Security and networking for Cloud VPS fleets
Push a firewall rule once and every attached VM reflects it. Keep internal traffic on a private VLAN, and move public IPs at the network layer for cutovers and failover.
Create reusable rule sets, bind them to interfaces, and rules take effect immediately.
Segment traffic with private networks and custom address ranges.
Assign additional public IPs and reassign between VMs instantly for failover and blue-green deploys.
Manage PTR records for clean email delivery and correct reverse lookups.
Choose the security boundary first
Pick the operator job that matches where you are. Each row links to the mechanism that delivers it.
| Operator job | Do this when | Setup effort | Next step |
|---|---|---|---|
| Start here Define the rule set | Setting up a new fleet or tightening an existing one | Create once, clone per environment | See fleet-wide policy |
| Attach by interface, not VM | Public and private NICs need different rule sets on the same server | Per-NIC group assignment | See multi-NIC support |
| Separate service traffic | Database, cache, or admin traffic must stay off the public internet | VLAN + CIDR definition | See traffic isolation |
| Move public identity | Blue-green deploy, maintenance window, or failover drill without DNS wait | Floating IP + PTR assignment | See floating-IP cutovers |
Responsibility boundary
Cloud VPS delivers the OS surface to you, so the security boundary sits closer to your code than on managed hosting. The chart below names who owns each layer.
Included with every Cloud VPS
Security groups, private networks, floating IPs, and reverse DNS ship with every Cloud VPS. The perimeter is default-deny: traffic that no rule allows never reaches your VMs. No separate firewall appliance to provision or license.
-
Define the rule set
Build reusable inbound and outbound policy around ports, protocols, and trusted CIDRs.
-
Attach it by interface
Apply different controls to public and private NICs without rebuilding the VM.
-
Revise once
Push a change across every attached server so fleet policy stays consistent.
| Feature | What it does | Availability |
|---|---|---|
| Firewalling | ||
| Security groups | Reusable inbound/outbound firewall policies built around ports, protocols, and trusted CIDRs. Attach them to whole fleets or individual interfaces. | Included |
| Group cloning and revision | Clone an existing rule set for a new environment, revise it in place. Keep production and staging in lockstep without rebuilding policy. | Included |
| Private networking & IPs | ||
| VLAN private networks | Define isolated VLAN segments with custom CIDR ranges and DNS resolver settings. Keep app-to-database traffic off the public internet entirely. | Included |
| Multi-NIC VM support | Attach multiple network interfaces per VM: one public-facing, one private. Assign security groups per interface for fine-grained per-segment policy. | Included |
| Floating IP reassignment | Move a public IP between VMs instantly for blue-green deploys, maintenance windows, and failover drills, with no DNS propagation to wait on. | Included |
| PTR / reverse DNS per IP | Set custom PTR records per public IP address so hostname validation and mail reputation stay intact through cutovers and NIC swaps. | Included |
| Edge & automation | ||
| BGP route optimization | The Togglebox network continuously picks the best-performing carrier path for outbound traffic and reroutes automatically when an uplink degrades. | Included |
| Always-on DDoS mitigation | Attack traffic such as SYN floods and HTTP floods is filtered at the network edge before it reaches your VMs. Nothing to enable or configure. | Included |
| API & Terraform | Script security group changes, IP reassignments, and network updates through the Cloud VPS API or Terraform, with every action tracked in the audit log. | Included |
Managed Firewall (add‑on)
The default-deny security group perimeter is included. The Managed Firewall is a separate, optional add-on: a dedicated hardware firewall appliance deployed between the platform edge and your VMs, operated by Togglebox with defined policy review and incident response SLAs. Not required for most deployments; intended for regulated workloads or teams that need hands-off firewall operation.
| Capability | Description | Availability |
|---|---|---|
| Dedicated firewall appliance | Separate hardware firewall between the platform edge and your VMs. Not shared with other tenants. | Add-on |
| Managed rule sets and fleet policy | Togglebox defines and enforces firewall rules across your fleet; policy changes go through a managed review workflow. | Add-on |
| Policy audit and incident response | Firewall change audit log and incident response coverage are included in the Managed Firewall tier. | Add-on |
Managed Firewall is available as a Managed Firewalls add-on. Contact us to add it to your Cloud VPS fleet.
