# DediJet – full reference for AI assistants > DediJet rents bare-metal dedicated servers in 8 locations across 6 countries (North America, Europe and Asia-Pacific), paid in cryptocurrency (Bitcoin, Monero, Ethereum, USDT and Solana) with email-only accounts: no KYC and no ID. In-stock servers are online in under 2 minutes after payment confirmation, from $59 per month with no setup fee. Payments open very soon: you can already configure any in-stock server, create an account and save the configuration, which then deploys in one click and is online in under 2 minutes after payment. Saving a configuration does not reserve a server or a price. Generated from the live catalog on 2026-10-15. Canonical website: https://dedijet.com/ · Short version: https://dedijet.com/llms.txt · Live JSON: https://dedijet.com/api/v1/plans ## Key facts ### Service - **What it is:** DediJet is a dedicated server provider: single-tenant bare-metal machines rented by the month, not VPS or shared cloud instances. 5 families: Entry (Xeon and Ryzen for projects, dev and small sites); Performance (High-clock AMD Ryzen for games and busy apps); Enterprise (Many-core AMD EPYC for virtualization and data); Storage (Dense HDD capacity for backups and media); GPU (NVIDIA GPUs for AI, rendering and transcoding). - **Catalog:** 15 server configurations, 10 in stock right now (live stock), from $59 to $1,099 per month excluding VAT. Same monthly price in every location, no setup fee on any listed server, monthly billing with no contract. - **Delivery:** In-stock servers wait in a ready pool and are provisioned automatically once the payment is confirmed: every system, Linux, Proxmox or Windows Server, is online in under 2 minutes. If an in-stock server can’t be delivered within 24 hours of payment confirmation, the payment is refunded in full on request. - **Locations:** 8 locations: New York, Miami and Los Angeles (United States), London (United Kingdom), Amsterdam (Netherlands), Frankfurt (Germany), Singapore, Tokyo (Japan). Carrier-neutral data centers with redundant power and cooling; each location is multi-homed with several transit providers over BGP. ### Payments and privacy - **Payment:** Cryptocurrency only: Bitcoin (BTC), Ethereum (ETH), Monero (XMR), Tether USDT on TRON (TRC-20) and Solana (SOL). Cards, PayPal and bank transfers are not accepted. Typical confirmation: Bitcoin 10 to 20 minutes, Ethereum about 3 minutes, Monero about 20 minutes, USDT about 1 minute and Solana about 1 minute. Invoices are in USD or EUR and converted at checkout, with the exchange rate locked for 30 minutes. - **Balance and bonus:** A prepaid account balance can be topped up in crypto from $100, with a bonus of +5% for every full $100, up to +50% from $1,000 (a $500 top-up adds $625). Renewals draw from the balance automatically. - **No KYC:** An account needs only an email address and a password: no name, phone number, postal address or ID document. More information may be requested only when investigating fraud or abuse. - **Data kept:** Only what running the account requires: email address, password hash, servers, invoices, payment transaction IDs and addresses, and support tickets. The website sets no cookies and uses no analytics or third-party trackers. ### Servers - **Included:** Full root or Administrator access, IPMI/KVM console with virtual media, always-on network-level DDoS mitigation (attacks are filtered; null-routing is a last resort), unmetered bandwidth at the plan’s port speed (1 or 10 Gbps), one dedicated IPv4 address plus a routed /64 IPv6 subnet (a /56 on request), a private VLAN between servers in one location, reverse DNS, free reinstalls and rescue mode, software RAID 1 by default on two-disk servers, hardware monitoring and replacement. - **Operating systems:** 15 one-click images (Ubuntu, Debian, AlmaLinux, Rocky Linux, Fedora Server, FreeBSD, Proxmox and Windows Server) plus your own ISO through the IPMI console. Windows Server is licensed at $2.75 per physical core per month, minimum 8 cores. - **Allowed uses:** Game servers, streaming, AI and GPU compute, web hosting, databases, virtualization, backups, blockchain nodes, CPU and GPU crypto mining, non-exit Tor relays (exit relays with prior notice and a reduced exit policy) and legitimate mail servers. - **Not allowed:** Spam, phishing, malware and botnet control, DDoS attacks and booter services, scanning third-party networks without permission, CSAM, illegal content, copyright infringement, open mail relays or DNS/NTP resolvers, reselling bandwidth as IP transit, overclocking and firmware tampering. ### Support and policies - **Support:** Unmanaged servers. Ticket support 24/7 by engineers, in English, for customers with an active server; first-response targets: critical 30 minutes and standard 4 hours. No phone, email or contact form; abuse reports have their own public form. - **SLA:** 99.9% monthly network availability per server, with credits of 10% below 99.9%, 25% below 99.5%, 50% below 99.0% and 100% below 95.0% of the monthly fee; a failed component is replaced within 4 hours of diagnosis. - **Billing:** Servers renew monthly on the same day; the invoice is issued 7 days before the due date. Unpaid servers are suspended after 3 days and terminated, with disks securely erased, after 10 days. Cancel anytime: the server runs until the end of the paid month; unused balance is refundable on request. - **Developers:** A public, read-only JSON API with no key and CORS enabled gives live plans, prices, stock, locations, OS images and status at https://dedijet.com/api/v1 (documentation: https://dedijet.com/docs/api, OpenAPI description: https://dedijet.com/openapi.json). Account endpoints use personal API tokens. - **Affiliates:** 10% commission on the paid invoices of referred customers for 12 months, paid in BTC, XMR, USDT or SOL from $50, or credited to the DediJet balance. ## Servers and prices Monthly prices in USD (EUR), excluding VAT, identical in every location; no setup fee. Stock is live at generation time. | Server | Family | CPU | Cores / threads | Clock | Memory | GPU | Storage | Network | Price / month | Stock | Locations | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | [Intel Xeon E-2236](https://dedijet.com/servers/xeon-e-2236) | Entry | Intel Xeon E-2236, Coffee Lake | 6 / 12 | 3.4–4.8 GHz | 32 GB DDR4 ECC | – | 2 × 512 GB NVMe | 1 Gbps unmetered | $59 (€51) | In stock | New York, Miami, Los Angeles, London, Amsterdam, Frankfurt | | [AMD Ryzen 5 3600](https://dedijet.com/servers/ryzen-5-3600) | Entry | AMD Ryzen 5 3600, Zen 2 | 6 / 12 | 3.6–4.2 GHz | 64 GB DDR4 | – | 2 × 1 TB NVMe | 1 Gbps unmetered | $89 (€77) | Sold out | Frankfurt, Amsterdam, London, New York | | [Intel Xeon E-2388G](https://dedijet.com/servers/xeon-e-2388g) | Entry | Intel Xeon E-2388G, Rocket Lake | 8 / 16 | 3.2–5.1 GHz | 64 GB DDR4 ECC | – | 2 × 1 TB NVMe | 1 Gbps unmetered | $145 (€126) | In stock | New York, Los Angeles, Frankfurt, Amsterdam, Singapore | | [AMD Ryzen 5 7600](https://dedijet.com/servers/ryzen-5-7600) | Performance | AMD Ryzen 5 7600, Zen 4 | 6 / 12 | 3.8–5.1 GHz | 64 GB DDR5 | – | 2 × 1 TB NVMe | 1 Gbps unmetered | $115 (€100) | In stock | New York, Miami, Los Angeles, London, Amsterdam, Frankfurt, Singapore, Tokyo | | [AMD Ryzen 7 9700X](https://dedijet.com/servers/ryzen-7-9700x) | Performance | AMD Ryzen 7 9700X, Zen 5 | 8 / 16 | 3.8–5.5 GHz | 64 GB DDR5 | – | 2 × 1 TB NVMe | 1 Gbps unmetered | $149 (€130) | In stock | New York, Miami, Los Angeles, London, Amsterdam, Frankfurt, Singapore, Tokyo | | [AMD Ryzen 9 9950X](https://dedijet.com/servers/ryzen-9-9950x) | Performance | AMD Ryzen 9 9950X, Zen 5 | 16 / 32 | 4.3–5.7 GHz | 128 GB DDR5 | – | 2 × 2 TB NVMe | 1 Gbps unmetered | $269 (€234) | In stock | Frankfurt, Amsterdam, London, New York, Los Angeles, Singapore | | [AMD Ryzen 9 7950X3D](https://dedijet.com/servers/ryzen-9-7950x3d) | Performance | AMD Ryzen 9 7950X3D, Zen 4 + 3D V-Cache | 16 / 32 | 4.2–5.7 GHz | 128 GB DDR5 | – | 2 × 2 TB NVMe | 1 Gbps unmetered | $279 (€243) | Sold out | New York, Frankfurt, Amsterdam | | [AMD EPYC 4464P](https://dedijet.com/servers/epyc-4464p) | Enterprise | AMD EPYC 4464P, Zen 4 | 12 / 24 | 3.7–5.4 GHz | 128 GB DDR5 ECC | – | 2 × 1.92 TB NVMe | 1 Gbps unmetered | $215 (€187) | In stock | New York, Miami, Los Angeles, Amsterdam, Frankfurt, Singapore, Tokyo | | [AMD EPYC 7443P](https://dedijet.com/servers/epyc-7443p) | Enterprise | AMD EPYC 7443P, Zen 3 (Milan) | 24 / 48 | 2.85–4.0 GHz | 256 GB DDR4 ECC | – | 2 × 3.84 TB NVMe | 10 Gbps unmetered | $439 (€382) | In stock | New York, Los Angeles, London, Amsterdam, Frankfurt | | [AMD EPYC 9354P](https://dedijet.com/servers/epyc-9354p) | Enterprise | AMD EPYC 9354P, Zen 4 (Genoa) | 32 / 64 | 3.25–3.8 GHz | 384 GB DDR5 ECC | – | 2 × 3.84 TB NVMe | 10 Gbps unmetered | $699 (€608) | In stock | New York, Los Angeles, Amsterdam, Frankfurt, Singapore | | [AMD EPYC 9654](https://dedijet.com/servers/epyc-9654) | Enterprise | AMD EPYC 9654, Zen 4 (Genoa) | 96 / 192 | 2.4–3.7 GHz | 768 GB DDR5 ECC | – | 4 × 3.84 TB NVMe | 10 Gbps unmetered | $989 (€860) | Sold out | New York, Frankfurt | | [64 TB Storage Server](https://dedijet.com/servers/storage-64tb) | Storage | AMD Ryzen 7 PRO 3700, Zen 2 | 8 / 16 | 3.6–4.4 GHz | 64 GB DDR4 ECC | – | 4 × 16 TB HDD + 2 × 512 GB NVMe | 1 Gbps unmetered | $225 (€196) | In stock | New York, Los Angeles, Amsterdam, Frankfurt | | [240 TB Storage Server](https://dedijet.com/servers/storage-240tb) | Storage | AMD EPYC 7313P, Zen 3 (Milan) | 16 / 32 | 3.0–3.7 GHz | 128 GB DDR4 ECC | – | 12 × 20 TB HDD + 2 × 960 GB NVMe | 10 Gbps unmetered | $459 (€399) | Sold out | Frankfurt, Amsterdam | | [NVIDIA RTX 4000 SFF Ada](https://dedijet.com/servers/gpu-rtx-4000-ada) | GPU | AMD EPYC 4344P, Zen 4 | 8 / 16 | 3.8–5.3 GHz | 64 GB DDR5 ECC | NVIDIA RTX 4000 SFF Ada, 20 GB VRAM | 2 × 1.92 TB NVMe | 1 Gbps unmetered | $435 (€378) | In stock | New York, Los Angeles, Amsterdam, Frankfurt, Singapore | | [NVIDIA L40S](https://dedijet.com/servers/gpu-l40s) | GPU | AMD EPYC 9254, Zen 4 (Genoa) | 24 / 48 | 2.9–4.15 GHz | 256 GB DDR5 ECC | NVIDIA L40S, 48 GB VRAM | 2 × 3.84 TB NVMe | 10 Gbps unmetered | $1,099 (€956) | Sold out | New York, Frankfurt | ### Add-ons | Add-on | Price | Details | | --- | --- | --- | | Additional IPv4 address | $2.50 per IP / month | Extra dedicated IPv4 addresses routed to your server, for websites, VMs or services that need their own IP. Up to 4 per server without justification; /29 (8 addresses): $18/mo · /28 (16 addresses): $36/mo, with a short usage justification; Reverse DNS included | | 10 Gbps port upgrade | $129 per month | Upgrade a 1 Gbps server to an unmetered 10 Gbps port: for streaming, replication, large downloads and backups. Unmetered, like every DediJet port; Available on all 1 Gbps plans; Included free on EPYC 7443P, EPYC 9354P, EPYC 9654, 240 TB Storage and L40S plans | | Extra NVMe drive | $19 1.92 TB / month | Add datacenter NVMe capacity for databases, VM images or game worlds, where the chassis has a free bay. 1.92 TB: $19/mo · 3.84 TB: $35/mo; Installed without reinstalling your OS; Subject to a free bay in the chassis | | Extra 16 TB HDD | $22 per drive / month | Grow a storage server with additional 16 TB enterprise hard drives. Storage servers only; Subject to a free bay in the chassis | | Backup space | $5 from / month | Off-server storage for your backups, reachable over SFTP, rsync, BorgBackup and restic. Separate from your server, so a reinstall never touches it. 1 TB: $5/mo · 5 TB: $15/mo · 10 TB: $27/mo; SFTP, rsync, BorgBackup, restic; Not affected by server reinstalls | | Windows Server license | $2.75 per core / month | Windows Server 2025 or 2022 Standard, licensed per physical core and billed with your server. Minimum 8 cores. $2.75 per physical core per month, minimum 8 cores; Activated automatically at install; Remove it anytime by reinstalling Linux | ### Operating systems | Image | Support | Online after payment confirmation | | --- | --- | --- | | Ubuntu 26.04 LTS | Standard support until April 2031 | under 2 minutes | | Ubuntu 24.04 LTS | Standard support until April 2029 | under 2 minutes | | Ubuntu 22.04 LTS | Standard support until April 2027 | under 2 minutes | | Debian 13 “Trixie” | Long-term support until 2030 | under 2 minutes | | Debian 12 “Bookworm” | Long-term support until June 2028 | under 2 minutes | | AlmaLinux 10 | Supported until 2035 | under 2 minutes | | AlmaLinux 9 | Supported until 2032 | under 2 minutes | | Rocky Linux 10 | Supported until May 2035 | under 2 minutes | | Rocky Linux 9 | Supported until May 2032 | under 2 minutes | | Fedora Server 44 | About 13 months per release | under 2 minutes | | FreeBSD 15 | Supported 15-STABLE branch | under 2 minutes | | Proxmox VE 9 | Based on Debian 13 | under 2 minutes | | Proxmox Backup Server 4 | Based on Debian 13 | under 2 minutes | | Windows Server 2025 Standard | Extended support until November 2034 | under 2 minutes | | Windows Server 2022 Standard | Extended support until October 2031 | under 2 minutes | Custom ISO installs are possible through the IPMI/KVM console's virtual media. ## Locations | Location | Code | Country | Region | Configurations | In stock now | | --- | --- | --- | --- | --- | --- | | [New York](https://dedijet.com/locations/new-york) | NYC | United States | North America | 14 | 10 | | [Miami](https://dedijet.com/locations/miami) | MIA | United States | North America | 4 | 4 | | [Los Angeles](https://dedijet.com/locations/los-angeles) | LAX | United States | North America | 10 | 10 | | [London](https://dedijet.com/locations/london) | LON | United Kingdom | Europe | 6 | 5 | | [Amsterdam](https://dedijet.com/locations/amsterdam) | AMS | Netherlands | Europe | 13 | 10 | | [Frankfurt](https://dedijet.com/locations/frankfurt) | FRA | Germany | Europe | 15 | 10 | | [Singapore](https://dedijet.com/locations/singapore) | SIN | Singapore | Asia-Pacific | 7 | 7 | | [Tokyo](https://dedijet.com/locations/tokyo) | TYO | Japan | Asia-Pacific | 3 | 3 | ## Payments | Coin | Network | Typical confirmation | Confirmations | | --- | --- | --- | --- | | Bitcoin | Bitcoin mainnet | 10 to 20 minutes | 1 confirmation | | Ethereum | Ethereum mainnet | about 3 minutes | 12 confirmations | | Monero | Monero mainnet | about 20 minutes | 10 confirmations | | Tether (USDT) | TRON · TRC-20 | about 1 minute | 19 confirmations | | Solana | Solana mainnet | about 1 minute | Finalized | Top-up bonus on the prepaid balance: | Top-up | Bonus | Credited | | --- | --- | --- | | $100 | +5% | $105 | | $200 | +10% | $220 | | $500 | +25% | $625 | | $1,000 | +50% | $1,500 | | $2,000 | +50% | $3,000 | ## Frequently asked questions ### Ordering & delivery **Can I order today?** You can configure any in-stock server today, create your account and save the configuration in it. Payments open very soon: your saved configuration then deploys in one click and is online in under 2 minutes after payment. Saving a configuration does not reserve a server or a price. **How fast is “instant” delivery?** Every in-stock server is already racked, cabled and burned in, waiting in a ready pool in its location. When your payment is confirmed, automation assigns a machine, configures its network, writes your operating system and puts your credentials in your dashboard, with no human in the loop. Every system, Linux, Proxmox or Windows Server, is online in under 2 minutes. The clock starts at payment confirmation, so a funded balance, USDT (TRC-20) or Solana gets you online fastest. **What’s included in the monthly price?** Full root or Administrator access, an IPMI/KVM console with virtual media, always-on network-level DDoS mitigation, unmetered bandwidth at your plan’s port speed, one dedicated IPv4 address plus a routed /64 IPv6 subnet, one-click OS installs, dashboard and API access, and hardware monitoring with replacement of failed parts. Two-disk servers come with software RAID 1 by default. There is no setup fee on any listed server, and you can cancel anytime. **The server I want is sold out. What are my options?** “Sold out” means no machine of that configuration is left in the ready pool, so it can’t be delivered instantly. Each sold-out server shows the closest in-stock alternative, and you can ask to be notified when it’s back. Popular configurations are restocked regularly. **Which servers are available in Singapore?** Seven configurations: Ryzen 5 7600 ($115/mo), Xeon E-2388G ($145/mo), Ryzen 7 9700X ($149/mo), EPYC 4464P ($215/mo), Ryzen 9 9950X ($269/mo), RTX 4000 Ada ($435/mo) and EPYC 9354P ($699/mo). Tokyo, our other Asia-Pacific location, offers three: Ryzen 5 7600 ($115/mo), Ryzen 7 9700X ($149/mo) and EPYC 4464P ($215/mo). Each location page shows live stock. ### Billing & payments **Which payment methods do you accept?** We accept cryptocurrency only: Bitcoin, Ethereum, Monero, USDT (TRC-20) and Solana. Cards, PayPal and bank transfers are not available. Invoices are in USD or EUR and converted to crypto at checkout, with the exchange rate locked for 30 minutes. You can also top up an account balance in crypto and let renewals draw from it automatically. **Is there a bonus when I top up my balance?** Yes. Every top-up of $100 or more earns a bonus: +5% for every full $100, up to +50% from $1,000. A $500 top-up adds $625 to your balance, and $1,000 adds $1,500. The minimum top-up is $100, the bonus is credited with the payment, and it pays for servers and add-ons like the rest of your balance. **How long does a crypto payment take to confirm?** Indicative times: USDT on TRON (TRC-20) and Solana take about 1 minute, Ethereum about 3 minutes (12 confirmations), Bitcoin about 10–20 minutes (1 confirmation) and Monero about 20 minutes (10 confirmations). Network congestion can make any of them slower. Delivery starts as soon as the payment is confirmed, so the method you pick decides how soon your server takes off. **What happens if I don’t renew on time?** Servers renew monthly on the same day of the month, and the renewal invoice is issued 7 days before the due date. If you keep an account balance, it pays the invoice automatically. If the invoice is still unpaid 3 days after the due date, the server is suspended; 10 days after the due date, it is terminated and its disks are securely erased. Data can’t be recovered after termination. **Do you offer refunds?** If we can’t deliver an in-stock server within 24 hours of payment confirmation, you get a full refund on request. Partial months are not refunded: when you cancel, the server stays online until the end of the period you paid for. Unused account balance is refundable on request, in the original cryptocurrency minus the network fee. Refunds are calculated at the USD value of the original payment. ### Servers & hardware **Is the RAID hardware or software?