Due to the direct connection between the data centers at the German locations, the upstream can be used across locations.

The total capacities of the respective locations are described below:

IONOS backbone AS-8560, to which IONOS Cloud is redundantly connected, has a high-quality edge capacity of 1.100 Gbps with 2.800 IPv4/IPv6 peering sessions, available in the following Internet and peering exchange points: AMS-IX, BW-IX, DE-CIX, ECIX, Equinix, FranceIX, KCIX, LINX.

Internal Network

IONOS Cloud operates redundant networks at each location. All networks are operated using the latest components from brand manufacturers with connections up to 100 Gbps.

IONOS Cloud uses high-speed networks based on InfiniBand technology both for connecting the central storage systems and for handling internal data connections between customer servers.

Core Network

IONOS Cloud operates a high availability core network at each location for the redundant connection of the product platform. All services provided by IONOS Cloud are connected to the Internet via this core network.

The core network consists exclusively of devices from brand manufacturers. The network connections are completed via an optical transmission network, which, by use of advanced technologies, can provide transmission capacities of several hundred gigabits per second. Connection to important Internet locations in Europe and America guarantees the customer an optimal connection at all times.

Data is not forwarded to third countries. At the customer’s explicit request, the customer can opt for support in a data center in a third country. In the interests of guaranteeing a suitable data protection level, this requires a separate agreement (within the meaning of article 44-50 DSGVO and §§ 78 ff. BDSG 2018).

IP Address Management

IONOS Cloud provides the customer with public IP addresses that, depending on the intended use, can be booked either permanently or for the duration for which a server exists. These IP addresses provided by IONOS Cloud are only needed if connections are to be established over the internet. Internally, VMs can be freely networked. For this, IONOS Cloud offers a DHCP server that allows assignment of IP addresses. However, one can establish one’s own addressing scheme.

See also: Reserve an IP Address

Public IPv4 Addresses

Every virtual network interface card that is connected to the internet is automatically assigned a public IPv4 address by DHCP. This IPv4 address is dynamic, meaning it can change while the server is operational or in the case of a restart.

Customers can reserve static public IPv4 addresses for a fee. These reserved IPv4 addresses can be assigned to a virtual network interface card, which is connected to the internet, as primary or additional IP addresses.

Private IPv4 Addresses

In networks that are not connected to the Internet, each virtual network interface card is automatically assigned a private IPv4 address. This is assigned by the DHCP service. These IPv4 addresses are assigned statically to the MAC addresses of the virtual network interface cards.

The use of the IP address assignment can be enabled or disabled for each network interface card. Any private IPv4 addresses pursuant to RFC 1918 can be used in private networks.

Public IPv6 Addresses

By default, every VDC is assigned a public /56 IPv6 CIDR block. Customers can choose to enable IPv6 in a LAN as per their needs and a maximum of 256 IPv6 enabled LANs can be created per VDC. On enabling IPv6 in a LAN, the customer can either select a /64 IPv6 CIDR block from the /56 IPv6 CIDR block assigned to the VDC or have a /64 block automatically assigned to the LAN. Public IPv6 addresses are assigned to both private and public LANs.

Every connected virtual NIC is then assigned a /80 IPv6 CIDR block and a single /128 IPv6 address either automatically, or the customer can also select both. The /80 and /128 address must both be assigned from the /64 IPv6 CIDR block assigned to the corresponding LAN. The first public IPv6 address is assigned by DHCP and in total a maximum of 50 IPv6 addresses can be assigned per NIC. IPv6 addresses are static, meaning they remain assigned in the case of a VM restart.

DDoS Protect

IONOS DDoS Protect is a managed Distributed Denial of Service defense mechanism, which ensures that every customer resource hosted on IONOS Cloud is secure and resilient against Layer 3 and Layer 4 DDoS attacks. This is facilitated by a filtering and scrubbing technology, which in event detection of an attack filters the malicious DDoS traffic and lets through only the genuine traffic to its original destination. Hence, enabling applications and services of our customers to remain available under a DDoS attack.

Known attack vectors regularly evolve and new attack methods are added. IONOS Cloud monitors this evolution and dedicates resources to adapt and enhance DDoS Protect as much as possible to capture and mitigate the threat.

The service is available in all of our data centers.

The service is available in two packages:

DDoS Protect Basic: This package is enabled by default for all customers and does not require any configuration. It provides basic DDoS Protection for every resource on IONOS Cloud from common volumetric and protocol attacks and has the following features:

• DDoS traffic filtering - All suspicious traffic is redirected to the filtering platform where the DDoS traffic is filtered and the genuine traffic is allowed to the original destination.

