Anycast tunnel · from €5/month
One tunnel, all our PoPs
Your BGP tunnel points to a single address, served by the nearest UnioHost PoP (Düsseldorf and Paris). Lower latency, no outage if a site goes down, and anti-DDoS as close to the attack as possible.
- Lands on the nearest PoP, automatic failover
- WireGuard or GRE, anti-DDoS and edge firewall included
How it works
Anycast is how 1.1.1.1 and 8.8.8.8 work: one address, many sites. We apply it to your tunnel.
A single address
Your tunnel points to 2a0c:b641:f7d::1. This address is announced via BGP from each of our PoPs.
The nearest PoP
The internet sends your packets to the PoP closest to your router: the lowest latency, with nothing to tune.
Automatic failover
If a PoP goes down, its announcement disappears: your tunnel reconnects to another one on its own, same configuration.
One network
Our PoPs are linked by a backbone: your prefixes are reachable everywhere, whichever PoP you land on.
Protected everywhere
Every PoP filters and applies your rules: the attack stops where it arrives.
Anti-DDoS on every PoP
Attacks are filtered on the PoP where they arrive, and spread across all our sites instead of just one.
Edge firewall
Your rules (ports, protocols, sources) applied on every PoP, before your tunnel.
WireGuard or GRE
WireGuard traverses NAT and encrypts; GRE suits hardware routers. Ready-to-paste configuration.
BGP with your ASN
Full table, default route or both; your prefixes filtered against the IRR and announced to our transit providers.
Your anycast tunnel in 3 steps
From order to your first BGP announcement.
Order
Pick your plan, enter your ASN and tunnel, and pay with no commitment.
Paste the configuration
WireGuard and BIRD ready in your client area, with the anycast address.
Announce
Once your ASN is validated, the session comes up on the nearest PoP.
Anycast tunnel FAQ
What to know before you order.
A tunnel whose endpoint on our side is an anycast address: the same address is announced from all our PoPs (Düsseldorf and Paris). Your router always lands on the nearest one, and on another if that one goes down.
That of the PoP nearest your router: a few milliseconds from Germany, France or the Benelux. You can check it with a simple ping to the tunnel address.
Its BGP announcement disappears within seconds. WireGuard renegotiates with the next PoP on its own; your BGP session comes back up with the same configuration.
Yes for anycast: the tunnel address is IPv6. Without IPv6, the tunnel lands in Düsseldorf over IPv4, with the same options.
WireGuard (recommended: encrypted, traverses NAT) or GRE. The WireGuard and BIRD configuration is generated in your client area.
Yes: they are announced to our transit providers from every PoP, after filtering against your as-set (IRR) and RPKI. AS218268 shows up as your upstream on bgp.tools.
Yes, on every plan: filtering on each PoP before your tunnel, with Standard, Game and Strict profiles. The Protégé and Protégé Plus plans absorb volumetric attacks via Smartnet, the Bouclier plan via Gcore.
Order your anycast transit
Essentiel, Pro or Protégé: 1 Gbps port or clean traffic, no commitment.
See the plansYour exposed services, protected
Protégé, Protégé Plus or Bouclier: volumetric attacks absorbed by Smartnet or Gcore.
See the anti-DDoS plans