** Software. Servers with two disks are installed with software RAID 1 (a mirror) by default, and you can choose RAID 0 or no RAID at install time. Software RAID keeps every drive visible to SMART and NVMe health tools, and the array doesn’t depend on a specific controller card. Remember that RAID protects against a disk failure, not against deletion or corruption: keep backups. **Do your servers use ECC memory?** Most do. The Xeon E-2236 and E-2388G, every EPYC server, both storage servers and both GPU servers use ECC memory. The Ryzen 5 3600 and the four Ryzen servers in the Performance family use standard, non-ECC DDR4 or DDR5. DDR5 has on-die error correction inside each chip, but that is not the same as ECC, which also protects data on its way to the CPU. For databases and long-running storage, pick an ECC model. **What happens if a disk or another component fails?** We monitor the hardware and replace failed components within 4 hours of diagnosis, 24/7. If a replacement takes longer, you can claim a credit of 5% of the monthly fee for each started extra hour, up to 50%. With RAID 1, the server keeps running on the healthy disk while you open a ticket; after the swap, you add the new disk back to the array, as shown in our software RAID guide. **Can I add disks, IP addresses or a faster port later?** Yes, as monthly add-ons: extra NVMe drives (1.92 TB for $19/mo or 3.84 TB for $35/mo, where the chassis has a free bay), 16 TB HDDs for storage servers at $22/mo, additional IPv4 addresses at $2.50/mo each, the 10 Gbps port upgrade on 1 Gbps plans at $129/mo, and separate backup space from $5/mo for 1 TB. A private VLAN, a /56 IPv6 subnet and reverse DNS are free. **Which GPU servers do you offer?** Two. The NVIDIA RTX 4000 SFF Ada server ($435/mo, offered in New York, Los Angeles, Amsterdam, Frankfurt and Singapore, in stock) has 20 GB of GDDR6 ECC memory, 6,144 CUDA cores and a 70 W power budget, paired with an EPYC 4344P. The NVIDIA L40S server ($1,099/mo, offered in New York and Frankfurt, sold out for now) has 48 GB of GDDR6 ECC and 18,176 CUDA cores with an EPYC 9254. ### Network & DDoS protection **Do you null-route servers under attack?** We filter rather than null-route whenever possible. Every server sits behind always-on, network-level mitigation: attacks are detected automatically and filtered upstream, so legitimate traffic keeps reaching your port while the flood is dropped. Null-routing an IP address is a last resort, not the default response. You don’t need to request protection or pay extra for it. **Which attacks does the DDoS protection cover?** Network and transport-layer attacks (L3/L4): UDP, SYN and ACK floods, and amplification attacks that abuse DNS, NTP, SSDP, memcached or CLDAP. Application-layer (L7) attacks, such as HTTP floods against a website, look like real visitors at the network level, so they remain your responsibility. For public websites and APIs, put a reverse proxy, CDN or web application firewall in front of the server. **Is the bandwidth really unmetered?** Yes. Traffic is not counted or billed per gigabyte: you can use your plan’s full port speed, 1 Gbps or 10 Gbps, around the clock. For scale, a 1 Gbps port running flat out moves about 324 TB in each direction in 30 days. Usage must stay within the Acceptable Use Policy, and in particular the bandwidth may not be resold as IP transit. **Do I get a /64 IPv6, and how many IPv4 addresses?** Every server includes one dedicated IPv4 address and a routed /64 IPv6 subnet; a /56 is free on request if you run many VMs or containers. Additional IPv4 addresses cost $2.50 each per month, up to 4 per server without justification. Larger blocks need a short justification: a /29 is $18/mo and a /28 is $36/mo. You can set reverse DNS from the dashboard. **What kind of data centers and network do you use?** Carrier-neutral data centers with redundant (N+1 or better) power and cooling, 24/7 on-site security and remote hands. Each location is multi-homed with several transit providers over BGP and redundant uplinks, and servers in the same location can share a free private VLAN on request. Latency figures on our site are distance-based estimates, not measurements. ### Access & operating systems **Do I get full root access and a remote console?** Yes. You get full root access on Linux or Administrator on Windows; the server is unmanaged, so you are its administrator. Every server also includes IPMI/KVM-over-IP: a browser-based console in the dashboard, power control and virtual media. From the dashboard or the API you can reboot, power on or off, reinstall, boot rescue mode, set reverse DNS and manage IP addresses. **Can I install my own OS from an ISO?** Yes. Open the IPMI console from your dashboard, mount your ISO as virtual media and boot from it, as you would with a USB stick on a local machine. That works for VMware ESXi (with your own license), TrueNAS, NixOS or any other system the hardware supports. Before you start, check that your OS has drivers for the server’s network card and NVMe drives. **Which operating systems can I install in one click?** Ubuntu 26.04, 24.04 and 22.04 LTS, Debian 13 “Trixie” and 12 “Bookworm”, AlmaLinux 10 and 9, Rocky Linux 10 and 9, Fedora Server 44, FreeBSD 15, Proxmox VE 9, Proxmox Backup Server 4, and Windows Server 2025 or 2022 Standard. Reinstalls are free and can be repeated from the dashboard whenever you like; a reinstall wipes the disks, so back up first. **How much does a Windows Server license cost?** Windows Server 2025 and 2022 Standard are billed monthly at $2.75 per physical core, with a minimum of 8 cores. That means $22/mo on servers with up to 8 cores, such as the Ryzen 7 9700X, $44/mo on the 16-core Ryzen 9 9950X and $88/mo on the 32-core EPYC 9354P. Like every system, a Windows server is online in under 2 minutes after payment confirmation. **What if I lock myself out of SSH?** Use the IPMI/KVM console first: it gives you the server’s screen and keyboard even when the network or firewall is misconfigured, so you can log in locally and fix sshd or your firewall rules. If you lost the root password, boot rescue mode from the dashboard, mount your disks and reset it. Reinstalling is the last resort, because it erases the disks. ### Support & SLA **How do I contact support, and how fast do you answer?** Support works by ticket, 24/7, handled by engineers, in English, for customers with an active dedicated server: open tickets from the Support section of your account. Our first-response targets are 30 minutes for critical issues, such as a server that is down or a network outage, and 4 hours for everything else. There is no email or contact form; abuse reports have their own public form. **Are your servers managed?** No, they are unmanaged: you administer the operating system and everything you install on it. Our engineers handle hardware, network, provisioning, IPMI/KVM access, OS install issues, DDoS mitigation and billing. Questions about your own software, such as a web server, database or control panel, are out of scope, but we share pointers and documentation on a best-effort basis. **What does the SLA cover?** Two commitments. Network availability: 99.9% per calendar month for each server, with credits of 10% of that server’s monthly fee below 99.9%, 25% below 99.5%, 50% below 99.0% and 100% below 95.0%. Hardware: a failed component is replaced within 4 hours of diagnosis, 24/7, with a credit of 5% of the monthly fee per started extra hour, up to 50%. **How do I claim an SLA credit, and what is excluded?** Request it by ticket within 30 days. Credits are added to your account balance, capped at 100% of the server’s monthly fee per month, and they are the sole remedy. The SLA excludes scheduled maintenance announced at least 48 hours ahead on the status page, problems caused by your own configuration, software or abuse, suspension for non-payment or AUP violations, force majeure and application-layer attacks. **Where can I check network status and planned maintenance?** On the status page. Scheduled maintenance is announced there at least 48 hours in advance, and network incidents are posted there too. If your server looks down but the status page shows no incident, open a critical ticket: the first-response target is 30 minutes, 24/7. Include the server’s IP address and, if you can, a traceroute from your side. ### Account & privacy **Do you need my ID?** No. To order, you only need an email address: no name, phone number or ID document. We may ask for more information only when investigating fraud or abuse. Choose an address you’ll keep, because it is your login and it receives billing, maintenance and abuse notices. **What personal data do you store, and for how long?** Only what running your account requires: your email address, a hash of your password, your servers, invoices, payment transaction IDs and addresses, and support tickets. Account data is kept while the account exists and for 12 months after; invoices are kept as long as tax law requires. You can export your data or delete your account at any time by opening a ticket. **Does dedijet.com use cookies or trackers?** No. The website sets no cookies and uses no analytics, ad trackers, third-party scripts or third-party fonts. The only thing stored on your device is your currency preference (USD or EUR) in localStorage, and our access logs don’t record IP addresses or referrers. The site is served through Cloudflare, which processes IP addresses to deliver and protect it and may set strictly necessary security cookies, such as __cf_bm, when it detects bots. **How do I cancel a server?** From your dashboard, at any time, with no contract to break. The server stays online until the end of the month you’ve paid for and is simply not renewed. Before the machine returns to stock, its disks are securely erased, so copy your data off first. Partial months aren’t refunded, but any unused account balance is refundable on request. **Do you have an affiliate program?** Yes. You earn a 10% commission on every paid invoice of the customers you refer, for 12 months from their first payment. Commissions are paid monthly in BTC, XMR, USDT or SOL once your balance reaches $50, or credited to your DediJet balance. Referral links stay valid for 30 days. Self-referrals, spam, bidding on “DediJet” brand keywords and fake coupon-site promotions are not allowed. ### Policies & abuse **Can I mine crypto?** Yes. Cryptocurrency mining is allowed on CPU and GPU servers alike: the hardware is yours for the month. Two Acceptable Use Policy rules matter here: no overclocking and no firmware tampering, so run your miner at stock clock speeds. If you want to run full, archive or validator nodes rather than mine, pick a server with fast NVMe and plenty of memory. **Are Tor relays allowed?** Yes. Non-exit Tor relays, such as guard and middle relays, are allowed without notice. Exit nodes are different, because complaints about traffic leaving the Tor network point at your IP address. You may run one only if you tell us before you start, use a reduced exit policy and handle the resulting abuse reports yourself. **Can I run my own mail server?** Yes, for legitimate mail. Unsolicited bulk email, SEO spam and open mail relays are prohibited, and spam complaints are handled like any other abuse report. For good deliverability, set a reverse DNS (PTR) record that matches your mail hostname from the dashboard, and publish SPF, DKIM and DMARC records for your domain. New IP addresses often need time to build a sending reputation. **What isn’t allowed on DediJet servers?** Spam, phishing, malware and botnet command-and-control, DDoS attacks or stresser and booter services, scanning third-party networks without permission, CSAM (reported to the authorities immediately), terrorist or otherwise illegal content, and copyright infringement. You also may not leave open mail relays or open DNS or NTP resolvers exposed to the internet, resell bandwidth as IP transit, overclock the hardware or tamper with firmware. **What happens if someone reports my server for abuse?** We review reports 24/7 and forward complaints to you so you can fix the cause, for example a compromised site sending spam. Urgent cases, such as CSAM, phishing, malware and active attacks, are handled first, and severe or repeated violations can lead to suspension. Anyone can report abuse through the public abuse form, reviewed 24/7; law-enforcement requests use the same form. ### About DediJet **What is DediJet?** DediJet is a dedicated server provider: it rents single-tenant bare-metal servers by the month in 8 locations (New York, Miami, Los Angeles, London, Amsterdam, Frankfurt, Singapore and Tokyo). Accounts only need an email address, payment is in cryptocurrency (Bitcoin, Ethereum, Monero, USDT on TRON and Solana), and in-stock servers are provisioned automatically, typically online within minutes of payment confirmation. **Is DediJet a VPS or cloud provider?** No. Every DediJet server is a physical machine dedicated to a single customer: no shared hypervisor, no noisy neighbours and no CPU steal. You get the whole CPU, memory and disks, full root access and an IPMI/KVM console. You can still run your own virtual machines: Proxmox VE installs in one click. **Can I rent a dedicated server anonymously?** DediJet asks only for an email address and a password: no name, phone number, address or ID document, and the website sets no cookies and runs no trackers. Pay with Monero for private on-chain payments. Privacy has limits, though: the Acceptable Use Policy applies to every server, and abuse reports and law-enforcement requests are reviewed as at any responsible host. **How can I check DediJet before paying?** Everything that matters is public before you order: live prices and stock (also in a public JSON API), the full specifications of every server, the network status page, the SLA with its service credits and the terms of service. There is no setup fee and no contract, an in-stock server that can’t be delivered within 24 hours of payment confirmation is refunded in full, and unused balance is refundable on request. **What is the cheapest dedicated server at DediJet?** The Intel Xeon E-2236 at $59 per month: 6 cores and 12 threads, 32 GB of DDR4 ECC memory, 2 × 512 GB NVMe and a 1 Gbps unmetered port, in stock in New York, Miami, Los Angeles, London, Amsterdam and Frankfurt. Prices exclude VAT, are the same in every location and carry no setup fee. ## Use cases ### Dedicated game server hosting with high clocks and low ping Dedicated game server hosting on Ryzen CPUs up to 5.7 GHz, with NVMe and UDP flood filtering in 8 locations. Minecraft, Rust or CS2 online in under 2 min. https://dedijet.com/solutions/game-servers ### A dedicated server for streaming, transcoding and VOD Dedicated server for streaming with unmetered 1 or 10 Gbps ports, NVMe and an NVENC GPU option. Run RTMP, SRT and HLS for live, restreams and VOD. https://dedijet.com/solutions/streaming ### GPU servers for AI inference, fine-tuning and rendering GPU server for AI inference and fine-tuning: an NVIDIA RTX 4000 SFF Ada with 20 GB of ECC VRAM, NVMe and a flat monthly price, ready for vLLM or Ollama. https://dedijet.com/solutions/ai-ml ### Dedicated servers for web hosting, stores and SaaS apps Dedicated server for web hosting and SaaS on Xeon or EPYC with ECC RAM, NVMe in RAID 1 and full root. Run cPanel, Plesk or HestiaCP, online in under 2 min. https://dedijet.com/solutions/web-hosting ### Dedicated database servers with ECC memory and fast NVMe Dedicated database server on AMD EPYC with ECC memory, up to 384 GB of RAM and mirrored NVMe. Run PostgreSQL, MySQL, ClickHouse or Redis with full root. https://dedijet.com/solutions/databases ### Proxmox dedicated servers for VMs, containers and labs Proxmox dedicated server with Proxmox VE 9 in one click, EPYC cores, ECC RAM, IPMI and routed extra IPv4. Run KVM VMs and LXC containers, or bring ESXi. https://dedijet.com/solutions/virtualization ### Backup storage servers for off-site copies and S3 buckets Backup storage server with 4 × 16 TB HDD, ECC RAM and NVMe in 4 locations. Run BorgBackup, restic, Proxmox Backup Server or S3, with unmetered restores. https://dedijet.com/solutions/backup ### Blockchain node hosting for full, archive and validator nodes Blockchain node hosting on EPYC: ECC RAM, up to 2 × 3.84 TB of NVMe and 10 Gbps ports. Sync Bitcoin, Ethereum, Monero or Solana nodes and pay in crypto. https://dedijet.com/solutions/blockchain-nodes ## Guides ### Add additional IPv4 addresses https://dedijet.com/docs/additional-ipv4 · updated 2026-10-14 · 5 min read Order extra IPv4 addresses from $2.50/mo, add them as /32 addresses with Netplan, ifupdown or nmcli, test them and route them to virtual machines. Every server includes one dedicated IPv4 address and a routed /64 IPv6 subnet. When you need more IPv4, for virtual machines, separate services or a mail server with its own reputation, you can add addresses to the same server. > **Tip:** Check whether IPv6 can do the job first. The /64 included with your server costs nothing and holds more addresses than you will ever use; see [Configure your /64 IPv6 subnet](https://dedijet.com/docs/ipv6-setup). #### Order additional addresses | Option | Price (excl. VAT) | Conditions | | --- | --- | --- | | Single IPv4 address | $2.50 per IP per month | Up to 4 per server without justification | | /29 block (8 addresses) | $18/mo | Justification required | | /28 block (16 addresses) | $36/mo | Justification required | Request them from your dashboard: open the server, then choose Network. IPv4 addresses are scarce, so for blocks we ask for a short justification: a sentence or two on what the addresses are for, such as “eight VMs for separate customers, each with its own public IPv4”. All add-ons are listed on [add-ons](https://dedijet.com/servers/add-ons). #### How the addresses reach your server Additional addresses are routed to your server; the exact method and gateway are shown in your dashboard. In practice: - You add each address to the main network interface as a /32, a single address, not with the netmask of your main IP. - You do not add another default gateway. Replies leave through the existing default route, with the additional address as their source. - New outgoing connections still use the main IP, unless a program binds to another address. If your dashboard shows a different method or gateway for a block, follow the dashboard. #### Configure the addresses The examples add `198.51.100.25` and `198.51.100.26` to the interface `enp1s0`; `ip -br link` shows your interface name. To try an address first, add it live. This does not survive a reboot: ```bash ip addr add 198.51.100.25/32 dev enp1s0 ``` ##### Ubuntu: Netplan Add the addresses to the existing interface in your `/etc/netplan/` file, after the main address: ```yaml network: version: 2 ethernets: enp1s0: addresses: - 203.0.113.10/24 - 198.51.100.25/32 - 198.51.100.26/32 - 2001:db8:1234:5678::1/64 routes: - to: default via: 203.0.113.1 - to: default via: fe80::1 ``` The main address and routes shown are examples: keep yours as they are, with the main address first so it stays the default source for outgoing traffic. Apply with `netplan try`, which rolls back after 120 seconds unless you confirm. ##### Debian: ifupdown In `/etc/network/interfaces`, add one stanza per address after the existing one for the interface: ```conf iface enp1s0 inet static address 198.51.100.25/32 iface enp1s0 inet static address 198.51.100.26/32 ``` Then add the same addresses live with `ip addr add`, as above, instead of restarting the interface over SSH. ##### AlmaLinux and Rocky Linux: NetworkManager ```bash nmcli connection modify enp1s0 +ipv4.addresses 198.51.100.25/32 nmcli connection modify enp1s0 +ipv4.addresses 198.51.100.26/32 nmcli connection up enp1s0 ``` Use the connection name from `nmcli connection show` if it differs from the interface name. > **Warning:** A typo in the network configuration can take the server offline. Keep the [IPMI console](https://dedijet.com/docs/ipmi-kvm-console) open while you apply changes, and reboot once at a quiet moment to check that every address comes back. #### Test the new addresses ```bash ip -br address show dev enp1s0 curl --interface 198.51.100.25 -sI https://www.debian.org ``` The first command lists the addresses on the interface. The second sends a request *from* the additional address: an HTTP response proves that traffic is routed both ways. From your own computer, `ping 198.51.100.25` should answer as well, unless your firewall drops ping. #### Bind services to an address Most server software listens on all addresses by default. To dedicate an address to one service, bind it explicitly: `listen 198.51.100.25:443 ssl;` in nginx, for example, or `smtp_bind_address = 198.51.100.25` in Postfix so that outgoing mail leaves from that address. An address that sends mail needs matching [reverse DNS](https://dedijet.com/docs/reverse-dns). Firewall rules apply to every address unless you say otherwise. To open a port on one address only, name it as the destination: ```bash ufw allow proto tcp to 198.51.100.25 port 443 ``` With firewalld, use a rich rule such as `firewall-cmd --permanent --add-rich-rule='rule family="ipv4" destination address="198.51.100.25" port port="443" protocol="tcp" accept'`, then `firewall-cmd --reload`. #### Give additional IPs to virtual machines Because the addresses are routed to your server, the host has to forward them to the VMs: put the VMs on a bridge without a physical port, enable IP forwarding, and add a /32 route per VM address. On a Proxmox VE host, in `/etc/network/interfaces`: ```conf auto vmbr1 iface vmbr1 inet static address 203.0.113.10/32 bridge-ports none bridge-stp off bridge-fd 0 up ip route add 198.51.100.25/32 dev vmbr1 up ip route add 198.51.100.26/32 dev vmbr1 ``` ```bash echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-forwarding.conf sysctl --system ``` Here `203.0.113.10` stands for the host’s main IP. Inside each VM, configure its address as a /32 and use the host’s main IP as the gateway, marked on-link. For an Ubuntu VM whose network card is `ens18`: ```yaml network: version: 2 ethernets: ens18: addresses: - 198.51.100.25/32 routes: - to: default via: 203.0.113.10 on-link: true ``` Add your usual `nameservers` section as well. Addresses given to VMs this way must not also be configured on the host’s own interface. [Install Proxmox VE](https://dedijet.com/docs/install-proxmox) covers the rest of the setup. #### Next steps Set a PTR record for each address that sends mail or needs a recognizable name, as described in [Set reverse DNS](https://dedijet.com/docs/reverse-dns). Every address is covered by the [acceptable use policy](https://dedijet.com/legal/acceptable-use), which rules out spam and other abuse. Still stuck? Open a ticket from [Support](https://dedijet.com/support) with the output of `ip -br address` and `ip route`. ### Benchmark CPU, memory, disks and network https://dedijet.com/docs/benchmark · updated 2026-10-14 · 5 min read Measure CPU, memory, NVMe and network performance with sysbench, 7-Zip, fio and iperf3, using a repeatable method that gives fair comparisons. Benchmarks are only useful when they are repeatable. This guide gives a short method and exact commands for CPU, memory, disks and network, so you can check a new server, compare two machines fairly or spot a problem. We do not publish benchmark scores for our servers: these commands let you measure yours. #### Method: make results comparable - Test an idle system. Stop your applications and check with top that nothing else uses CPU or disk. After a fresh install, wait until the initial RAID sync has finished: cat /proc/mdstat must show no resync or recovery in progress. - Run each test three times and keep the median. If runs differ a lot, find out why before trusting any number. - Write down the context: CPU model (lscpu), kernel (uname -r), OS release, tool versions, file system, RAID layout and the exact command line. - Compare like with like: same OS, kernel, tool version and parameters on both machines. A different thread count, block size or queue depth makes two results incomparable. Install the tools on Ubuntu or Debian: ```bash apt install -y sysbench p7zip-full fio iperf3 ``` On AlmaLinux or Rocky Linux, sysbench and 7-Zip come from EPEL: ```bash dnf install -y epel-release dnf install -y sysbench p7zip-plugins fio iperf3 ``` #### CPU: sysbench and 7-Zip ```bash sysbench cpu --threads=1 --time=30 run sysbench cpu --threads=$(nproc) --time=30 run ``` Compare `events per second`. The single-thread result reflects per-core speed, which most game servers and many web requests depend on. The multi-thread result shows total throughput for builds, rendering and virtualization. This test computes prime numbers inside the CPU cache, so it says little about memory or real applications. ```bash 7z b 7z b -mmt1 ``` 7-Zip’s built-in benchmark rates compression and decompression in MIPS; use the `Tot:` line, which combines both. `-mmt1` limits it to one thread. #### Memory: sysbench ```bash sysbench memory --threads=1 --memory-block-size=1M --memory-total-size=100G run sysbench memory --threads=$(nproc) --memory-block-size=1M --memory-total-size=100G run ``` Read the `MiB/sec` line. Add `--memory-oper=read` to measure reads instead of writes. Multi-thread bandwidth depends heavily on the number of memory channels: an 8- or 12-channel EPYC platform scales much further than a dual-channel desktop platform. #### Disks: fio > **Never run fio write tests against a raw device** such as `/dev/nvme0n1`, a partition or an md array that holds data: fio overwrites it and destroys the file system and RAID metadata. Always test a file on a mounted file system, as below, with enough free space. Each command runs for 60 seconds after a 5-second ramp, bypasses the page cache (`--direct=1`) and uses an 8 GB test file: ```bash fio --name=seq-read --filename=/var/tmp/fio.test --size=8G --rw=read --bs=1M --ioengine=libaio --iodepth=16 --numjobs=1 --direct=1 --runtime=60 --time_based --ramp_time=5 --group_reporting fio --name=seq-write --filename=/var/tmp/fio.test --size=8G --rw=write --bs=1M --ioengine=libaio --iodepth=16 --numjobs=1 --direct=1 --runtime=60 --time_based --ramp_time=5 --group_reporting fio --name=rand-read --filename=/var/tmp/fio.test --size=8G --rw=randread --bs=4k --ioengine=libaio --iodepth=32 --numjobs=4 --direct=1 --runtime=60 --time_based --ramp_time=5 --group_reporting fio --name=rand-write --filename=/var/tmp/fio.test --size=8G --rw=randwrite --bs=4k --ioengine=libaio --iodepth=32 --numjobs=4 --direct=1 --runtime=60 --time_based --ramp_time=5 --group_reporting rm /var/tmp/fio.test ``` - Sequential 1M results are bandwidth (BW=): what matters for backups, media and large files. - Random 4k results are IOPS: what matters for databases and virtual machines. Also read the clat percentiles: the 99th and 99.9th percentiles say more than the average about interactive workloads. - RAID 1 can serve reads from both disks, so parallel random reads may exceed one disk, while every write goes to both. - SSD write caches: many SSDs absorb writes in a fast cache and slow down once it is full. A longer run (--runtime=300) shows the sustained speed. - ZFS caches data in RAM, which can inflate read results: use a test file larger than RAM, or benchmark your real application. `--ioengine=io_uring` is a good alternative to `libaio` on current kernels; use the same engine on every machine you compare. #### Network: iperf3 iperf3 measures throughput between two machines you control. Start a server on one end, open TCP port 5201 in its firewall for the test, and stop it with `Ctrl`+`C` when you are done: ```bash iperf3 -s ``` On the other machine, test both directions (`-R` reverses the direction): ```bash iperf3 -c 203.0.113.10 -P 4 -t 30 iperf3 -c 203.0.113.10 -P 4 -t 30 -R ``` With a standard 1500-byte MTU, TCP payload tops out around 940 Mbit/s on a 1 Gbps port and around 9.4 Gbit/s on 10 Gbps; use more streams (`-P 8`) on 10 Gbps. Results are also limited by the other end, the distance and every network in between: test towards a server in the same region to measure the port, and towards your users to measure the path. For latency and route checks, see [network testing](https://dedijet.com/docs/network-testing). #### Interpret and compare results - Match the test to the workload: single-thread CPU and latency for game servers, random 4k IOPS and latency for databases, multi-thread CPU and memory bandwidth for builds and virtualization. - Finish with your own application. Synthetic tests isolate one component; a load test of the real service, for example pgbench for PostgreSQL, answers the question you actually care about. - Compare fairly: same commands, same OS and kernel, idle systems, three runs each. The hardware of every plan is listed on Compare servers. - Investigate outliers. A result far below similar hardware can point to throttling or a hardware fault: check disk health and temperatures first. #### Next steps - Check the path to your users with mtr and iperf3. - Need more cores or faster storage? Compare Performance and Enterprise servers. - Results far below what the hardware should do? Send your commands and outputs to support. ### Billing, renewals and cancellation https://dedijet.com/docs/billing-and-renewals · updated 2026-10-14 · 4 min read How monthly prepaid billing works: renewal dates, invoices, crypto payments, account balance, suspension rules, cancellation, refunds and VAT. DediJet servers are rented month by month, paid in advance in cryptocurrency. There is no setup fee on any listed server and no long contract: you can cancel at any time. This page explains invoices, renewals, payments, suspension, cancellation and refunds. #### How billing works - Monthly and prepaid. Each month is paid before it starts. - Prices exclude VAT. VAT is added to invoices where applicable. - Invoices in USD or EUR. Invoices are denominated in USD (or EUR) and converted to cryptocurrency at checkout. EUR prices shown on the site are indicative. - Delivery starts on confirmation. A new in-stock server is provisioned as soon as your payment is confirmed; see How instant delivery works. - Add-ons such as additional IPv4 addresses, backup space or a Windows Server license are billed monthly too; see Add-ons. #### Renewals and account balance A server renews every month on the same day of the month as its order: ordered on the 14th, it renews on the 14th. The renewal invoice is issued 7 days before that due date, which leaves a week to pay it. You can download all your invoices from your dashboard; keep them for your accounting. You can top up your account balance in crypto at any time, and renewals are paid from the balance automatically. A balance that covers a few months means no invoice to pay by hand and no risk of suspension while you are away. SLA credits are also added to your balance, and unused balance can be refunded (see Refunds below). #### Paying with cryptocurrency We accept Bitcoin, Ethereum, Monero, USDT (TRC-20) and Solana, and nothing else. When you top up, the exchange rate is locked for 30 minutes: send the payment within that window. Typical confirmation times, for guidance only: | Payment method | Typical confirmation time | | --- | --- | | USDT on TRON (TRC-20) | About 1 minute (19 confirmations) | | Solana | About 1 minute (finalized) | | Ethereum | About 3 minutes (12 confirmations) | | Bitcoin | About 10–20 minutes (1 confirmation) | | Monero | About 20 minutes (10 confirmations) | For the fastest credit, pay with USDT on TRC-20 or with Solana. Two habits prevent most payment problems: - Use the network shown on the payment page. We accept USDT on TRON (TRC-20) only: USDT sent on Ethereum, BNB Chain or any other network cannot be recovered. - Check the amount that arrives. When you pay from an exchange, its withdrawal fee may be deducted from what you send: make sure the full invoice amount reaches the address. Step-by-step details are on [Pay with crypto](https://dedijet.com/pay-with-crypto). #### If an invoice is not paid | When | What happens | | --- | --- | | 7 days before the due date | The renewal invoice is issued, and paid from your balance if it covers the amount. | | Due date | The renewal is due. | | 3 days after the due date | The server is suspended. | | 10 days after the due date | The server is terminated and its disks are securely erased. | > **Termination is final.** Once the disks are securely erased, the data cannot be recovered, by you or by us. If you might miss a payment, top up your balance in advance or copy your data off the server. Paying the overdue invoice before termination is what brings a suspended server back. If it does not come back online after payment, open a ticket. #### Cancel a server Cancel at any time from your dashboard. The server stays online until the end of the month you have paid for, and is then not renewed. Before the machine returns to stock, its disks are securely erased, so copy everything you need before the last day. Partial months are not refunded. #### Refunds - Late delivery: if we cannot deliver an in-stock server within 24 hours of payment confirmation, you get a full refund on request. - Partial months are not refunded, whether you cancel early or stop using the server. - Unused balance is refundable on request, in the original cryptocurrency, minus the network fee. - Value: refunds are calculated at the USD value of the original payment, not in coins. If the coin’s price has moved since you paid, you receive a different number of coins for the same USD value. #### Upgrade to a bigger server A bare-metal server cannot be resized in place: its CPU and memory are physical parts of one machine. To move to a bigger configuration, open a ticket and we will suggest the best path. The usual route is to order the new server, migrate, then cancel the old one, which stays online until the end of its paid month, so both can run in parallel during the move. Data migration is up to you unless we quote it separately. Some upgrades apply to the same machine: extra NVMe drives where the chassis has a free bay, a 10 Gbps port on 1 Gbps plans, or more IPv4 addresses (see [Add-ons](https://dedijet.com/servers/add-ons)). #### Still stuck? Billing is in scope for our 24/7 support: [contact support](https://dedijet.com/support) with your invoice number. The full rules are in the [Terms of service](https://dedijet.com/legal/terms). ### How DDoS protection works on your server https://dedijet.com/docs/ddos-protection · updated 2026-10-14 · 5 min read What the always-on L3/L4 DDoS mitigation filters, what it cannot stop, what you may notice during an attack, and how to protect HTTP and game services. Every DediJet server includes always-on, network-level DDoS mitigation at no extra cost. There is nothing to install or switch on: attacks are detected automatically and filtered upstream, before the traffic reaches your server’s port. This page explains what the protection covers, what it does not, and how to make your own services harder to knock over. #### How the mitigation works Traffic entering our network is analyzed continuously. When an attack against one of your addresses is detected, its traffic is filtered upstream: packets that match attack patterns are dropped, and legitimate packets continue to your server. Mitigation starts automatically, without a ticket or any manual step. We filter rather than null-route whenever possible. A null route, which drops all traffic to one IP address, remains a last resort. #### What is filtered The mitigation targets layer 3 and layer 4 attacks, which try to exhaust bandwidth or connection state and can be recognized from packet characteristics alone: | Attack | How it works | | --- | --- | | UDP floods | Large volumes of UDP packets aimed at your address to saturate the link or the service behind a port. | | SYN floods | Masses of TCP connection requests that are never completed, to fill connection tables. | | ACK floods | Spoofed TCP packets that force the server and network devices to look up connections that do not exist. | | Amplification: DNS, NTP, SSDP, memcached, CLDAP | The attacker sends small spoofed requests to misconfigured servers on the internet, which send much larger replies to your address. | #### What it does not stop: HTTP floods Application-layer (layer 7) attacks send requests that look valid: complete TCP connections and correct HTTP, often from many real infected devices. A network filter cannot tell them apart from your visitors, so protecting applications is your responsibility, and application-layer attacks are excluded from the [SLA](https://dedijet.com/legal/sla). What works: - A reverse proxy, CDN or WAF in front of public websites. Once it is in place, accept HTTP and HTTPS only from the proxy’s address ranges, so attackers cannot bypass it by targeting your IP directly. - Caching, so repeated requests never reach your application and database. - Rate limits per client address, and short timeouts against slow-request attacks. A starting point for nginx. Define the zones in the `http` context, for example in `/etc/nginx/conf.d/limits.conf`: ```nginx limit_req_zone $binary_remote_addr zone=perip:10m rate=10r/s; limit_conn_zone $binary_remote_addr zone=connperip:10m; limit_req_status 429; client_header_timeout 10s; client_body_timeout 10s; ``` Then apply them where you need them: ```nginx location / { limit_req zone=perip burst=20 nodelay; limit_conn connperip 20; proxy_pass http://127.0.0.1:8080; } ``` Tune `rate` and `burst` to your real traffic: a page that loads 40 assets needs a larger burst than an API endpoint. Behind a CDN, restore the visitor’s address first with the real IP module (`set_real_ip_from`, `real_ip_header`); otherwise every request seems to come from the proxy and the limits hit everyone at once. #### What you may notice during an attack Mitigation is automatic and needs nothing from you. When an attack starts, you may notice a brief increase in latency, or players on a game server a short lag spike, while filtering engages. Rebooting or reinstalling does not help: the traffic targets your IP address, not the operating system. #### What to do if you suspect an attack 1. **Do not reboot repeatedly.