• Always-On attack detection - The service is always on by default for all customers and does not require any added configuration or subscription.

• Automatic Containment - Each time an attack is identified the system automatically triggers the containment of the DDoS attack by activating the DDoS traffic and letting through only genuine traffic.

• Protect against common Layer 3 and 4 attacks - This service protects every resource on IONOS Cloud from common volumetric and protocol attacks in the Network and Transport Layer such as UDP, SYN floods, etc.

DDoS Protect Advanced: This package offers everything that's part of the DDoS Protect Basic package plus advanced security measures and support.

• 24/7 DDoS Expert Support - Customers have 24/7 access to IONOS Cloud DDoS expert support. The team is available to assist customers with their concerns regarding ongoing DDoS attacks or any related issues.

• Proactive Support - The IONOS Cloud DDoS support team, equipped with alarms, will proactively respond to a DDoS attack directed towards a customer's resources and also notify the customer in such an event.

• On-demand IP specific DDoS filtering - If a customer suspects or anticipates a DDoS attack at any point in time, he can request to enable DDoS filtering for a specific IP or server owned by him. Once enabled, all traffic directed to that IP will be redirected to the IONOS Cloud filtering platform where DDoS traffic will be filtered and genuine traffic will be passed to the original destination.

• On-demand Attack Diagnosis - At the customer's request, a detailed report of a DDoS attack is sent to the customer, explaining the attack and other relevant details.

Managing IP Failover groups

To make sure that high-availability (HA) or setups on your are effective in case of events such as a physical server failure, you should set up "IP failover groups".

They are essential to all HA or fail-over setups irrespective of the mechanism or protocol used.

A failover group is characterized by the following components:

• Members: The same (reserved, public) is assigned to all members of an IP failover group so that communication within this group can continue in the event of a failure. You can set up multiple IP failover groups. A can be a member of multiple IP failover groups. Dedicated Core Servers should be spread over different . The rules for managing the traffic between your VMs in event of a failure are specified at the operating system level using the options and features for setting up high-availability or fail-over configurations. Users must have access rights for the IPs they wish to use.

• Master: During the initial provisioning, the master of an IP failover group in the DCD represents the master of the HA setup on your virtual machines. If you change the master later, you won't have to change the master of the IP failover group in the DCD.

• Primary IP address: The IP address of the IP failover group can be provisioned as the primary or additional IP address. We recommend that you provide the IP address used for the IP failover group as the primary IP address, as it is used to calculate the gateway IP, which is advantageous for some backup solutions. Please note that this will replace the previously provisioned primary IP address. When there are multiple IP failover groups in a LAN, a involved in multiple of these groups can only be used once for the primary IP address. The DCD will alert you accordingly.

Limitations and restrictions

For technical reasons this feature can only be used subject to the following limitations:

• In public LANs that do not contain load balancers.

• With reserved public IP addresses only - DHCP-generated IP addresses cannot be used.

• Virtual MAC addresses are not supported.

• IP failover must be configured for all HA setups.

Creating an IP Failover Group

1. In the Workspace, select the required LAN.

2. In the Inspector, open the IP Failover tab.

3. Click Create Group. In the dialog box that appears, select the IP address from the IP drop-down menu.

Select the NICs that you wish to include in the IP failover group by selecting their respective checkboxes.

Select the Primary IP checkboxes for all NICs for which the selected address is to be the primary IP address.

The primary IP address previously assigned to a NIC in another IP failover group is replaced.

Select the master of the group by clicking the respective radio button.

4. Click Create.

5. Provision your changes.

The IP failover group is now available.

Editing an IP failover group

1. Click the IP address of the required IP failover group.

2. The properties of the selected group are displayed.

3. To change the IP address, click Change.

4. In the dialog box that appears, select a new IP address.

(Optional) If no IP address is available, reserve a new one by clicking +.

5. Specify the primary IP address by selecting the respective check box.

6. Confirm your changes by clicking Change IP.

7. To Change Master, select the new Master by clicking the respective radio button.

8. To add or remove members Click Manage.

9. Select or clear the checkboxes of the required NICs.

10. Confirm your changes by clicking Update Group.

Deleting an IP Failover Group

1. Click the IP address of the required failover group.

2. The properties of the selected IP failover group are displayed.

3. Click Remove. Confirm your action by clicking OK.

4. Provision your changes

The IP failover group is no longer available. The DCD no longer maps your HA setup.

The information and assistance available in this category make it easier for you to work with flow logs using the (DCD). For the time being, you have the option of doing either of the following.