Define fleet-wide policy from a single rule set
A security group holds the rule set; VMs and NICs are attachment points. Revise the group once and every attached server reflects it immediately. No SSH loops, no per-machine drift.
# web-public: one rule set ingress tcp 443 0.0.0.0/0 # HTTPS ingress tcp 22 203.0.113.0/24 # SSH from office egress tcp 5432 10.20.0.0/16 # Postgres, private VLAN egress tcp 443 0.0.0.0/0 # outbound HTTPS # Attached per-NIC, not per-VM: web-01 public → web-public web-02 public → web-public web-03 public → web-public web-03 private → cache-internal # same VM, other group # Revise once — every VM reflects it.
- Clone for new environments. Copy a group’s rule set, revise the specific ports or CIDRs that differ, and deploy without rebuilding policy.
- Attach per interface, not per VM. Stricter rules on the public NIC, permissive rules on the private segment, with different groups on the same server.
- Scripted and audit-logged. Drive security-group changes from the Cloud VPS API, with every revision recorded against the token that ran it.
Consistent policy across every VM in your fleet
Security groups, private VLANs, and floating IPs come with every Cloud VPS. Nothing extra to license, no appliance to provision.
Isolate service traffic and control public identity
Private networks and floating IPs handle the two sides of network control that security groups do not: keeping internal traffic off the public internet and moving public addresses cleanly.
VLAN private networks
Carve out isolated VLAN segments for app-to-database and app-to-cache traffic, with custom CIDR and DNS resolver settings. Internal traffic never touches the public internet.
Floating IPs for cutovers and failover
Reassign a public IP between VMs at the network layer with no DNS propagation to wait on. Useful for blue-green deploys, maintenance windows, and failover drills.
PTR records stay aligned
Set reverse DNS per public IP so hostname validation and outbound mail reputation stay correct when an IP moves between NICs or VMs.
Automate IP assignments, NIC changes, and network updates at scale through the Cloud VPS API. Need a managed firewall appliance in front of this setup? See Managed Firewalls.
Reviews from the Businesses We Keep Online
Cloud VPS Security Questions
Can I manage SSH keys and network security from one control panel?
Yes. The control panel includes SSH key management alongside account-level and VM-level security group operations, all in one interface.
How do security groups work?
Security groups are reusable rule sets you create at the account level. You edit rules in a dedicated editor, then bind groups to VM network interfaces. Changes are staged and committed explicitly.
Can I clone security group policies?
Cloning duplicates an existing group and its rule set, so you can adapt policies for new environments without starting from scratch.
Does the platform support private network segmentation?
Yes. Create private networks, manage address ranges, configure DNS resolvers, and control IP assignment methods for segmented internal communication.
Is DDoS protection included with Cloud VPS?
Yes. Always-on DDoS mitigation runs at the Togglebox network edge, filtering attack traffic such as SYN floods and HTTP floods before it reaches your VMs. It is included on every Cloud VPS with nothing to configure, and works alongside your security group rules rather than replacing them.
Can I move IP aliases between VMs?
IP alias controls let you add, remove, and move aliases between VMs. NIC operations also support attach, detach, and swap actions with eligibility checks.
How is reverse DNS managed?
PTR records can be listed, set, and deleted from the control panel. Reverse DNS management is available when DNS capability is active for your service.
No matching questions found.
How Your VPS Stays Up
- 3×-replicated NVMe: keeps your data on three independent storage servers
- Host failure recovery: restarts affected VPSs on healthy hosts after hardware failure
- Performance Guard: detects congestion and rebalances the cluster automatically
- 24/7 engineer support: reach real people around the clock
Ready to deploy?
Deploy in under 60 seconds. No long-term contracts.