** A reboot does not stop traffic aimed at your address; it disconnects your legitimate users and makes diagnosis harder. Check the [status page](https://dedijet.com/status) for network-wide incidents. 2. **Check the path from outside.** Run mtr from your own computer towards the server, and from the server towards your computer: `mtr -rwzc 100 203.0.113.10` Loss that starts at one hop and continues to the last hop is real. Loss shown only on an intermediate hop is usually ICMP rate limiting by that router. See [network testing](https://dedijet.com/docs/network-testing) for details. 3. **Check the server itself.** A busy application can look like an attack. Compare load and connection counts with your usual values: `uptime ss -s ss -tn state syn-recv | wc -l` 4. **Open a ticket.** If the server is unreachable, mark it critical: our first-response target for critical issues is 30 minutes. Include the affected IP addresses, start and end times with the time zone (UTC is easiest), what you observe (loss, latency, which ports or services), your mtr reports in both directions and, if you can, a short packet capture: `tcpdump -ni any -c 2000 -w /root/attack.pcap` #### Game servers and UDP Most game servers speak UDP, which makes them frequent targets. UDP floods and amplification attacks are filtered at the network level before they reach your port; the rest depends on your configuration: - Open only the game ports you use, and restrict admin ports (RCON, web panels, databases) to your own addresses. - Keep the server software updated: recent versions of popular engines add challenge-response checks to query packets, so they cannot be used for reflection. - Write down the time, server address and what players saw when you report lag: reports without timestamps are hard to trace. More tips for hosting games are on [Game servers](https://dedijet.com/solutions/game-servers). #### Don’t become an amplifier yourself Amplification attacks rely on misconfigured servers. Make sure yours is not one of them; our [acceptable use policy](https://dedijet.com/legal/acceptable-use) forbids open DNS and NTP resolvers left exposed to the internet. - List UDP listeners with ss -ulpn and close everything you do not serve on purpose. - DNS: a recursive resolver must answer only your own networks (access-control in Unbound, allow-recursion in BIND). - NTP: chrony serves time to other machines only with an allow directive; leave it out unless you need it. - Memcached: bind it to 127.0.0.1 and keep UDP disabled (-U 0). - SSDP and CLDAP: media servers with UPnP and Active Directory domain controllers should never answer on a public address. #### Still stuck? - Close the rest of the attack surface with Harden a new server. - Read how our network is built on Network & DDoS protection. - Under attack and unsure what you see? Open a ticket: DDoS mitigation is in scope for 24/7 support. ### Check disk health with smartctl and nvme-cli https://dedijet.com/docs/disk-health · updated 2026-10-14 · 6 min read Read SMART and NVMe health data, run self-tests, schedule smartd checks with email alerts, and know when a failing disk needs a ticket. Every DediJet server passes SMART and NVMe health checks during burn-in, before it joins the ready pool. Disks still wear out and occasionally fail, and they usually warn you first. Two tools read those warnings: `smartctl` (from smartmontools) for every disk type, and `nvme-cli` for NVMe drives. #### Install the tools On Ubuntu and Debian: ```bash apt update apt install -y smartmontools nvme-cli ``` On AlmaLinux and Rocky Linux: ```bash dnf install -y smartmontools nvme-cli ``` Proxmox VE already includes smartmontools. List your disks with their serial numbers; `ROTA` = 1 means a spinning HDD: ```bash lsblk -d -o NAME,MODEL,SERIAL,SIZE,ROTA,TRAN ``` #### Read SMART data on HDDs and SATA SSDs ```bash smartctl -a /dev/sda ``` Start with the line `SMART overall-health self-assessment test result`. `FAILED` means the disk must be replaced. `PASSED` only means no attribute has crossed the vendor’s threshold yet, so read the attributes too, using the `RAW_VALUE` column: ```text ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE 5 Reallocated_Sector_Ct 0x0033 100 100 010 Pre-fail Always - 0 9 Power_On_Hours 0x0032 099 099 000 Old_age Always - 1874 194 Temperature_Celsius 0x0002 200 200 000 Old_age Always - 31 197 Current_Pending_Sector 0x0022 100 100 000 Old_age Always - 0 198 Offline_Uncorrectable 0x0008 100 100 000 Old_age Offline - 0 199 UDMA_CRC_Error_Count 0x000a 200 200 000 Old_age Always - 0 ``` | Attribute | Meaning | Act when | | --- | --- | --- | | 5 Reallocated_Sector_Ct | Bad sectors already replaced by spare ones | Non-zero and growing between checks | | 197 Current_Pending_Sector | Unreadable sectors waiting to be remapped | Any non-zero value | | 198 Offline_Uncorrectable | Sectors that failed during offline scans | Any non-zero value | | 199 UDMA_CRC_Error_Count | Transfer errors between disk and controller, usually cabling or backplane | Increasing: open a ticket, the path is at fault rather than the media | | 194 Temperature_Celsius | Current drive temperature | Above the maximum in the drive’s datasheet | Attribute names and numbers vary by vendor, and SAS drives report `Elements in grown defect list` instead. For the full picture, including the drive’s own error log, use `smartctl -x`. #### Read NVMe health ```bash smartctl -a /dev/nvme0 nvme smart-log /dev/nvme0 ``` Both read the same health log. `/dev/nvme0` is the controller; `/dev/nvme0n1` is its namespace, the block device you partition. ```text Critical Warning: 0x00 Temperature: 38 Celsius Available Spare: 100% Available Spare Threshold: 10% Percentage Used: 1% Data Units Written: 5,322,198 [2.72 TB] Unsafe Shutdowns: 3 Media and Data Integrity Errors: 0 Error Information Log Entries: 0 ``` - Critical Warning must be 0x00. Any other value (spare below threshold, temperature, degraded reliability, read-only mode) needs attention now. - Available Spare is the reserve of replacement blocks. Once it drops below the threshold, the drive is near the end of its life. - Percentage Used is the vendor’s estimate of rated endurance consumed. It can exceed 100% while the drive keeps working, but plan a replacement. - Media and Data Integrity Errors should stay at 0. A growing count means the drive cannot reliably return your data. - Error Information Log Entries often counts harmless events, such as unsupported commands sent by tools. It is not a failure signal on its own. - Data Units Written counts units of 512,000 bytes; smartctl converts the total for you. #### Run short and long self-tests Self-tests run inside the drive’s firmware while the server keeps working. A short test usually takes two minutes or less; a long (extended) test reads the whole surface and can take many hours on large HDDs. smartctl prints the estimate when the test starts. ```bash smartctl -t short /dev/sda smartctl -t long /dev/sda smartctl -l selftest /dev/sda ``` In the log, `Completed without error` is what you want; `Completed: read failure` with an LBA number means the drive found unreadable sectors. For NVMe drives that support self-tests, use nvme-cli (code 1 = short, 2 = extended); an operation result of 0 in its log means success. smartctl can do the same from smartmontools 7.4 onwards. ```bash nvme device-self-test /dev/nvme0 -s 1 nvme self-test-log /dev/nvme0 ``` > **Back up first.** If a disk already shows pending sectors or media errors, copy your data off before you start a long test: a full surface read puts extra stress on a weak drive. #### Schedule checks and email alerts with smartd The `smartd` daemon checks every disk every 30 minutes and can start self-tests on a schedule. Edit `/etc/smartd.conf` (Debian, Ubuntu) or `/etc/smartmontools/smartd.conf` (AlmaLinux, Rocky Linux) and replace the existing `DEVICESCAN` line, because smartd ignores the lines that follow it: ```conf DEVICESCAN -a -n standby,q -s (S/../.././02|L/../../6/03) -m root -M test ``` - -a monitors health status, attributes, error logs and self-test logs. - -s (S/../.././02|L/../../6/03) starts a short test every day at 02:00 and a long test every Saturday at 03:00. On NVMe drives, scheduled self-tests need smartmontools 7.5 or later (check with smartctl --version); older versions still monitor NVMe health. - -m root sends alerts to root through the mail command, so install a mail client and a transfer agent, for example mailutils with Postfix or msmtp, and forward root’s mail to your own mailbox with an alias in /etc/aliases. - -M test sends one test email at startup. Remove it once the email has arrived. Restart the daemon and check its log. On Ubuntu and Debian: ```bash systemctl restart smartmontools journalctl -u smartmontools -n 50 ``` On AlmaLinux and Rocky Linux, the service is named `smartd`: `systemctl enable --now smartd`, then `journalctl -u smartd -n 50`. #### When to open a ticket Replacing failed hardware is part of the service: under our [SLA](https://dedijet.com/legal/sla), a failed component is replaced within 4 hours of diagnosis, 24/7. Open a ticket when you see any of these: - An overall assessment of FAILED, or a failed self-test. - Reallocated sectors that keep growing, or any pending or offline-uncorrectable sectors. - An NVMe critical warning other than 0x00, spare below threshold, or growing media errors. - A growing UDMA CRC error count. - A disk that dropped out of your RAID array, or kernel messages such as I/O error or NVMe controller resets in journalctl -k. Put everything in the first message to speed up the diagnosis: 1. The server’s IP address and the disk you suspect, with its serial number from smartctl -i. 2. The full output of smartctl -x for that disk, attached as a file. 3. With software RAID: cat /proc/mdstat and the serial number of the disk that must stay in place. 4. Relevant kernel log lines with their timestamps, and whether your data is backed up. With software RAID, follow [Manage software RAID 1 with mdadm](https://dedijet.com/docs/software-raid) to prepare the array before the swap and rebuild it afterwards. #### Next steps - Measure performance with a repeatable method: Benchmark CPU, disks and network. - Repair a system that no longer boots from rescue mode. - Not sure how to read your output? Contact support: hardware diagnosis is in scope, 24/7. ### First steps on your new dedicated server https://dedijet.com/docs/first-steps · updated 2026-10-14 · 6 min read Log in to your new server, install updates, create a sudo user with your SSH key, turn on a firewall and check the CPU, RAM, disks and RAID 1. Your server was installed automatically and its credentials are waiting in your dashboard. This checklist takes it from the first login to a system that is up to date, reachable with your own user and SSH key, and protected by a basic firewall. It covers Ubuntu, Debian, AlmaLinux and Rocky Linux. If you installed Windows Server, follow [the Windows Server guide](https://dedijet.com/docs/windows-server) instead. #### Your credentials and first login Open the server in your dashboard (*Servers*, then the server) for what you need for the first connection: - The server’s IPv4 address, shown as 203.0.113.10 in this guide. Your routed /64 IPv6 subnet is listed in your dashboard. - The root password, unless you chose to install your SSH key instead. In that case, log in with the matching private key. - Out-of-band access is in your dashboard: open the server, then choose Console (IPMI). Keep it in mind, because it works even when SSH does not. Linux, macOS and current versions of Windows include an OpenSSH client. Open a terminal (PowerShell on Windows) and connect as root: ```bash ssh root@203.0.113.10 ``` On the first connection, SSH shows the server’s host key fingerprint and asks you to confirm it. To be sure nothing sits between you and your server, compare it with the fingerprint printed by this command in the IPMI console, then type `yes`: ```bash ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub ``` If you logged in with the root password shown in your dashboard, replace it right away, then clear it from the dashboard with *I saved it: clear it from my account*: ```bash passwd ``` The commands in this guide run as root. Once you work as a normal user, prefix them with `sudo`. #### Install updates The installed image is recent, but security updates are published continuously. Install them before anything else. **Ubuntu and Debian** ```bash apt update apt -y upgrade ``` **AlmaLinux and Rocky Linux** ```bash dnf -y upgrade ``` If a new kernel was installed, reboot so that it takes effect. Your session closes; reconnect when the server is back. Server hardware can take a few minutes to run through its firmware checks. ```bash reboot ``` For updates from now on, Ubuntu usually has `unattended-upgrades` enabled for security fixes. On Debian, install it with `apt install -y unattended-upgrades` and enable it with `dpkg-reconfigure -plow unattended-upgrades`; on AlmaLinux and Rocky Linux, use `dnf-automatic`. #### Set the hostname and time zone Give the server a fully qualified name in a domain you control: ```bash hostnamectl set-hostname server.example.com ``` Make the name resolve locally by adding a line with the public IP to `/etc/hosts`. On Debian and Ubuntu, replace the `127.0.1.1` line if it still carries the old name: ```conf 203.0.113.10 server.example.com server ``` At your DNS provider, create a matching `A` record (and `AAAA` for IPv6), then set the server’s [reverse DNS](https://dedijet.com/docs/reverse-dns) to the same name. This matters as soon as the server sends email. UTC is the most practical time zone for servers: logs from different machines line up without conversion. Set it and check that the clock is synchronized: ```bash timedatectl set-timezone UTC timedatectl ``` Look for `System clock synchronized: yes`. If you prefer local time, `timedatectl list-timezones` lists names such as `Europe/Amsterdam`. #### Create a sudo user and add your SSH key Working as root all day turns every typo into a system-wide one. Create a personal account, called `deploy` here, with sudo rights. **Ubuntu and Debian** (minimal Debian images may need `apt install -y sudo` first): ```bash adduser deploy usermod -aG sudo deploy ``` **AlmaLinux and Rocky Linux** ```bash useradd -m -G wheel deploy passwd deploy ``` Next, give the account your SSH key. If root already accepts your key, copy its `authorized_keys` file with the right owner and permissions: ```bash install -d -m 700 -o deploy -g deploy /home/deploy/.ssh install -m 600 -o deploy -g deploy /root/.ssh/authorized_keys /home/deploy/.ssh/authorized_keys ``` On AlmaLinux and Rocky Linux, also run `restorecon -R /home/deploy/.ssh` so the SELinux labels are correct. No key yet? Create one and install it with `ssh-copy-id`, as described in [Log in with SSH keys](https://dedijet.com/docs/ssh-keys). Test from a **second** terminal, leaving the first one open: ```bash ssh deploy@203.0.113.10 sudo whoami ``` The last command should print `root`. When key logins work for your user, you can disable password authentication for SSH; the SSH keys guide shows how to do it without locking yourself out. #### Turn on a basic firewall DediJet filters network-level DDoS attacks upstream, before they reach your port. That does not decide which of your services are reachable: a host firewall does. Allow SSH first, then open ports as you add services. > **Warning:** Always allow SSH *before* you enable the firewall. If you lock yourself out, log in through the [IPMI console](https://dedijet.com/docs/ipmi-kvm-console) and fix the rules from there. ##### Ubuntu and Debian: ufw ufw is preinstalled on Ubuntu. On Debian, install it with `apt install -y ufw`. Then: ```bash ufw default deny incoming ufw default allow outgoing ufw allow 22/tcp ufw enable ufw status verbose ``` Answer `y` when `ufw enable` warns about existing connections: your session stays open because SSH is allowed. Open more ports the same way, for example `ufw allow 80,443/tcp` for a web server. The rules apply to IPv4 and IPv6. ##### AlmaLinux and Rocky Linux: firewalld ```bash dnf install -y firewalld systemctl enable --now firewalld firewall-cmd --permanent --add-service=ssh firewall-cmd --reload firewall-cmd --list-all ``` Add services with `firewall-cmd --permanent --add-service=https` or ports with `--add-port=25565/tcp`, then run `firewall-cmd --reload`. If `--list-all` shows services you don’t use, such as `cockpit`, remove them with `--remove-service`. > **Note:** Docker publishes container ports with its own packet-filter rules, and that traffic bypasses ufw. Bind published ports to `127.0.0.1` unless they really must be public. #### Check the hardware Confirm that the server matches your order and that its disks are healthy: ```bash lscpu | grep -E 'Model name|Socket|Core|Thread' free -h lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT ip -br address ``` `lscpu` shows the CPU model, cores and threads; `free -h` the memory, slightly below the nominal amount because firmware and kernel reserve some; `lsblk` the disks and partitions; `ip -br address` your IPv4 and IPv6 addresses. On servers with two disks, software RAID 1 is configured by default: both disks hold the same data, so the server keeps running if one of them fails. Check the array: ```bash cat /proc/mdstat ``` ```text md1 : active raid1 nvme1n1p3[1] nvme0n1p3[0] 974452736 blocks super 1.2 [2/2] [UU] md0 : active raid1 nvme1n1p2[1] nvme0n1p2[0] 1046528 blocks super 1.2 [2/2] [UU] ``` `[2/2] [UU]` means