Create a flow log

You can create flow logs for your network interfaces as well as the public interfaces of the Network Load Balancer and Network Address Translation () Gateway. Flow logs can publish data to your buckets in the .

After you have created and configured your bucket in the IONOS S3 Object Storage, you can create flow logs for your network interfaces.

Prerequisites

Before you create a flow log, make sure that you meet the following prerequisites:

• You are logged on to the .

• You are the .

• You have to edit the required data center.

• You have the privilege.

• You are the owner or have write access to permissions of an .

• You have an IONOS S3 Object Storage instance with a bucket that exists for your flow logs. To create an IONOS S3 Object Storage bucket, see .

Procedure

Select the appropriate tab for the instance or interface for which you want to activate flow logs in the workspace.

A flow log record is a record of a network flow in your virtual data center (). By default, each record captures a network internet protocol (IP) traffic flow, groups it, and is enhanced with the following information:

• Account ID of the resource

• Unique identifier of the network interface

• The flow's status, indicating whether it was accepted or rejected by the software-defined networking (SDN) layer

The flow log record is in the following format:

Available Fields

The following table describes all of the available fields for a flow log record.

Flow log record example

Accepted record

In this example, traffic to the network interface 7ffd6527-ce80-4e57-a949-f9a45824ebe2 for the account 12345678 was accepted.

Rejected record

In this example, traffic to the network interface 7ffd6527-ce80-4e57-a949-f9a45824ebe2 for the account 12345678 was rejected.

Overview

Machines use IP addresses to communicate over a network, and IONOS has introduced Internet Protocol version 6 (IPv6) to its compute instances, offering a significantly larger pool of unique addresses. This upgrade enables support for the ever-growing number of connected devices.

At IONOS, we recognize the significance of IPv6 configuration in virtual environments and offer a flexible and scalable infrastructure that accommodates IPv6 configuration, allowing our customers to take advantage of the latest features.

One of the primary requirements is to ensure that VMs in the VDC can access services on the internet over IPv6. IONOS allows you to do the necessary provisions to provide seamless service access.

In addition to being a client to an IPv6 service, a Virtual Machine (VM) in the IONOS Virtual Data Center (VDC) can provide a service, such as a simple REST API, over IPv6. In this case, it is essential to ensure that the IPv6 address assigned to the VM is static. If DHCPv6 is enabled, the NICs can receive their static IPv6 address(es) using DHCPv6. You do not need to log in every server and hardcode the IPv6 address. A Network Interface Card (NIC) has a Media Access Control address (MAC) and it sends a DHCPv6-Discover request to every user asking for a configuration for its MAC address. DHCPv6 shares configuration information with NIC, containing the IPv6 address. Our DHCPv6 has the information on which MAC address gets which IPv6 address(es). This is a critical requirement to allow you to access the service continuously, without any interruptions.

Concepts

IONOS supports the internet standard IPv6. Following are a few concepts associated with it:

• IPv6 or Internet Protocol version 6, is the most recent version of the Internet Protocol (IP) that provides a new generation of addressing and routing capabilities. The IPv6 is designed to replace the older IPv4 protocol, which is limited in its available address space.

• IPv6 uses 128-bit addresses, providing an almost limitless number of unique addresses. This allows for a much larger number of devices to be connected to the Internet.

• IPv6 defines several types of addresses, including unicast, multicast, and anycast addresses. Unicast addresses identify a single interface on a device, multicast addresses identify a group of devices, and anycast addresses identify a group of interfaces that can respond to a packet.

• IPv6 addresses are divided into two parts: a prefix and an interface identifier. The prefix is used for routing and can be assigned by an Internet Service Provider (ISP) or network administrator, while the interface identifier is typically generated by the device.

• As IPv6 adoption continues, transition mechanisms are used to ensure compatibility between IPv6 and IPv4 networks. These mechanisms include dual-stack, tunneling, and translation methods. For more information about IPv6 see our latest blog on IPv6: Everything about the New Internet Standard.

Overview

Use the Flow logs feature to capture data that is related to IPv4 and IPv6 network traffic flows. Flow logs can be enabled for each network interface of a Virtual Machine (VM) instance, as well as the public interfaces of the Network Load Balancer (NLB) and Network Address Translation (NAT) Gateway.

Flow logs can help you with a number of tasks such as:

• Debugging connectivity and security issues

• Monitoring network throughput and performance

• Logging data to ensure that firewall rules are working as expected

Flow logs are stored in a customer’s IONOS S3 Object Storage bucket, which you configure when you create a flow log collector.