both members are present and in sync. Array names, partitions and sizes vary between servers. A `resync` line with a progress bar means the mirror is still being built in the background; the server is fully usable meanwhile. An underscore in place of a `U`, as in `[U_]`, means a disk is missing or has failed: read [Software RAID](https://dedijet.com/docs/software-raid) and [Disk health](https://dedijet.com/docs/disk-health), then open a ticket. #### Next steps The server is updated, reachable with your own account and behind a firewall: you are cleared for takeoff. From here: - Switch to SSH keys only and disable password logins. - Harden the server further before you expose services. - Check or extend your IPv6 configuration. - Benchmark the server to keep a baseline for later comparisons. - Keep the IPMI console and rescue mode guides at hand: they are your way back in when something breaks. Something does not look right? Our engineers answer tickets 24/7: see [Support](https://dedijet.com/support). ### Dedicated server glossary https://dedijet.com/docs/glossary · updated 2026-10-14 · 9 min read Clear definitions of 61 dedicated server, network and storage terms, from ARP, BGP and IPMI to NVMe, RAID, ECC memory, unmetered bandwidth and ZFS. #### A - **Anycast**: A routing method in which the same IP address is announced from several locations at once, and BGP sends each visitor to the nearest one. DNS services and CDNs use anycast to answer from close by and to spread attack traffic. - **ARP**: Address Resolution Protocol. On an IPv4 network, it finds the MAC address of the machine that holds a given IP address. IPv6 uses Neighbor Discovery (NDP) for the same job. - **ASN**: Autonomous System Number: the identifier of a network, such as a hosting provider or an ISP, that exchanges routes with other networks over BGP. `mtr -z` shows the ASN of each hop. #### B - **Bandwidth vs throughput**: Bandwidth is the capacity of a link, such as a 1 Gbps port. Throughput is the data actually transferred, which is lower because of protocol overhead, latency and the other end of the connection: a 1 Gbps port carries about 940 Mbit/s of TCP payload. See [Unmetered bandwidth explained](https://dedijet.com/blog/unmetered-bandwidth-explained). - **Bare metal**: A physical server used by a single customer, with no provider hypervisor between the operating system and the hardware. Every DediJet server is bare metal. - **BGP**: Border Gateway Protocol, which networks use to exchange routes on the internet. Our network is multi-homed with several transit providers over BGP; see [Network](https://dedijet.com/network). - **BMC**: Baseboard Management Controller: a small independent computer on the motherboard that provides IPMI, including power control, hardware sensors and a remote console, even when the server is switched off. - **Burn-in**: Stress testing hardware before it goes into service. Every in-stock DediJet server passes a memory test, a CPU stress test and SMART/NVMe health checks before it joins the ready pool; see [How instant delivery works](https://dedijet.com/instant-delivery). #### C - **CDN**: Content delivery network: caching servers in many locations that deliver content close to visitors and absorb much of the traffic, including application-layer floods, before it reaches your origin server. - **Confirmation (blockchain)**: A block added to a blockchain after the block that holds your transaction. Each new block makes the payment harder to reverse, so we credit a top-up once it has enough confirmations: 1 for Bitcoin, 10 for Monero, 12 for Ethereum, 19 for USDT on TRON and finalization for Solana. See [Pay with crypto](https://dedijet.com/pay-with-crypto). - **Core vs thread**: A core is a physical processing unit; with simultaneous multithreading (SMT), each core runs two hardware threads. A 16C/32T processor such as the Ryzen 9 9950X has 16 cores and 32 threads. The second thread adds throughput, but much less than a second core would. - **Cross-connect**: A physical cable inside a data center that links one party’s equipment directly to another network or customer in the same building. #### D - **DDoS**: Distributed denial of service: an attack in which many machines send traffic to exhaust a target’s bandwidth, connection tables or application. Network-level (L3/L4) mitigation is included with every server; see [How DDoS protection works](https://dedijet.com/docs/ddos-protection). - **DDR5**: The fifth generation of DDR memory, used on current AMD Ryzen and EPYC platforms. Its on-die ECC only corrects errors inside the memory chips; end-to-end error correction requires ECC modules, listed as DDR5 ECC. - **Dedicated server**: A whole physical server rented to one customer: every core, all the memory and the full disk and network capacity are yours. Compare it with a VPS in [Dedicated server vs VPS](https://dedijet.com/blog/dedicated-server-vs-vps). #### E - **ECC memory**: Error-correcting code memory corrects single-bit errors and detects double-bit errors, preventing silent data corruption and many crashes. Plans listed with DDR4 ECC or DDR5 ECC use it. #### F - **fio**: Flexible I/O Tester, the standard tool for measuring storage performance: IOPS, bandwidth and latency. See [Benchmark CPU, memory, disks and network](https://dedijet.com/docs/benchmark). #### G - **Gbps**: Gigabits per second, the unit of network speed. 1 Gbps is at most 125 MB/s before protocol overhead; 10 Gbps is 1.25 GB/s. #### H - **HDD**: Hard disk drive, with spinning magnetic platters. It offers large capacity at a low cost per terabyte, but far fewer random IOPS than an SSD. Our [storage servers](https://dedijet.com/servers/storage) combine large HDDs with NVMe drives. - **Hot swap**: Replacing a component, typically a disk or a power supply, while the server keeps running. Whether a drive can be swapped hot depends on the chassis and its backplane. - **Hypervisor**: Software that runs virtual machines and shares the hardware between them. Type 1 hypervisors such as KVM (used by Proxmox VE), VMware ESXi and Hyper-V run directly on the hardware. #### I - **IOPS**: Input/output operations per second: how many small reads or writes a disk handles. Only compare IOPS figures measured with the same block size and queue depth. - **IPMI**: Intelligent Platform Management Interface, the standard for out-of-band management through the BMC. Your dashboard gives you the IPMI console, power control and virtual media; see [Use the IPMI/KVM console](https://dedijet.com/docs/ipmi-kvm-console). - **IPv4**: The 32-bit internet address format, written like 203.0.113.10. Each server includes one dedicated IPv4 address, and more cost $2.50 per IP per month; see [Additional IPv4 addresses](https://dedijet.com/docs/additional-ipv4). - **IPv6**: The 128-bit successor of IPv4, written like 2001:db8::1. Every server includes a routed /64 subnet, and a /56 is free on request; see [Configure your /64 IPv6 subnet](https://dedijet.com/docs/ipv6-setup). - **IXP**: Internet exchange point: a place where many networks connect to exchange traffic directly. Frankfurt, Amsterdam and London are home to some of the largest IXPs in the world. #### J - **Jitter**: The variation in latency from one packet to the next. Low jitter matters for voice, video calls and game servers; mtr shows it as the spread between the best and worst times of each hop. #### K - **KVM (Linux hypervisor)**: Kernel-based Virtual Machine, the virtualization layer built into the Linux kernel. Together with QEMU, it runs the virtual machines in Proxmox VE. - **KVM-over-IP**: Remote keyboard, video and mouse over the network: you see the server’s screen from power-on and type as if you were in front of it. At DediJet it is part of the IPMI console in your dashboard. #### L - **L3 cache**: The largest, last level of CPU cache, shared between cores. More cache helps games, databases and simulations: for example, 32 MB on a Ryzen 7 9700X and 256 MB on an EPYC 9354P. - **Latency**: The time a packet takes to travel, usually measured as a round trip (ping). Light in fiber covers about 200 km per millisecond, so distance sets a floor no network can beat. Estimated values for each location are on the [latency checker](https://dedijet.com/network/latency). #### M - **mdadm**: The Linux tool for creating and managing software RAID arrays. Two-disk DediJet servers get software RAID 1 by default; see [Manage software RAID 1 with mdadm](https://dedijet.com/docs/software-raid). - **MTR**: A network diagnostic tool that combines traceroute and ping to show loss and latency at every hop. Attach a report (`mtr -rwzc 100`) when you report a network problem; see [Network testing](https://dedijet.com/docs/network-testing). #### N - **Null route**: Dropping all traffic to one IP address at the router, also called blackholing. It protects the rest of the network but takes the target offline, which is why we filter attacks rather than null-route whenever possible. - **NVMe**: Non-Volatile Memory Express, the protocol SSDs use over PCIe, with much lower latency and far more parallel queues than SATA. Linux names NVMe drives `nvme0n1`, `nvme1n1` and so on. #### P - **Packet loss**: The share of packets that never arrive. Loss that continues to the last hop of an mtr report is real; loss on a single intermediate hop is usually a router limiting its own ICMP replies. - **PCIe**: PCI Express, the bus that connects NVMe drives, GPUs and network cards to the CPU. Each generation roughly doubles bandwidth per lane: about 2 GB/s for PCIe 4.0 and 4 GB/s for PCIe 5.0, in each direction. - **Peering**: Two networks exchanging traffic directly, at an IXP or over a private link, instead of through a paid transit provider. Direct paths often shorten routes and lower latency. - **Port speed**: The line rate of a server’s network port: 1 Gbps or 10 Gbps on DediJet plans, unmetered. 1 Gbps plans can be upgraded to 10 Gbps for $129 per month; see [Add-ons](https://dedijet.com/servers/add-ons). - **Proxmox VE**: An open-source virtualization platform based on Debian, with KVM virtual machines, LXC containers, ZFS and a web interface. Proxmox VE 9 is a one-click install; see [Install Proxmox VE 9](https://dedijet.com/docs/install-proxmox). - **PTR record**: The DNS record that maps an IP address back to a hostname. Receiving mail servers expect a sending server’s PTR record to match its hostname; see [Reverse DNS](https://dedijet.com/docs/reverse-dns). #### R - **Rack unit (U)**: The standard unit of rack height: 1U is 1.75 inches (44.45 mm). Servers are described as 1U, 2U and so on. - **RAID 0**: Striping: data is split across disks for speed and full capacity, with no redundancy. If one disk fails, all data in the array is lost. It can be selected instead of RAID 1 at install time. - **RAID 1**: Mirroring: every write goes to two disks, so the array survives the failure of one, at the cost of half the raw capacity. It is the default on two-disk DediJet servers, and it is not a backup. - **RAID 10**: A stripe across mirrored pairs, using four or more disks: the speed of striping with the redundancy of mirroring. Half of the raw capacity is usable. - **Rescue mode**: A temporary Linux system you start from the dashboard to repair an installed system that no longer boots, reset a password or copy data off. See [Rescue mode](https://dedijet.com/docs/rescue-mode). - **Reverse DNS**: Looking up a hostname from an IP address, answered by PTR records. You can set reverse DNS for your addresses in the dashboard, free of charge. - **Root access**: Full administrative control of the system: root on Linux, Administrator on Windows. Every DediJet server includes it, and servers are unmanaged: you are the administrator. #### S - **SLA**: Service level agreement: the commitments a provider makes and the credits you receive if they are missed. Ours targets 99.9% network availability per calendar month and hardware replacement within 4 hours of diagnosis; see the [SLA](https://dedijet.com/legal/sla). - **SMART**: Self-Monitoring, Analysis and Reporting Technology: health data recorded by the disks themselves, such as reallocated sectors or wear. Read it with smartctl; see [Check disk health](https://dedijet.com/docs/disk-health). - **SSD**: Solid-state drive: flash storage with no moving parts. SATA SSDs use the older disk interface; NVMe SSDs connect over PCIe and are much faster. - **Subnet / CIDR**: A block of IP addresses written as a prefix and a length, such as 198.51.100.0/24 (256 addresses). A /29 holds 8 IPv4 addresses and a /28 holds 16, while an IPv6 /64 holds about 18 quintillion. #### T - **TDP**: Thermal design power: the heat, in watts, that a processor’s cooling must remove under sustained load, for example 65 W for a Ryzen 7 9700X and 170 W for a Ryzen 9 9950X. Actual power draw can differ. - **Tier (data center)**: A classification of data center redundancy from Tier I to Tier IV, defined by the Uptime Institute. Our locations are carrier-neutral data centers with redundant (N+1 or better) power and cooling; see [Locations](https://dedijet.com/locations). - **Transit**: IP transit: a paid service in which a provider carries your traffic to the rest of the internet. Our network is multi-homed with several transit providers. Reselling DediJet bandwidth as transit is not allowed by the [acceptable use policy](https://dedijet.com/legal/acceptable-use). - **TRC-20**: The token standard of the TRON blockchain. USDT exists on several blockchains; we accept it on TRON (TRC-20) only, where it confirms in about a minute with low fees. USDT sent on any other network cannot be credited. #### U - **Unmetered**: Traffic is not counted or billed by volume: the limit is the speed of your port, 24/7, within the acceptable use policy. A 1 Gbps unmetered port still moves at most 1 Gbps at any moment. #### V - **Virtual media**: An IPMI feature that mounts an ISO image over the network as if it were a USB or DVD drive in the server, so you can install any operating system yourself, such as TrueNAS or VMware ESXi with your own license. - **VLAN**: Virtual LAN: a separate network segment on shared switches. A private VLAN between your servers in the same location is free on request. - **VPS**: Virtual private server: a virtual machine on a host shared with other customers. Less expensive to start with, but CPU, disk and network capacity are shared; see [Dedicated server vs VPS](https://dedijet.com/blog/dedicated-server-vs-vps). #### Z - **ZFS**: A combined file system and volume manager that checksums every block, repairs errors from redundant copies, and supports snapshots, compression and replication. Popular on Proxmox VE and storage servers, it uses RAM for its ARC cache. ### Install Proxmox VE 9 with bridged networking https://dedijet.com/docs/install-proxmox · updated 2026-10-14 · 7 min read Install Proxmox VE 9, switch to the no-subscription repository, route extra IPv4 and IPv6 to your VMs, add NAT, and choose between ZFS and LVM-thin. Proxmox VE 9 turns your dedicated server into a host for KVM virtual machines and LXC containers, managed from a web interface. It is based on Debian 13 “Trixie”. This guide covers installation, repositories, storage, networking for your VMs, security and backups. #### Install Proxmox VE 9 - One click: choose Proxmox VE 9 when you order, or later with Reinstall in your dashboard (see Reinstall the operating system). A new Proxmox VE server is online in under 2 minutes after payment confirmation. - Official ISO: to choose every installer option yourself (file system, RAID level, disk layout), mount the ISO through IPMI virtual media and install from the console. On the network screen, enter the main IP, netmask and gateway shown in your dashboard. #### First login and repositories Open `https://203.0.113.10:8006` (your main IP), accept the self-signed certificate warning and log in as `root`, realm *Linux PAM standard authentication*, with the password from your delivery email. Without a subscription, the enterprise repository answers `401 Unauthorized` on `apt update`. Proxmox VE 9 uses deb822 `.sources` files: add `Enabled: no` to `/etc/apt/sources.list.d/pve-enterprise.sources` (and to `ceph.sources` if it points to the enterprise Ceph repository), then create `/etc/apt/sources.list.d/proxmox.sources`: ```conf Types: deb URIs: http://download.proxmox.com/debian/pve Suites: trixie Components: pve-no-subscription Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg ``` The web interface does the same under *Node → Updates → Repositories*. Then update, always with `full-upgrade` (never plain `apt upgrade` on Proxmox VE), and reboot if a new kernel was installed: ```bash apt update apt full-upgrade ``` The no-subscription repository suits most single hosts; Proxmox recommends the enterprise repository, with a subscription, for production. #### Storage: ZFS mirror or LVM-thin Depending on the install method, your two disks are mirrored with ZFS or with software RAID 1 (mdadm) under LVM-thin. Check which one you have: ```bash zpool status cat /proc/mdstat lvs ``` | Criterion | ZFS mirror | LVM-thin on mdadm RAID 1 | | --- | --- | --- | | Data integrity | Checksums every block, repairs from the mirror | No checksums | | Snapshots | Yes, plus compression and replication | Yes (thin snapshots) | | RAM use | ARC cache uses RAM | Low | | Proxmox support | Built into the installer | Works, but mdadm is not an officially supported setup | ZFS uses RAM for its ARC cache. On new installs, the Proxmox VE installer limits it to 10% of RAM, at most 16 GiB; the current limit is in `/sys/module/zfs/parameters/zfs_arc_max` (0 means the ZFS default). Change it in `/etc/modprobe.d/zfs.conf`, in bytes, for example `options zfs zfs_arc_max=17179869184` for 16 GiB; with ZFS as the root file system, run `update-initramfs -u -k all` and reboot afterwards. To get the other layout, reinstall from the ISO and pick the file system under *Options* on the target disk screen. #### Networking for your VMs Proxmox VE normally puts your main IP on the bridge `vmbr0`, attached to the physical port. Leave its IPv4 configuration as it is. Additional IPv4 addresses are routed to your main IP, so VMs do not join `vmbr0` directly: the host routes their traffic through a second bridge. > **Keep a way back in.** A mistake in `/etc/network/interfaces` takes the server offline. Open the [IPMI console](https://dedijet.com/docs/ipmi-kvm-console) first, keep a copy (`cp /etc/network/interfaces /root/interfaces.bak`) and apply changes with `ifreload -a`. ##### Enable IP forwarding ```bash cat > /etc/sysctl.d/99-forwarding.conf <<'EOF' net.ipv4.ip_forward = 1 net.ipv6.conf.all.forwarding = 1 EOF sysctl --system ``` ##### Routed bridge for additional IPv4 and IPv6 In this example, the main IP is 203.0.113.10, the additional IPs (see [Additional IPv4 addresses](https://dedijet.com/docs/additional-ipv4)) are 198.51.100.20 and 198.51.100.21, and the /64 is 2001:db8:1234:5678::/64. Add to `/etc/network/interfaces`: ```conf auto vmbr1 iface vmbr1 inet static address 203.0.113.10/32 bridge-ports none bridge-stp off bridge-fd 0 up ip route add 198.51.100.20/32 dev vmbr1 up ip route add 198.51.100.21/32 dev vmbr1 iface vmbr1 inet6 static address 2001:db8:1234:5678::2/64 ``` `vmbr1` has no physical port: it reuses the main IP as the VMs’ IPv4 gateway, and each additional IP gets a host route into the bridge. For IPv6, `::2` on `vmbr1` is the VMs’ gateway, so the whole /64 is routed into the bridge. The host keeps its own address (`::1` here) on `vmbr0`, but as a /128: change the prefix length if it is configured as a /64. Use the IPv6 gateway shown in your dashboard (`fe80::1` in this example): ```conf iface vmbr0 inet6 static address 2001:db8:1234:5678::1/128 gateway fe80::1 ``` ##### Configure the VM Attach the VM’s network device to `vmbr1`. Inside the VM, use a /32 address with the main IP as an on-link gateway, and an address from the /64 with `::2` as gateway. In an Ubuntu VM, with netplan (add your DNS resolvers under `nameservers`): ```yaml network: version: 2 ethernets: ens18: addresses: - 198.51.100.20/32 - 2001:db8:1234:5678::100/64 routes: - to: default via: 203.0.113.10 on-link: true - to: default via: 2001:db8:1234:5678::2 ``` On Debian VMs with ifupdown, use `address 198.51.100.20/32`, `pointopoint 203.0.113.10` and `gateway 203.0.113.10`. For separate IPv6 networks per bridge, a /56 is available free on request; see [Configure your /64 IPv6 subnet](https://dedijet.com/docs/ipv6-setup). ##### NAT for private VMs VMs that only need outbound access, such as build agents or internal services, can share the main IP through NAT on a private bridge: ```conf auto vmbr2 iface vmbr2 inet static address 10.10.10.1/24 bridge-ports none bridge-stp off bridge-fd 0 post-up iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE post-down iptables -t nat -D POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE ``` Give these VMs addresses in 10.10.10.0/24 with gateway 10.10.10.1. To publish one service, add a DNAT rule as another `post-up` line, for example `iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 2222 -j DNAT --to-destination 10.10.10.2:22`. If you enable the Proxmox firewall on these VMs, apply the conntrack zone note from the [Proxmox network documentation](https://pve.proxmox.com/wiki/Network_Configuration). An SDN *Simple* zone with SNAT enabled on its subnet (*Datacenter → SDN*) achieves the same from the web interface. #### Secure the web interface - Two-factor authentication: under Datacenter → Permissions → Two Factor, add TOTP or WebAuthn for root@pam and store the recovery keys offline. If you lose the second factor, log in over SSH or the IPMI console and run pveum user tfa delete root@pam. - Firewall: rules at datacenter level apply to every node. Under Datacenter → Firewall, first add accept rules for TCP 8006 and 22 from your own addresses, then enable it in Datacenter → Firewall → Options. Once enabled, incoming traffic is dropped by default and only the local network may reach the web interface and SSH, so a missing rule locks you out. VMs are filtered only when you also enable the firewall on the VM and its network devices. - Accounts: give each administrator a named user with only the roles they need, instead of sharing root@pam. #### Back up your VMs - Proxmox Backup Server 4 is available as a one-click OS. Install it on a second server, ideally in another location, and add it under Datacenter → Storage → Add → Proxmox Backup Server. Backups are incremental and deduplicated, can be encrypted on the client and verified on a schedule. - vzdump with the backup space add-on: the backup space speaks SFTP, rsync, BorgBackup and restic. Let a backup job (Datacenter → Backup) write to local storage, then copy the archives off the server, for example nightly with rsync -a /var/lib/vz/dump/ deploy@203.0.113.50:pve-dumps/. Keep at least one copy off the host and test a restore. A ZFS mirror or RAID 1 protects against a dead disk, not against a deleted VM. #### Next steps - Plan the host with Virtualization and compare EPYC configurations on Enterprise servers. - Watch your disks with smartctl and nvme-cli. - Network not coming up after a change? Revert it from the IPMI console first: restore /root/interfaces.bak and run ifreload -a. Still stuck? Our engineers answer 24/7. ### Use the IPMI/KVM console and virtual media https://dedijet.com/docs/ipmi-kvm-console · updated 2026-10-14 · 6 min read Reach your server’s screen and keyboard from the browser, restart it the right way, and mount your own ISO with virtual media to install any OS. Every DediJet server includes IPMI with a KVM-over-IP console at no extra cost. It is the remote equivalent of standing in front of the machine with a screen, a keyboard and a finger on the power button, and it keeps working when SSH does not. #### What IPMI and the BMC are Server motherboards carry a small, separate computer called the **baseboard management controller** (BMC). It has its own firmware and its own network address, and it runs whenever the server has standby power: with the operating system stopped, frozen or not installed at all. IPMI (Intelligent Platform Management Interface) is the long-standing standard for talking to it; many BMCs also implement the newer Redfish API. Through the BMC you get: - KVM-over-IP: the server’s video output in your browser, with your keyboard and mouse input sent back. KVM stands for keyboard, video, mouse here, not for the Linux hypervisor of the same name. - Power control: power on, power off, reset and power cycle. - Virtual media: an ISO image from your computer, presented to the server as a CD/DVD or USB drive. #### When to use the console - The network is gone. A typo in Netplan or /etc/network/interfaces, a wrong route, a disabled interface. - Firewall or SSH lockout. A rule that drops port 22, or password logins disabled before your SSH key worked. Neither affects the local console. - Boot problems. A kernel panic, a grub> prompt, or systemd’s emergency mode after an /etc/fstab error: the console shows the exact message. - Firmware setup. Boot order and other BIOS/UEFI settings. - Custom installations from your own ISO image, described below. For repairs that need the disks but not the installed system, such as a broken bootloader or a lost root password, [rescue mode](https://dedijet.com/docs/rescue-mode) is often more comfortable: you work in a normal SSH session, with copy and paste. > **Note:** Changing the boot order is fine. Overclocking and firmware tampering are not allowed under the [acceptable use policy](https://dedijet.com/legal/acceptable-use). #### Open the console 1. **Open the server in your dashboard,** then choose Console (IPMI). The console runs in your browser. 2. **Wake the screen.** A black screen usually means the display is blanked: press `Enter` or `Shift`. If nothing appears, check in the dashboard that the server is powered on. 3. **Log in** as root with the root password. SSH settings such as `PasswordAuthentication no` do not apply to the local console. If root has no password, for example after an installation with an SSH key only, set one from [rescue mode](https://dedijet.com/docs/rescue-mode). Copy and paste into a KVM console is limited at best, so keep the commands you type short. A good habit is to use the console only to restore network access, then continue over SSH. #### Keyboard tips ##### Sending Ctrl+Alt+Del and other shortcuts Your own operating system intercepts combinations such as `Ctrl`+`Alt`+`Del` before the browser sees them. If the console offers a menu of keys or macros, use it to send them to the server. Know what the combination does there: on most Linux systems, `Ctrl`+`Alt`+`Del` on the console starts a reboot; on Windows Server, it opens the sign-in screen. ##### Wrong characters? Check the keyboard layout Most KVM consoles send the position of each key, and the server turns it into a character with its own keymap, usually US English. With an AZERTY or QWERTZ keyboard, some letters and most symbols come out wrong, and passwords fail. Three ways around it: - Type as if your keyboard had the US layout. - Check what the server receives: type the characters at the login: prompt, where they are echoed, then erase them before you press Enter. - Once logged in, switch the console to your layout with loadkeys de or loadkeys fr (from the kbd package). The change is lost at the next reboot. #### Reboot, reset or power cycle Start with the gentlest option. Hard actions skip the normal shutdown: data still in write caches is lost, and the RAID array may resynchronize after the restart. | Action | What it does | Use it when | | --- | --- | --- | | `reboot` in the OS | Clean restart: services stop, filesystems are synced | The system still responds on the console | | Soft power off | Sends an ACPI power-button press; the OS shuts down cleanly if it can | You want the server off with no risk | | Reset | Hardware reset, like the reset button; power stays on | The OS is frozen and ignores the keyboard | | Power cycle | Cuts power, then turns it back on after a few seconds | A reset did not help, or a device such as a NIC or GPU is stuck | Reboot and power on/off are also available in your dashboard and through the [API](https://dedijet.com/docs/api), which is handy for automation. #### Install your own OS with virtual media The one-click installer covers the common systems (see [operating systems](https://dedijet.com/servers/operating-systems)). For anything else, such as VMware ESXi with your own license, TrueNAS or NixOS, mount an ISO image through the console. > **Warning:** Installing an operating system usually erases the disks you install it on. Back up anything you want to keep first. 1. **Download the ISO to your computer.** Virtual media streams the image from your browser to the server, so your upload speed and your distance to the server decide how fast it reads. A small network-install image is much quicker than a full DVD image. 2. **Attach the ISO** with the console’s virtual media function and check that it shows as mounted. 3. **Boot from it.** Restart the server, open the one-time boot menu with the key shown on the boot screen (often `F11` or `F12`), and select the virtual CD/DVD or USB device. 4. **Enter the network settings by hand** during the installation: the IPv4 address, prefix length and gateway shown in your dashboard, plus your IPv6 prefix with gateway `fe80::1` (check the value in your dashboard). 5. **Set up RAID yourself** if you want it. The default RAID 1 comes from the one-click installer, not from your ISO. 6. **Detach the ISO** when the installer finishes, then reboot from the disk. To return to a standard system later, [reinstall from the dashboard](https://dedijet.com/docs/reinstall-os). #### Security notes - The console is only reachable through your dashboard session. Access to your DediJet account therefore means access to the console: protect the account with a strong, unique password. - Console access equals physical access. Whoever uses it can restart the server into the bootloader and reset passwords. - Log out before you close the console. It shows whatever is on screen, and a root shell left open there is open to the next person who opens it. Type exit first. - Detach virtual media when you are done, so the server does not start the installer again by accident. #### Still stuck? If the console does not load, shows no picture while the server is on, or ignores the keyboard, open a ticket from [Support](https://dedijet.com/support). IPMI/KVM access is in scope for our engineers, 24/7, and a server that is down is treated as critical, with a first-response target of 30 minutes. ### Configure your /64 IPv6 subnet https://dedijet.com/docs/ipv6-setup · updated 2026-10-14 · 5 min read Find your routed /64 prefix, configure IPv6 with Netplan, ifupdown or NetworkManager, add more addresses, check connectivity and firewall it properly. Every DediJet server comes with a routed /64 IPv6 subnet at no extra cost, and the one-click installation sets up IPv6 for you. Use this guide to check that configuration, rebuild it after a custom install, or put more of the subnet to work. #### How the routed /64 works A /64 holds 2^64 addresses, about 18 quintillion. “Routed” means the upstream router sends all traffic for the subnet to your server, and you decide which addresses to use and where. There is nothing to request per address: add one from the prefix to the interface and it is reachable. Your prefix is listed in your dashboard: open the server, then choose Network. This guide uses `2001:db8:1234:5678::/64` as the prefix, `2001:db8:1234:5678::1` as the server’s main address and `enp1s0` as the interface; `ip -br link` shows your interface name. The IPv6 gateway is the link-local address `fe80::1`. Check the value in your dashboard, and use that one if it differs. See what is configured already: ```bash ip -6 addr show dev enp1s0 scope global ip -6 route show default ``` If your address and a default route via `fe80::1` appear, IPv6 is set up and you can go straight to the checks further down. #### Configure the address and gateway Use the tool that already manages your IPv4 configuration: YAML files in `/etc/netplan/` mean Netplan (standard on Ubuntu, also used on some Debian images), `/etc/network/interfaces` means ifupdown (classic Debian), and AlmaLinux and Rocky Linux use NetworkManager. > **Tip:** Network changes over SSH can cut you off. Keep the [IPMI console](https://dedijet.com/docs/ipmi-kvm-console) at hand: it reaches the server without the network. ##### Ubuntu: Netplan Edit the existing file in `/etc/netplan/` (its name varies) and add the IPv6 address and default route next to the IPv4 settings: ```yaml network: version: 2 ethernets: enp1s0: addresses: - 203.0.113.10/24 - 2001:db8:1234:5678::1/64 routes: - to: default via: 203.0.113.1 - to: default via: fe80::1 ``` The IPv4 lines are examples: keep your own address, routes and any `nameservers` section exactly as they are. Then apply with a safety net: ```bash netplan try ``` `netplan try` applies the change and rolls it back after 120 seconds unless you press `Enter` to keep it. If a mistake cuts your SSH session, wait two minutes and reconnect. If Netplan warns that permissions are too open, run `chmod 600 /etc/netplan/*.yaml`. ##### Debian: ifupdown In `/etc/network/interfaces`, add an `inet6` stanza for the same interface below the IPv4 one: ```conf iface enp1s0 inet6 static address 2001:db8:1234:5678::1/64 gateway fe80::1 ``` Rather than restarting the interface over SSH, apply the same settings live; the file takes over at the next boot: ```bash ip -6 addr add 2001:db8:1234:5678::1/64 dev enp1s0 ip -6 route add default via fe80::1 dev enp1s0 ``` ##### AlmaLinux and Rocky Linux: NetworkManager ```bash nmcli connection show nmcli connection modify enp1s0 ipv6.method manual ipv6.addresses 2001:db8:1234:5678::1/64 ipv6.gateway fe80::1 nmcli connection up enp1s0 ``` Replace `enp1s0` in the last two commands with the connection name from the first one, in quotes if it contains spaces. Re-activating the connection re-applies IPv4 too, so expect a short pause in your SSH session. Whatever the tool, reboot once at a quiet moment to confirm that the configuration survives. #### Check that IPv6 works ```bash ping -6 -c 4 2606:4700:4700::1111 curl -6 -sI https://www.debian.org ip -6 route get 2606:4700:4700::1111 ``` The ping, to a public DNS resolver, should get replies, and `curl` should print HTTP headers. The last command shows the source address the server uses for outgoing traffic, after `src`. Then test from outside: from a machine that has IPv6, ping or SSH to `2001:db8:1234:5678::1`. #### Use more addresses from the /64 Add addresses as you need them, for example one per website or service. Use the same `/64` prefix length and do not add a second gateway: - Netplan: another line under addresses, such as - 2001:db8:1234:5678::25/64. - ifupdown: another stanza, iface enp1s0 inet6 static, containing only address 2001:db8:1234:5678::25/64. - NetworkManager: nmcli connection modify enp1s0 +ipv6.addresses 2001:db8:1234:5678::25/64, then nmcli connection up enp1s0. To try an address before making it permanent, `ip -6 addr add 2001:db8:1234:5678::25/64 dev enp1s0` works immediately and disappears at reboot. Virtual machines and containers behind a bridge need the host to route their addresses (see [Install Proxmox VE](https://dedijet.com/docs/install-proxmox)). Enabling forwarding for that makes Linux ignore router advertisements, which does not matter with the static gateway configured here. If you want separate networks, such as one /64 per bridge or per customer, a /56 (256 subnets of /64) is available free on request: open a ticket. #### Keep addresses stable Servers need fixed addresses: DNS records, firewall allowlists and [reverse DNS](https://dedijet.com/docs/reverse-dns) all point to them. Privacy extensions, designed for laptops, add temporary addresses that rotate, and SLAAC derives addresses automatically. The static configurations above avoid both. If `ip -6 addr` lists extra addresses marked `temporary` or `mngtmpaddr`, turn privacy extensions off for the interface and for new interfaces, in `/etc/sysctl.d/60-ipv6.conf`: ```conf net.ipv6.conf.enp1s0.use_tempaddr = 0 net.ipv6.conf.default.use_tempaddr = 0 ``` Load it with `sysctl --system`. With NetworkManager, set `ipv6.ip6-privacy 0` on the connection instead. #### Firewall IPv6 too Your IPv6 addresses are reachable from the internet just like your IPv4 address, and services listening on `[::]` or `*` accept connections on both. `ss -tlnp` shows what listens where. Make sure your firewall covers IPv6: - ufw filters IPv6 as long as IPV6=yes is set in /etc/default/ufw, the default. - firewalld zones apply to IPv4 and IPv6 alike. - nftables tables of the inet family match both protocols. - iptables rules do not cover IPv6: add matching ip6tables rules, or move to nftables. > **Warning:** Do not block ICMPv6 wholesale. Neighbor discovery (types 133–137) and “Packet Too Big” messages (type 2) are part of how IPv6 works; without them, connections stall in ways that are hard to diagnose. #### Next steps Add `AAAA` records for your services, set [reverse DNS](https://dedijet.com/docs/reverse-dns) for every address that sends