Network traffic flows

A network traffic flow is a sequence of packets sent from a specific source to a specific unicast, anycast, or multicast destination. A flow could be made up of all packets in a specific transport connection or a media stream. However, a flow is not always mapped to a transport connection one-to-one.

A flow consists of the following network information:

• Source IP address

• Destination IP address

• Source port

• Destination port

• Internet protocol

• Number of packets

• Bytes

• Capture start time

• Capture end time

Flow log basics

Core concepts

• Flow log data for a monitored network interface is stored as flow log records, which are log events containing fields that describe the traffic flow. For more information, see Flow Log Record.

• Flow log records are written to flow logs, which are then stored in a user-defined IONOS S3 Object Storage bucket from where they can be accessed.

• You can export, process, analyze, and visualize flow logs using tools, such as Security Information and Event Management (SIEM) systems, Intrusion Detection Systems (IDS), Cyberduck, Logstash, etc.

• Traffic flows in your network are captured in accordance with the defined rules.

• Flow logs are collected at a 10-minute rotation interval and have no impact on customer resources or network performance. Statistics about a traffic flow are collected and aggregated during this time period to create a flow log record.

• The flow log file's name is prefixed with an optional object prefix, followed by a Unix timestamp and the file extension .log.gz, for example, flowlogs/webserver01-1629810635.log.gz.

• Flow logs are retained in the IONOS S3 Object Storage bucket until they are manually deleted. Alternatively, you can configure objects to be deleted automatically after a predefined time period using a Lifecycle Policy for an object in the IONOS S3 Object Storage.

• The IONOS S3 Object Storage owner of the object is an IONOS internal technical user named flowlogs@cloud.ionos.com (Canonical ID 31721881|65b95d54-8b1b-459c-9d46-364296d9beaf).

Limitations

To use flow logs, you need to be aware of the following limitations:

• You can't change the configuration of a flow log or the flow log record format after it's been created. In the flow log record, for example, you can't add or remove fields. Instead, delete the flow log and create a new one with the necessary settings.

• There is a limit of one flow log created per NIC, NAT Gateway, and Network Load Balancer.

A Virtual Data Center (VDC) is a collection of cloud resources for creating an enterprise-grade IT infrastructure. A Local Area Network (LAN) in a VDC refers to the interconnected network of Virtual Machines (VMs) within a single physical server or cluster of servers. The LAN in a VDC is a critical component of cloud computing infrastructure that enables efficient and secure communication between VMs and other resources within the data center.

VDC operates in a dual-stack mode that is, the Network Interface Cards (NICs) can communicate over IPv4, IPv6, or both. In Data Center Designer (DCD), IPv6 can be enabled for both Private and Public LANs, but on provisioning, only Public IPv6 addresses are allocated to all LANs.

• One limitation of IPv6 is that a /56 block is typically assigned to a data center, with a /64 block assigned inside this /56 block to the Local Area Network (LAN). The difference between a /56 and a /64 block is 8, resulting in 2^8 (2 to the power of 8) blocks, or a total of 256 blocks. This limitation can impact the scalability and flexibility of IPv6 addressing in large networks. Therefore, it is important to carefully consider the allocation of IPv6 blocks to ensure efficient utilization of available resources.

• You will get a new /56 prefix every time you create a new data center. If your services depend on static IPv6 addresses, and you want to rebuild your data center, you must not delete the data center itself, but only its components, such as, LANs, NICs, etc. For more information about how to create new Data Center LANs in DCD, see DCD How-Tos.

• For older Debian images (version 10 and version 11), you may need to tweak the OS initialization process of your image. For example, the Dynamic Host Configuration Protocol version 6 (DHCPv6) client may need to be run manually after restarting the system. Generally, if the interfaces have not received an IPv6 address from the IONOS DHCP server, try to run the DHCPv6 client manually. For more information, see FAQs.

• In Rocky Linux 8, it is important to note that the IPv6 protocol may not be readily available after the initial boot. For the latest version, Rocky Linux 9.0, you can use IPv6 support right from the first boot.

• Currently, IPv6 is not available for Managed Services such as Application Load Balancer (ALB), Network Load Balancer (NLB), Network Address Translation (NAT) Gateway, IP Failover and Managed Kubernetes (MK8s).

To enable IPv6 for Local Area Network (LAN) in the Data Center Designer (DCD), follow these steps:

1. Drag the Server element from the Palette onto the Workspace. The created server is automatically highlighted in turquoise. The Inspector pane allows you to configure the properties of this individual server instance.

2. Drop the internet element onto the Workspace, and connect it to a LAN to provide internet access. First, connect the server or cube to the internet and then to the Local Area Network (LAN).

   Note: Upon provisioning, the data centre will be allocated a /56 network prefix by default.

1. By default, every new LAN has IPv6 addressing disabled. Select the checkbox Activate IPv6 for this LAN in LAN view.

1. In the Inspector pane, configure your LAN device in the Network tab. Provide the following details:

   • Name: Your choice is recommended to be unique to this Virtual Data Center (VDC).

   • MAC: The Media Access Control (MAC) address will be assigned automatically upon provisioning.

   • LAN: Select a LAN for which you want to configure the network.

   • Firewall: To activate the firewall, choose between Ingress / Egress / Bidirectional.

   • IPv4 Configuration: Provide the following details:

     • Primary IP: The primary IP address is automatically assigned by the IONOS DHCP server. You can, however, enter an IP address for manual assignment by selecting one of the reserved IPs from the drop-down list. Private IP addresses should be entered manually. The Network Interface Controller (NIC) has to be connected to the Internet.

     • Failover: If you have an HA setup including a failover configuration on your VMs, you can create and manage IP failover groups that support your High Availability (HA) setup.

     • Firewall: Configure the firewall.

     • DHCP: It is often necessary to run a Dynamic Host Configuration Protocol (DHCP) server in your VDC (e.g. Preboot Execution Environment (PXE) boot for fast rollout of VMs). If you use your own DHCP server, clear this checkbox so that your IPs are not reassigned by the IONOS DHCP server.

     • Add IP: In order to use "floating" or virtual IPs, you can assign additional IPs to a NIC by selecting them from the drop-down menu.

   • IPv6 Configuration: Provide the following details:

     • NIC IPv6 CIDR: You can populate an IPv6 CIDR block with prefix length /80 or allow it to be automatically assigned from the VDCs allocated range, by selecting PROVISION CHANGES. You can also choose 1 or more individual /128 IPs. Only the first IP is automatically allocated. The remaining IPs can be assigned as per your requirement. The maximum number of IPv6 IPs that can be allocated per NIC is 50.

     • DHCPv6: It is often necessary to run your own DHCPv6 server in your Virtual Data Center (VDC) (e.g. PXE boot for fast rollout of VMs). If you use your own DHCPv6 server, clear this checkbox so that your IPs are not reassigned by the IONOS DHCPv6 server.

     • Add IP: In order to use "floating" or virtual IPs, you can assign additional IPs to a NIC by selecting them from the drop-down menu.
2. Start the provisioning process by clicking PROVISION CHANGES in the Inspector.

The Virtual Data Center (VDC) is provisioned with the new network settings.

You can enable the IPv6 LAN and configure the network to support IPv6. Using IPv6 LANs, devices can communicate on the same LAN using standard IPv6 protocols. IONOS LANs route packets between devices and networks, ensuring that the network runs smoothly and effectively.

Quicklinks

To update IPv6 configurations for LANs in the Data Center Designer (DCD), follow these steps:

1. Select the LAN you want to update IPv6 for.

2. You can update your IPv6 CIDR block with prefix length /64 from the VDCs allocated range.

3. Start provisioning by clicking PROVISION CHANGES in the Inspector pane.

The Virtual Data Center (VDC) will now be provisioned with the new network settings. In this case, the existing configuration gets reprovisioned accordingly.

To disable IPv6 for LANs in the Data Center Designer (DCD), follow these steps:

1. Select the LAN you want to disable IPv6 for, and clear the Activate IPV6 for this LAN checkbox.

2. Start provisioning by clicking PROVISION CHANGES in the Inspector pane.

The Virtual Data Center (VDC) is provisioned with the new network settings. On disabling IPv6 on a LAN, existing IPv6 configuration on the Network Interface Card (NICs) will be removed or deleted.

1. How do I configure IPv6 on my network?

   IPv6 can be configured via the Data Center Designer (DCD) or Cloud API using IPv6-enabled LAN. You can get IPv6 support by configuring the network. For more information about how to enable IPv6 on Virtual Data Center LANs in DCD, see .

2. Why do we need IPv6 configuration in DCD?

   The main reason for the transition to IPv6 is the exhaustion of available IPv4 addresses due to the exponential growth of the internet and the increasing number of devices connected to it.