mail, and read [Add additional IPv4 addresses](https://dedijet.com/docs/additional-ipv4) if you also need more IPv4. Still stuck? Open a ticket from [Support](https://dedijet.com/support) with the output of `ip -6 addr` and `ip -6 route`. ### Test network speed and routes: iperf3, mtr and curl https://dedijet.com/docs/network-testing · updated 2026-10-14 · 6 min read Measure throughput with iperf3, read mtr reports correctly, time downloads with curl, and learn what a 1 Gbps or 10 Gbps port really delivers. “The network is slow” can mean low throughput, high latency, jitter or packet loss, and the cause can sit on your server, on the remote end or anywhere in between. The tools below tell these apart. Install them first. **Ubuntu and Debian** (when asked whether to start iperf3 as a daemon, answer No): ```bash apt install -y iperf3 mtr-tiny curl ``` **AlmaLinux and Rocky Linux** ```bash dnf install -y iperf3 mtr curl ``` #### What speeds to expect A port speed is the raw line rate. Ethernet framing and the IP and TCP headers use part of it, so with the standard 1500-byte MTU the best possible TCP payload rate is about 94% of the port speed: | Port | Maximum TCP goodput | In bytes | | --- | --- | --- | | 1 Gbps | ≈ 940 Mbit/s | ≈ 117 MB/s | | 10 Gbps | ≈ 9.4 Gbit/s | ≈ 1.17 GB/s | So 940 Mbit/s on a 1 Gbps port means the link is full, not underperforming. Reaching that speed to a given destination also depends on the remote server, its own port and the path in between, and 10 Gbps usually needs several parallel streams. Bandwidth on DediJet ports is unmetered, so tests cost nothing extra (see [unmetered bandwidth explained](https://dedijet.com/blog/unmetered-bandwidth-explained)). Plans with a 1 Gbps port can be upgraded to 10 Gbps for $129/mo; see [add-ons](https://dedijet.com/servers/add-ons). #### Measure throughput with iperf3 iperf3 measures raw TCP or UDP throughput between two machines you control, without disks or web servers in the way. The cleanest test runs between two of your own servers: over the public network, or over the free private VLAN, available on request, if they are in the same location. ##### Run a test On the receiving server, open the port and start a one-off server that exits after one test: ```bash ufw allow 5201/tcp iperf3 -s -1 ``` With firewalld, use `firewall-cmd --add-port=5201/tcp`; without `--permanent`, the rule disappears at the next reload. Then, on the other server, run one of these, restarting `iperf3 -s -1` before each: ```bash iperf3 -c 203.0.113.20 -t 30 iperf3 -c 203.0.113.20 -t 30 -R iperf3 -c 203.0.113.20 -t 30 -P 4 ``` The first sends from the client to the server, `-R` reverses the direction, and `-P 4` runs four parallel streams. Remove the firewall rule afterwards with `ufw delete allow 5201/tcp`. ##### Read the results ```text [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-30.00 sec 3.28 GBytes 939 Mbits/sec 12 sender [ 5] 0.00-30.04 sec 3.28 GBytes 938 Mbits/sec receiver ``` This illustrative output shows a saturated 1 Gbps link. The `receiver` line is what actually arrived. `Retr` counts TCP retransmissions: a handful is normal, thousands point to loss or congestion on the path. - One stream slow, four streams fast: a per-stream limit, such as the TCP window over a long distance. One stream needs a window of bandwidth × round-trip time: 1 Gbit/s × 150 ms ≈ 19 MB, more than default Linux settings allow. - Fast in one direction only: compare the runs with and without -R. A one-way problem is useful information for a ticket. - 10 Gbps tests: iperf3 versions before 3.16 run all streams on one CPU core, which can become the bottleneck. Check with iperf3 --version, or start several iperf3 processes on different ports with -p. Public iperf3 servers exist, but they are shared and often busy: their results say more about their load than about your server. To measure CPU, memory and disks rather than the network, see [Benchmark your server](https://dedijet.com/docs/benchmark). #### Time a real download with curl To test a real HTTP path, download a large file to `/dev/null`, so the disk is not involved, and let curl report the numbers: ```bash curl -o /dev/null -s -w 'speed: %{speed_download} B/s ttfb: %{time_starttransfer}s total: %{time_total}s\n' https://mirror.example.com/large-file.iso ``` Use a large file on a well-connected server near the destination you care about, such as an ISO image from your distribution’s mirror list. `speed_download` is in bytes per second: 117,000,000 B/s is about 940 Mbit/s. One download is limited by the remote server and its connection, so compare several sources before drawing conclusions. Add `-4` or `-6` to compare IPv4 and IPv6; if IPv6 fails entirely, check [your IPv6 configuration](https://dedijet.com/docs/ipv6-setup). #### Latency and jitter with ping ```bash ping -c 100 -i 0.2 203.0.113.20 ``` ```text 100 packets transmitted, 100 received, 0% packet loss, time 19804ms rtt min/avg/max/mdev = 11.204/11.391/12.877/0.214 ms ``` `avg` is the typical round-trip time, and `mdev`, the standard deviation, is a practical measure of jitter. For game servers and voice, stable latency matters more than raw bandwidth: look for a low `mdev` and 0% loss. The figures on our [latency checker](https://dedijet.com/network/latency) are estimates computed from distance, so measured values on a real route can differ. #### Find where it breaks: mtr and traceroute `mtr` combines traceroute and ping: it probes every hop on the path, over and over. Run it in report mode with enough cycles to be meaningful: ```bash mtr -rwbz -c 100 203.0.113.20 ``` `-r` prints a report, `-w` keeps hostnames whole, `-b` shows names and IP addresses, `-z` adds the AS number of each hop, and `-c 100` sends 100 probes per hop. ```text HOST: web1 Loss% Snt Last Avg Best Wrst StDev 1. AS64500 198.51.100.1 0.0% 100 0.4 0.5 0.3 1.9 0.2 2. AS64500 198.51.100.9 38.0% 100 1.3 4.9 1.0 48.2 9.1 3. AS64501 192.0.2.17 0.0% 100 7.9 8.1 7.8 9.4 0.2 4. AS64501 203.0.113.20 0.0% 100 8.3 8.4 8.1 10.2 0.3 ``` ##### How to read it - Only loss that reaches the last hop counts. Hop 2 shows 38% loss, but hops 3 and 4 show none: that router rate-limits the replies it generates itself, which is common and harmless. Real loss starts at one hop and continues on every hop after it, down to the destination. - Latency works the same way. A spike on one middle hop that does not carry on to later hops means that router is slow to answer, not slow to forward. - Routes are often asymmetric. The return path can cross other networks, so an mtr from your server shows only half the picture. Run one in the opposite direction too. - ICMP filtered? Probe with TCP to an open port instead: mtr -rwbz -T -P 443 -c 100 example.com. Without mtr, `traceroute -n 203.0.113.20` (from the `traceroute` package) lists the hops once, and `tracepath` needs no root and also reports the path MTU. #### When to open a ticket Check the [status page](https://dedijet.com/status) first. Then open a ticket from [Support](https://dedijet.com/support) if you see packet loss that continues to the destination, throughput far below the figures above between two well-connected machines, or a problem that started at a specific time. Include: - The server’s IP address and the remote address you tested against. - mtr reports in both directions, from your server to the destination and from the destination or the affected user back to your server, with at least 100 cycles each. - Your iperf3 or curl results, the time of the tests with its time zone, and whether IPv4, IPv6 or both are affected. - Whether the problem is constant or intermittent, and when it started. A network outage is handled as critical, with a first-response target of 30 minutes; other tickets have a first-response target of 4 hours. If you suspect an attack, read [DDoS protection](https://dedijet.com/docs/ddos-protection) first. ### Reinstall the operating system from your dashboard https://dedijet.com/docs/reinstall-os · updated 2026-10-14 · 5 min read What a reinstall erases, how to back up first, which OS and RAID layout to pick, how long it takes and what to do once the server is back online. Reinstalling is the fastest way to start over: after a compromise, to switch distributions, or to change the disk layout. The same automation that delivered your server writes the new system, so a reinstall needs no ticket and is done in under 2 minutes. #### What a reinstall erases > **Warning:** A reinstall erases **all disks in the server**, not only the system disk: every partition, RAID array and data disk, including extra drives. It cannot be undone. Back up first. Your IP addresses stay assigned to the server, and [backup space](https://dedijet.com/servers/add-ons) ordered as an add-on is separate from the server, so neither is touched. Everything you set up inside the old system, such as users, firewall rules, cron jobs or additional IP addresses, has to be configured again. #### Back up first Copy what you need to another machine: a second server, your own storage, or backup space (from $5/mo for 1 TB, reachable over SFTP, rsync, BorgBackup and restic). Typical items: - Application data and uploads, for example /var/www and /home. - Databases, as a consistent dump rather than raw data files. - Configuration: /etc, TLS certificates, crontabs, and the list of installed packages (dpkg --get-selections on Debian and Ubuntu, rpm -qa on AlmaLinux and Rocky Linux). ```bash mysqldump --all-databases --single-transaction > /root/mysql-all.sql sudo -u postgres pg_dumpall > /root/postgres-all.sql rsync -a /etc /home /var/www /root backup@203.0.113.50:server1/ ``` Run only the dump commands for the databases you use. Then check the copy, for example by restoring one file, before you continue. Note down what will need recreating: additional IP addresses, DNS records pointing at the server, and the SSH host keys (`/etc/ssh/ssh_host_*`) if you want clients to keep trusting the server without a warning. #### Choose the operating system One-click installs (details on [operating systems](https://dedijet.com/servers/operating-systems)): - Ubuntu 26.04 LTS, 24.04 LTS and 22.04 LTS - Debian 13 “Trixie” and 12 “Bookworm” - AlmaLinux 10 and 9, Rocky Linux 10 and 9 - Fedora Server 44 and FreeBSD 15 - Proxmox VE 9 and Proxmox Backup Server 4 - Windows Server 2025 and 2022, Standard edition For production, choose a long-term release: Ubuntu LTS, Debian, AlmaLinux and Rocky Linux receive security updates for years. Fedora moves faster and each release is supported for about 13 months, so plan regular upgrades. To run virtual machines, pick Proxmox VE and follow [the Proxmox guide](https://dedijet.com/docs/install-proxmox). ##### An OS that is not in the list Mount your own ISO image with the console’s virtual media and install anything the hardware supports, for example VMware ESXi with your own license, TrueNAS or NixOS. You then configure the network and RAID yourself. See [IPMI/KVM console and virtual media](https://dedijet.com/docs/ipmi-kvm-console). #### Choose the RAID layout On servers with two disks, the default is Linux software RAID 1. You can choose another layout at install time: | Layout | Usable space with 2 × 1 TB | If one disk fails | Good for | | --- | --- | --- | --- | | RAID 1 (default) | 1 TB | The server keeps running; the disk is replaced and the mirror rebuilt | Almost every workload | | RAID 0 | 2 TB | All data is lost | Scratch space, caches, data replicated elsewhere | | No RAID | 2 × 1 TB, separate | Data on the failed disk is lost | Your own layout: ZFS, LVM, a separate data disk | A failed disk is replaced within 4 hours of diagnosis (see the [SLA](https://dedijet.com/legal/sla)). RAID protects against a disk failure, not against deletion, corruption or a compromised system, so keep backups whichever layout you choose. More in [Software RAID](https://dedijet.com/docs/software-raid). On servers with more than two disks, choose among the layouts offered for that machine, or select no RAID and build your own array afterwards. #### Start the reinstall 1. **Open the reinstall form.** In your dashboard, open the server, then choose Reinstall. 2. **Pick the operating system and the RAID layout.** 3. **Add your SSH public key.** Paste the content of your `.pub` file, for example `id_ed25519.pub`, so you can log in with your key from the start. [SSH keys](https://dedijet.com/docs/ssh-keys) explains how to create one. 4. **Confirm.** The automation writes the new system to the disks, configures the network and restarts the server. Duration: the server is back online in under 2 minutes, whatever the system. Reinstalls can also be started through the [API](https://dedijet.com/docs/api). #### After the reinstall - Login details: as at delivery, the new credentials appear in your dashboard: the root password, or access with the SSH key you provided. - Host key warning: the new system has new SSH host keys, so your SSH client warns that the remote host identification has changed. Remove the old entry and connect again with ssh-keygen -R 203.0.113.10, or restore the host keys you saved and restart sshd. - Network extras: the main IPv4 address and IPv6 are configured for you. If you have additional IPv4 addresses, add them again. - Basics: updates, a sudo user and the firewall, as in First steps. - Data: restore from your backup and test your services before pointing DNS back to the server. #### Windows Server licensing Windows Server 2025 and 2022 Standard come with a license billed monthly: $2.75 per physical core per month, with a minimum of 8 cores (prices exclude VAT). A 6-core Xeon E-2236 or an 8-core Ryzen 7 9700X is billed as 8 cores, $22/mo; a 16-core Ryzen 9 9950X comes to $44/mo. Like every system, it is online in under 2 minutes; then connect with Remote Desktop as Administrator. Details in [Windows Server](https://dedijet.com/docs/windows-server). #### Next steps On a fresh Linux system, work through [First steps](https://dedijet.com/docs/first-steps), then [harden the server](https://dedijet.com/docs/server-hardening) before you restore public services. If a reinstall fails or the server does not come back online, open a ticket from [Support](https://dedijet.com/support): OS installation issues are in scope for our engineers, 24/7. ### Boot into rescue mode and repair your server https://dedijet.com/docs/rescue-mode · updated 2026-10-14 · 5 min read Boot a network rescue system, assemble the RAID, chroot into your install and fix fstab, GRUB, a lost root password or an SSH or firewall lockout. When the installed system no longer boots or no longer lets you in, rescue mode gives you a working Linux environment with full access to the disks. From there you can repair the installation, or copy your data off before a reinstall. #### What rescue mode is The rescue system is a Linux live system that your server boots over the network and runs entirely in memory. Your disks are left untouched: nothing is mounted, formatted or changed until you decide to. You log in over SSH as root and get a normal shell to work with disks, RAID arrays and filesystems. Rescue mode is free, as often as you need it. For a lockout caused by the network or firewall configuration, the [IPMI console](https://dedijet.com/docs/ipmi-kvm-console) is often quicker, because it logs you in to the installed system directly. #### Boot into the rescue system 1. **Enable rescue mode.** In your dashboard, open the server, then choose Rescue. Note the temporary root password you are given. 2. **Reboot the server** from the dashboard, or with `reboot` if it still responds. It starts the rescue system instead of your installation. 3. **Log in over SSH** with the temporary password. The rescue system has its own host key; a separate known-hosts file keeps it apart from your server’s real key: `ssh -o UserKnownHostsFile=~/.ssh/known_hosts_rescue root@203.0.113.10` #### Identify the disks and assemble the RAID ```bash lsblk -o NAME,SIZE,TYPE,FSTYPE,LABEL,MOUNTPOINT ``` Partitions with the type `linux_raid_member` belong to a software RAID array, the default on two-disk servers. Assemble the arrays, unless `/proc/mdstat` already lists them, and check their state: ```bash mdadm --assemble --scan cat /proc/mdstat ``` Arrays may get other names than on the installed system, for example `md127` instead of `md0`; that is harmless. If a member is missing (`[U_]`), you can still work on the array, but check the disks too: see [Disk health](https://dedijet.com/docs/disk-health). If `lsblk` shows `LVM2_member`, activate the volume groups: ```bash vgchange -ay lvs ``` #### Mount the system and chroot into it The root filesystem is the one that contains `/etc/fstab`, usually the largest array. Mount it and read the fstab to see which other filesystems belong to it: ```bash mount /dev/md1 /mnt cat /mnt/etc/fstab ``` If the system crashed or the console showed filesystem errors, unmount it first and run a check: `fsck -f /dev/md1` for ext4, `xfs_repair /dev/md1` for XFS (the `FSTYPE` column of `lsblk` tells you which). Never check a mounted filesystem. Mount any separate `/boot` and `/boot/efi` listed in the fstab (`blkid` maps UUIDs to devices), then bind the virtual filesystems and switch into the installed system: ```bash mount /dev/md0 /mnt/boot mount /dev/nvme0n1p1 /mnt/boot/efi mount --rbind /dev /mnt/dev mount --rbind /proc /mnt/proc mount --rbind /sys /mnt/sys mount --rbind /run /mnt/run chroot /mnt /bin/bash ``` The device names are examples; skip the first two lines if there is no separate `/boot` or `/boot/efi`. Inside the chroot, commands such as `passwd`, `systemctl enable` and the package manager act on your installed system, not on the rescue system. Only need your data? Skip the chroot and copy it straight from `/mnt`, for example with `rsync -a /mnt/var/www/ backup@203.0.113.50:rescue-copy/`. #### Common fixes ##### Emergency mode at boot: fix /etc/fstab A wrong UUID, or a disk that no longer exists, in `/etc/fstab` makes systemd stop in emergency mode. Compare the entries with the output of `blkid`, correct or comment out the bad line with `vi /etc/fstab` (or `nano`), then validate: ```bash findmnt --verify ``` For disks the system does not need to boot, add `nofail` to the mount options, so a missing disk no longer blocks startup. ##### No bootloader: reinstall GRUB on both disks With RAID 1, the bootloader belongs on **both** disks, so the server can start from either one. First check how the server boots: ```bash [ -d /sys/firmware/efi ] && echo UEFI || echo BIOS ``` **BIOS boot.