3. If I use private images, do I need to adapt them in any way so that they support IONOS IPv6?

   For older versions of some images like Debian, you may need to tweak the OS initialization process of your image. For example, the Dynamic Host Configuration Protocol version 6 (DHCPv6) client may need to be run manually after the system boot. Generally, if the interfaces have not received an IPv6 address from the IONOS Dynamic Host Configuration Protocol (DHCP) server, try to run the dhcp6 client manually.

   This is because the client device may have cached the previous configuration information and needs to clear it before applying the new one. However, not all DHCPv6 implementations require a manual restart, as some may be able to automatically apply the new configuration without any intervention.

How do I set up a firewall?

For every network interface, you can activate a firewall, which will block all incoming traffic by default. You must specify the rules that define which protocols will pass through the firewall, and which ports are enabled. For instructions on how to set up a firewall, see Configure a Firewall.

How does the IONOS firewall work?

The IONOS firewall offered in the DCD can be used for simple protection for THE hosts behind it. Once activated, all incoming traffic is blocked. The traffic can only pass through the ports that are explicitly enabled. Outgoing traffic is generally permitted. We recommend that you set up your firewall VM, even for small networks. There are many cost-free options, including IP tables for Linux, pfSense FreeBSD, and various solutions for Windows.

See also: Activating a Firewall

Do you have a DNS resolver?

Yes, there are DNS resolvers. Valid everywhere IP addresses for 1&1 resolvers are:

212.227.123.16

212.227.123.17

2001: 8d8: fe: 53: 72ec :: 1

2001: 8d8: fe: 53: 72ec :: 2

How do I create reverse DNS entries?

Reverse DNS entries for IPv4 addresses can be created with IONOS Cloud DNS. For instructions on how to create reverse DNS entries, see Create and manage a Reverse DNS Entry. To create a reverse DNS entry for IPv6 addresses, please contact IONOS Cloud Support.

What is the IP address of my new server?

Once a server has been provisioned, you can find its IP address by following the procedure below:

• Open VDC

• Select the server, for which you wish to know the IP

• Select the Network tab in the Inspector

• Open the properties of the NIC

  The IPv4 and IPv6 addresses are listed in the Primary IP field.

See also: Reserve an IP Address

How can I connect multiple servers to the Internet?

The internet access element can connect to more than one server. Simply add multiple virtual machines to provide them all with internet access.

How can I get additional IPs for my server?

Users with the appropriate privileges can reserve and release additional IP addresses. Additional addresses are made available as part of a reserved consecutive IP block. For IPv6, you can add up to 50 addresses without any reservation.

See also: Reserve an IP address

How are IPs assigned by DHCP?

The public IP address assigned by DHCP will remain with your server. The IP address, however, may change when you deallocate your VM (power stop) or remove the network interface. We, therefore, recommend assigning reserved IPs when static IPs are required, such as for web servers. IPv6 addresses are not removed on deallocating your VM.

Can I use my own DHCP server?

Yes, you can. To make sure that a network interface will be addressed from your own DHCP server, perform the following steps:

• Open your data center

• Select the NIC

• Open the properties of the NIC in the Inspector

• Clear the DHCP check box

  This will disable the allocation of IPs to this NIC by IONOS DHCP, and then you can use your own DHCP server to allocate information for this interface.

How do I set up DHCP during a Linux installation?

We preset the subnet mask 255.255.255.255 for the DHCP allocation of public IPs. Unfortunately, this is not supported by all DHCP clients. You can perform network configuration at the operating system level or specify the netmask 255.255.255.0 using a configuration file.

How do I assign an IP address to a Linux server manually if DHCP fails?

DHCP configurations may fail during the installation of Linux distributions that do not support /32 subnet mask configurations. If this happens, the IP address can be assigned manually using the Remote Console.

Example

Network interface "eth0" is being assigned P address "46.16.73.50" and subnet mask "/24" ("255.255.255.0"). For the internet access to work, the IP address of the gateway (which is "46.16.73.1" in this example) must also be specified.

• Command-line:

  ifconfig eth0 46.16.73.50 netmask 255.255.255.0

  route add default gw 46.16.73.1

• Config file:

  Modify the "interface" file in the "/etc/networking/" folder as follows:

  # This file describes the network interfaces available on your system

  # and how to activate them. For more information, see interfaces(5).

  # The loopback network interface

  auto lo

  iface lo inet loopback

  # The primary network interface

  allow-hotplug eth0

  iface eth0 inet static

  address 46.16.73.50

  netmask 255.255.255.0

  gateway 46.16.73.1

• Restart the interfaces:

  ifdown eth0

  ifup eth0

Which IP versions are supported?

We support both IPv4 and IPv6 versions.

What is the maximum bandwidth of your data centers?

Our data centers are connected as follows:

Data center Bandwidth

What should I do if the network does not work?

First, attempt to log on to the VM with the Remote Console. If this is successful, please collect the information we will need to help you resolve the issue as described below.

We will need to know the following:

• VM name

• IP address

• URLs of web applications running on your VM

We will need the output of the following commands:

Windows

• ping Hostname

• date /t

• time /t

• route print

• ipconfig /all

• netstat

• netstat -e

• route print or netstat -r

• tracert and ping in/out

• nslookup hostname DNS-Server

• nslookup hostname DNS-Server

Linux

• date

• traceroute

• ping Hostname

The output of the following commands can also give important clues:

• arp -n

• ip address list

• ip route show

• ip neighbour show

• iptables --list --numeric --verbose

• cat /etc/sysconfig/network-scrips/ifcfg-eth*

• cat /etc/network/interfaces

• cat /etc/resolv.conf

• netstat tcp --udp --numeric -a

Script (for Linux-based VMs)

We have prepared a ready-made script that helps gather the relevant information. The script provides both screen output and a log file which you can forward to us.

What should I do if the Remote Console does not work?

If you are using the Java-based edition of the Remote Console, please ensure that you have the latest Java version installed and the following ports released:

• 80 (HTTP),

• 443 (HTTPS),

• 5900 (VNC).

The Remote Console becomes available immediately once the server is provisioned.

Is there a detailed traffic overview available?

There is no traffic overview screen in the user interface currently.

Customers can use either Traffic or Utilization endpoints of the Billing API to get details about their traffic usage.

Traffic

curl -X GET "https://api.ionos.com/billing/:contract/traffic/?output=all" -H "accept: application/json" -H "Authorization: Basic ******"

Utilization

curl -X GET "https://api.ionos.com/billing/:contract/utilization/?type=TRAFFIC" -H "accept: application/json" -H "Authorization: Basic ******"

More information in Swagger: https://api.ionos.com/billing/doc/

How can I configure VirtIO settings in Windows?

Please use the configuration below to ensure the stability and performance of the network connections on the operating system side. We suggest that you first check the current settings to see if any adjustments are necessary.

How to verify the current network configuration

1. Open Device Manager

2. Open the network adapter section where you can see all your connected virtual network cards named “Red Hat VirtIO Ethernet Adapter”. Now open the Properties dialog and go to the “Advanced” tab.

3. Verify that your settings match those listed below; if not, follow the guidelines later in this guide to update them accordingly.

   • "Init.MTUSize"="1500"

   • "IPv4 Checksum Offload"="Rx & Tx Enabled"

   • "Large Send Offload V2 (IPv4)"="Enabled"

   • "Large Send Offload V2 (IPv6)"="Enabled"

   • "Offload.Rx.Checksum"="All"

   • "Offload.Tx.Checksum"="All"

   • "Offload.Tx.LSO"="Maximal"

   • "TCP Checksum Offload (IPv4)"="Rx & Tx Enabled"

   • "TCP Checksum Offload (IPv6)"="Rx & Tx Enabled"

   • "UDP Checksum Offload (IPv4)"="Rx & Tx Enabled"

   • "UDP Checksum Offload (IPv6)"="Rx & Tx Enabled"

How to update the network configuration

Once you determine that your system needs an update (see the “Verifying current network configuration” above), one of the following actions must be taken to adjust the settings:

Online update using IONOS VirtIO Network Driver Settings Update Scripts (recommended)

The best way to update network configuration is by using IONOS VirtIO Network Driver Settings Update Scripts.

The scripts are distributed in the following versions:

• Installer, available for download here: https://github.com/ionos-enterprise/ionos-network-helper/blob/master/WinNet-v0.1.171.0001.exe

  Installer will extract the scripts to the user-specified folder and optionally run the scripts.

• ZIP archive, available for download here: https://github.com/ionos-enterprise/ionos-network-helper/blob/master/WinNet-v0.1.171.0001.zip

When using the ZIP archive, or not selecting script execution in the installer, scripts can be started manually by launching the update.cmd file in the root folder of the extracted scripts.

Offline update using IONOS Windows VirtIO Drivers ISO Image (alternative)

Alternatively, use the VirtIO drivers ISO for Microsoft operating systems provided by IONOS.

1. Use DCD or API to add an ISO image to the Dedicated Core Server you’d like to update (In DCD select the VM -> Inspector -> Storage -> CD-ROM -> IONOS-Images -> Windows-VirtIO-Drivers).

2. Set the boot flag to the virtual CD/DVD drive with the ISO image.

3. Boot your Dedicated Core Server from the Windows VirtIO drivers ISO.

4. Open the remote console of the virtual machine.

5. Select an operating system from the list of supported versions. Driver installation or update will be performed automatically.

6. Remove the ISO and restart the VM through the DCD. Make sure that the boot flag is set correctly again.

Manual update

Updating drivers

1. Make sure you have the latest “VirtIO Ethernet Adapter” driver package. The driver package is available in the “Drivers” folder of IONOS VirtIO Network Driver Settings Update Scripts as described above.

2. Open Device Manager.

   in the “File Explorer“ window right-click “My PC”, select “Properties” and then “Device Manager”.

3. Under Network Adapters, for each "Red Hat VirtIO Ethernet Adapter":

   1. Right-click the adapter and select “Update driver”

   2. Select “Browse my computer for driver software”

   3. Click “Browse” and select the folder with the driver package suitable for your OS version

   4. Click OK and follow the instructions to install the driver.

Updating existing VirtIO network devices

1. Open Device Manager

   In the File Explorer window, right-click My PC, select Properties, and then Device Manager

2. Under Network adapters, for each "Red Hat VirtIO Ethernet Adapter":

   1. Open Properties (double-click usually works)

   2. Go to Advanced tab

   3. Navigate and set the following settings there:

      • "Init.MTUSize"="1500"

      • "IPv4 Checksum Offload"="Rx & Tx Enabled"

      • "Large Send Offload V2 (IPv4)"="Enabled"

      • "Large Send Offload V2 (IPv6)"="Enabled"

      • "Offload.Rx.Checksum"="All"

      • "Offload.Tx.Checksum"="All"

      • "Offload.Tx.LSO"="Maximal"

      • "TCP Checksum Offload (IPv4)"="Rx & Tx Enabled"

      • "TCP Checksum Offload (IPv6)"="Rx & Tx Enabled"

      • "UDP Checksum Offload (IPv4)"="Rx & Tx Enabled"

      • "UDP Checksum Offload (IPv6)"="Rx & Tx Enabled"

Please be aware that these settings will revert to old Registry values unless the full update procedure is executed as described above.

How can I configure VirtIO settings in Linux?

Please use the configuration below to ensure the stability and performance of the network connections on the operating system side.

Verifying current network configuration

Please make sure to use the MTU setting of 1500 for all network interfaces.

root@debian:~# ip link
...
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
	link/ether 02:01:26:cb:fc:d5 brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
	link/ether 02:01:fb:20:f1:65 brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
	link/ether 02:01:2a:a0:e1:53 brd ff:ff:ff:ff:ff:ff

Make sure that all of your network interfaces have hardware offloads enabled. This can be done with the ethtool utility; to install ethtool:

• For .deb-based distributions: apt-get install ethtool -y

• For .rpm-based distributions: yum install ethtool.x86_64 -y

Once installed, please do the following for each of your VirtIO-net devices:

Replace the [device_name] with the name of your device, e.g. eth0 or ens0, and check that the highlighted offloads are in the On state:

root@debian:~# ethtool -k [device_name]
...
tx-checksumming: on
...
tx-checksum-ip-generic: on
...
...
tcp-segmentation-offload: on
tx-tcp-segmentation: on
tx-tcp-ecn-segmentation: on
...
tx-tcp6-segmentation: on

If you changed any configuration parameters, such as increase MTU or disable offloads for network adapters, please make sure to roll back these changes.

Fixing persistent network interface configuration

Fixing persistent network interface configuration may include removing such configuration in the below files:

/etc/network/interfaces
iface eth0 inet static
...
pre-up /sbin/ifconfig $IFACE mtu 64000 <-- WRONG
/etc/dhcp/dhclient.conf (for .deb-based distributions)
interface "eth0" {
supersede interface-mtu 64000; <-- WRONG
}
/etc/dhcp/dhclient-*.conf (for .rpm based distributions)
supersede interface-mtu 1500; <-- Correct

and then restarting the affected network interfaces with ifdown eth0; ifup eth0

Dynamic adjustment of the MTU and offload configuration

Dynamically adjust network device MTU configuration:

ip link set mtu 1500 dev [device_name]

Dynamically enable hardware offloads for VirtIO-net devices. This can be done with the ethtool utility; to install ethtool:

• For .deb-based distributions: apt-get install ethtool -y

• For .rpm-based distributions: yum install ethtool.x86_64 -y

Once installed, please do the following for each of your VirtIO-net devices: ethtool -K [device_name] tx on tso on