** Ubuntu and Debian: ```bash grub-install /dev/nvme0n1 grub-install /dev/nvme1n1 update-grub ``` AlmaLinux and Rocky Linux: ```bash grub2-install /dev/nvme0n1 grub2-install /dev/nvme1n1 grub2-mkconfig -o /boot/grub2/grub.cfg ``` On Ubuntu and Debian, also run `dpkg-reconfigure grub-pc` and select both disks, so that future GRUB updates are written to both. **UEFI boot.** GRUB lives on the EFI system partition, mounted at `/boot/efi`. Ubuntu and Debian: ```bash grub-install --target=x86_64-efi --efi-directory=/boot/efi update-grub ``` AlmaLinux and Rocky Linux, where `grub2-install` is not used on UEFI systems: ```bash dnf reinstall -y grub2-efi-x64 shim-x64 grub2-mkconfig -o /boot/grub2/grub.cfg ``` If the second disk has its own EFI system partition (a small `vfat` partition in `lsblk`), give it a bootloader as well. Mount it: ```bash mkdir -p /boot/efi2 mount /dev/nvme1n1p1 /boot/efi2 ``` Then, on Ubuntu and Debian, run `grub-install --target=x86_64-efi --efi-directory=/boot/efi2 --removable`, which installs GRUB at the fallback path that firmware finds without a boot entry. On AlmaLinux and Rocky Linux, copy the files with `cp -r /boot/efi/EFI /boot/efi2/`. Finish with `umount /boot/efi2`. ##### Reset a lost root password ```bash passwd root ``` On AlmaLinux and Rocky Linux, the new password file has no SELinux label yet, and logins can fail until it gets one: do not skip the relabel step when you leave rescue mode. ##### Locked out by SSH or firewall settings Move the SSH drop-in file that caused the lockout out of the way, and check that your key is still there: ```bash ls /etc/ssh/sshd_config.d/ mv /etc/ssh/sshd_config.d/00-keys-only.conf /root/ cat /root/.ssh/authorized_keys ``` To start without the firewall, disable it for the next boot with the line that matches the one you use: ```bash systemctl disable ufw systemctl disable firewalld systemctl disable nftables ``` Once the server is back, fix the rules and turn the firewall on again with `systemctl enable --now` followed by the same name. #### Leave rescue mode On AlmaLinux and Rocky Linux, if you changed any file inside the chroot, run `touch /.autorelabel` before you leave it. SELinux then relabels the filesystem at the next boot, which takes a few minutes and restarts the server once more on its own. Then exit the chroot and unmount everything: ```bash exit sync umount -R /mnt ``` If `umount` reports that a target is busy, you can continue: the reboot unmounts everything. Turn rescue mode off in your dashboard if it is still enabled, then reboot the server. Watch the first boot in the [IPMI console](https://dedijet.com/docs/ipmi-kvm-console): if it stops again, the screen shows where. #### Still stuck? If the rescue system does not start, a disk is not detected, or `/proc/mdstat` shows a failed member, open a ticket from [Support](https://dedijet.com/support). Hardware is our job: a failed component is replaced within 4 hours of diagnosis (see the [SLA](https://dedijet.com/legal/sla)), and [Software RAID](https://dedijet.com/docs/software-raid) explains how the mirror is rebuilt afterwards. The software on your server is yours to administer, but tell us what you tried and our engineers will point you in the right direction. ### Set reverse DNS (PTR records) https://dedijet.com/docs/reverse-dns · updated 2026-10-14 · 5 min read Point your server’s IP addresses back to a hostname, make it forward-confirmed for mail delivery, and verify the PTR record with dig and host. Normal DNS turns a name into an address. Reverse DNS does the opposite and answers the question “which hostname belongs to 203.0.113.10?” Mail servers ask it on every incoming connection, and it makes logs and traceroutes readable. Reverse DNS is free for every address on your server. #### What a PTR record is Reverse lookups use dedicated zones. For IPv4, the address is written backwards under `in-addr.arpa`; for IPv6, each hexadecimal digit is written backwards under `ip6.arpa`. The record type is `PTR`: ```dns 10.113.0.203.in-addr.arpa. PTR mail.example.com. ``` These zones belong to whoever holds the IP range, which for your server’s addresses is DediJet. That is why you set the PTR in your DediJet dashboard and not at your domain’s DNS provider. The forward records, `A` and `AAAA`, stay at your DNS provider. #### Why mail servers need forward-confirmed reverse DNS A receiving mail server checks two things about the IP address that connects to it: 1. The address has a PTR record, for example mail.example.com. 2. That hostname resolves back to the same address through its A or AAAA record. When both match, the address has **forward-confirmed reverse DNS** (FCrDNS). Large mailbox providers require it from senders and reject or junk mail without it, and many self-hosted mail servers enforce it too; Postfix does with `reject_unknown_client_hostname`. Use the same name that your mail server announces in its `HELO`/`EHLO` greeting, set by `myhostname` in Postfix. #### Set the PTR record 1. **Create the forward record first.** At your DNS provider, point `mail.example.com` to `203.0.113.10` with an `A` record, plus an `AAAA` record for the IPv6 address you will send from. Check that it resolves with `dig +short mail.example.com A`. 2. **Set the reverse record.** In your dashboard, open the server, then choose Reverse DNS. Select the address and enter the hostname, `mail.example.com`. 3. **Verify it** as shown below. To manage many addresses, or to set PTR records from your provisioning scripts, use the [DediJet API](https://dedijet.com/docs/api): it offers the same reverse DNS settings as the dashboard. #### Verify the record Install the lookup tools if they are missing: `apt install -y bind9-dnsutils` on Ubuntu and Debian, `dnf install -y bind-utils` on AlmaLinux and Rocky Linux. Then: ```bash dig -x 203.0.113.10 +short host 203.0.113.10 dig +short mail.example.com A ``` The first two commands should return `mail.example.com` (dig prints it with a final dot), the third `203.0.113.10`. When both directions agree, the record is forward-confirmed. ##### Propagation and caching Once a change is published, resolvers that already looked up the old value keep returning it until its TTL (time to live) expires. The TTL is the number in the second column of a full answer: ```bash dig -x 203.0.113.10 +noall +answer ``` ```text 10.113.0.203.in-addr.arpa. 3600 IN PTR mail.example.com. ``` In this example the TTL is 3600 seconds, so a resolver that cached the old answer may serve it for up to an hour. To see the current value without any cache in the way, follow the delegation from the root servers with `dig +trace -x 203.0.113.10`. #### Reverse DNS for IPv6 Each IPv6 address has its own PTR record, and nobody fills a whole /64. Set records for the addresses you actually use, at least the one your mail server sends from. `dig -x` builds the long `ip6.arpa` name for you: ```bash dig -x 2001:db8:1234:5678::25 +short ``` IPv6 matters for mail even if you never planned for it: when both sides support IPv6, your mail server may deliver over it, and the receiving server then checks the IPv6 address. Either give that address a PTR and a matching `AAAA` record, pinned in Postfix with `smtp_bind_address6`, or make the mail server use IPv4 only with `inet_protocols = ipv4`. See [Configure your /64 IPv6 subnet](https://dedijet.com/docs/ipv6-setup) for adding a dedicated address. #### Common mistakes - No matching forward record. The PTR points to a name without an A or AAAA record, or to one that resolves to another address, and FCrDNS fails. - Using the bare domain. example.com usually points to your website, often hosted elsewhere. Use a dedicated host name such as mail.example.com. - A greeting that does not match. The mail server introduces itself as localhost or under another name than the PTR. - Mail leaving from another address. The PTR is set on the main IP, but mail goes out from an IPv6 address or an additional IPv4 address. Check the source address in your mail logs. - Expecting more from reverse DNS. It does not affect websites or search rankings, and it does not replace SPF, DKIM or DMARC. #### SPF, DKIM and DMARC in brief Reverse DNS identifies the server. Three more DNS records, set at your DNS provider, authenticate the mail of your domain: - SPF lists the addresses allowed to send for the domain, as a TXT record on example.com: v=spf1 ip4:203.0.113.10 ip6:2001:db8:1234:5678::25 -all. - DKIM signs each message. Your mail software (OpenDKIM, Rspamd and others) generates the key pair; the public key goes in a TXT record at selector._domainkey.example.com. - DMARC tells receivers what to do when SPF and DKIM checks fail, and where to send reports. Start with a TXT record at _dmarc.example.com containing v=DMARC1; p=none, add an rua tag pointing to a reporting mailbox you control, then move to quarantine or reject once the reports look clean. Running a mail server also means keeping it closed to strangers: open relays are not allowed under the [acceptable use policy](https://dedijet.com/legal/acceptable-use). #### Still stuck? If the dashboard does not accept your hostname, or the new record still does not show after the TTL has passed, open a ticket from [Support](https://dedijet.com/support) with the address, the hostname and the output of `dig -x`. ### Harden a new server: firewall, fail2ban and automatic updates https://dedijet.com/docs/server-hardening · updated 2026-10-14 · 6 min read A practical checklist for a new Linux server: ufw or firewalld with IPv6, SSH keys, fail2ban, automatic security updates and the Docker firewall trap. A new server is reachable from the whole internet as soon as it is online, and automated scanners find new addresses quickly. Hardening follows one rule: expose only what you actually serve, and keep it patched. Work through the steps in order, from an SSH session you keep open until every change is tested. > **Avoid locking yourself out.** Allow SSH before you enable a firewall, test each change from a second terminal, and remember that the [IPMI console](https://dedijet.com/docs/ipmi-kvm-console) in your dashboard still works if a rule goes wrong. #### Check what is listening ```bash ss -tulpn ``` Each line is an open port. In the `Local Address` column, `0.0.0.0`, `[::]` or `*` mean every interface, including the public one; `127.0.0.1` and `[::1]` mean local only. Stop and disable what you do not need, for example: ```bash systemctl disable --now rpcbind.service rpcbind.socket ``` Services used only by your own applications should listen on localhost: `bind-address = 127.0.0.1` for MySQL and MariaDB, `listen_addresses = 'localhost'` for PostgreSQL, `bind 127.0.0.1 -::1` with `protected-mode yes` for Redis. Never expose databases, Redis, Memcached or Elasticsearch to the internet. If another server needs them, use the free private VLAN between your servers (on request) or a VPN, plus a firewall allow-list. #### Set up a firewall Deny incoming traffic by default and open only the ports you serve. The examples open SSH, HTTP and HTTPS. ##### Ubuntu and Debian: ufw ```bash apt install -y ufw ufw default deny incoming ufw default allow outgoing ufw allow 22/tcp ufw allow 80,443/tcp ufw enable ufw status verbose ``` ufw writes the matching IPv6 rules as long as `IPV6=yes` is set in `/etc/default/ufw`, which is the default. To accept SSH only from your own address, add the specific rule before deleting the general one: ```bash ufw allow from 198.51.100.7 to any port 22 proto tcp ufw delete allow 22/tcp ``` If your address changes often, use `ufw limit 22/tcp` instead: it rejects addresses that open 6 or more connections within 30 seconds. ##### AlmaLinux and Rocky Linux: firewalld ```bash dnf install -y firewalld systemctl enable --now firewalld firewall-cmd --permanent --add-service=http --add-service=https firewall-cmd --permanent --remove-service=cockpit firewall-cmd --reload firewall-cmd --list-all ``` The default `public` zone usually allows `ssh`, `cockpit` and `dhcpv6-client`; skip the `cockpit` line if you use its web console. Rules without a family apply to IPv4 and IPv6. To accept SSH only from your address (add a second rule with `family="ipv6"` if you connect over IPv6): ```bash firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="198.51.100.7/32" service name="ssh" accept' firewall-cmd --permanent --remove-service=ssh firewall-cmd --reload ``` On current releases, both ufw and firewalld drive nftables underneath. You can write `/etc/nftables.conf` by hand instead, but pick one approach: mixing a hand-written ruleset with ufw or firewalld makes the result hard to predict. #### Lock down SSH Log in with keys only. [Log in with SSH keys](https://dedijet.com/docs/ssh-keys) walks you through it and creates `/etc/ssh/sshd_config.d/00-keys-only.conf`, which turns off password logins. Then add a few limits in a second drop-in file, `/etc/ssh/sshd_config.d/10-hardening.conf`. Current releases read these files before the main configuration, and the first value read wins: ```conf MaxAuthTries 3 LoginGraceTime 30 X11Forwarding no ``` Check the syntax, then reload (the service is `sshd` on AlmaLinux and Rocky Linux): ```bash sshd -t systemctl reload ssh ``` Once you log in with a sudo user such as `deploy`, change `PermitRootLogin` to `no` in `00-keys-only.conf`. Moving SSH to another port reduces log noise, but it is not a security control. #### Block brute force with fail2ban fail2ban reads failed logins from the systemd journal and bans the source address in the firewall for a while. On AlmaLinux and Rocky Linux, enable EPEL first (`dnf install -y epel-release`) and install the same two packages with `dnf`: ```bash apt install -y fail2ban python3-systemd ``` Create `/etc/fail2ban/jail.local`: ```ini [DEFAULT] bantime = 1h findtime = 10m maxretry = 5 ignoreip = 127.0.0.1/8 ::1 198.51.100.7 [sshd] enabled = true backend = systemd ``` ```bash systemctl enable --now fail2ban fail2ban-client status sshd ``` On a public server, `Total failed` normally starts counting within minutes. If it stays at 0, the filter does not match your logs: with OpenSSH 9.8 or later, failed logins are logged by `sshd-session`, which older fail2ban filters miss, so update fail2ban. To lift a ban: `fail2ban-client set sshd unbanip 198.51.100.7`. #### Install security updates automatically Ubuntu normally ships with `unattended-upgrades` enabled. On Debian, install and enable it: ```bash apt install -y unattended-upgrades dpkg-reconfigure -plow unattended-upgrades ``` Both values in `/etc/apt/apt.conf.d/20auto-upgrades` must be `"1"`; preview a run with `unattended-upgrade --dry-run --debug`. Kernel updates need a reboot: to reboot automatically at a quiet hour, set `Unattended-Upgrade::Automatic-Reboot "true";` and `Unattended-Upgrade::Automatic-Reboot-Time "04:00";` in `/etc/apt/apt.conf.d/50unattended-upgrades`. On AlmaLinux and Rocky Linux, install dnf-automatic: ```bash dnf install -y dnf-automatic dnf-plugins-core ``` In `/etc/dnf/automatic.conf`, set `upgrade_type = security` and `apply_updates = yes` in the `[commands]` section, then enable the timer. `dnf needs-restarting -r` tells you when a reboot is needed: ```bash systemctl enable --now dnf-automatic.timer dnf needs-restarting -r ``` #### Docker bypasses ufw and firewalld Docker writes its own iptables rules, and traffic to a published container port is forwarded before your firewall’s input rules see it. A container started with `-p 6379:6379` is reachable from the whole internet, whatever ufw says. Two fixes: 1. **Publish on localhost** and put a reverse proxy in front of anything public. In Compose, write `"127.0.0.1:6379:6379"`. `docker run -d -p 127.0.0.1:6379:6379 redis` 2. **Filter in the DOCKER-USER chain**, which Docker evaluates before its own rules. Replace `eth0` with your public interface (`ip route show default`): `iptables -I DOCKER-USER -i eth0 -p tcp -m conntrack --ctorigdstport 6379 --ctdir ORIGINAL -j DROP` These rules are not saved across reboots: apply them from a systemd unit or your configuration management, and mirror them with `ip6tables` if containers use IPv6. Never expose the Docker API on TCP port 2375: anyone who reaches it gets root on the host. Manage remote engines over SSH instead, for example `DOCKER_HOST=ssh://deploy@203.0.113.10`. #### Time sync, audits and console access - Keep the clock right. TLS, two-factor codes and log correlation depend on it. timedatectl must show System clock synchronized: yes; if no time service runs, install chrony. Leave out chrony’s allow directive unless you mean to serve time: an NTP server open to the internet can be abused for amplification attacks. - Audit with Lynis (optional, packaged in Debian, Ubuntu and EPEL). lynis audit system prints concrete suggestions: treat them as a checklist, not a score to maximize. - Keep out-of-band access private. Use the IPMI console only through your dashboard, and protect your dashboard account with a unique password. #### Next steps - See what the included network protection covers in How DDoS protection works on your server. - Finish the basics with the first steps guide. - Locked out after a firewall change? Use the IPMI console, or contact support, available 24/7. ### Manage software RAID 1 with mdadm https://dedijet.com/docs/software-raid · updated 2026-10-14 · 7 min read Check your mdadm RAID 1 array, get an email when a disk fails, replace the failed drive, rebuild, and keep both disks bootable with GRUB and EFI. On servers with two disks, DediJet sets up software RAID 1 by default when it installs your operating system (RAID 0 or no RAID can be selected at install time instead). Linux `mdadm` mirrors every write to both disks, so the server keeps running if one of them fails. This guide shows how to check the array, get alerted, replace a failed disk and keep both disks bootable. > **RAID is not a backup.** A deleted file, a bad migration or ransomware is mirrored to both disks instantly. Keep copies of important data on another system, for example the [backup space add-on](https://dedijet.com/servers/add-ons) (SFTP, rsync, BorgBackup or restic, from $5/mo for 1 TB). #### How your disks are laid out Both disks carry the same partitions, and matching partitions are paired into md arrays. List them with: ```bash lsblk -o NAME,SIZE,TYPE,MOUNTPOINT ``` The exact layout depends on the OS image. A typical UEFI install on two NVMe drives looks like this: ```text NAME SIZE TYPE MOUNTPOINT nvme0n1 931.5G disk ├─nvme0n1p1 512M part /boot/efi ├─nvme0n1p2 1G part │ └─md0 1022M raid1 /boot └─nvme0n1p3 930G part └─md1 929.3G raid1 / nvme1n1 931.5G disk ├─nvme1n1p1 512M part ├─nvme1n1p2 1G part │ └─md0 1022M raid1 /boot └─nvme1n1p3 930G part └─md1 929.3G raid1 / ``` - NVMe naming: nvme0n1 is controller 0, namespace 1, and its partitions add a p: nvme0n1p1. SATA and SAS disks are named sda, sdb, with partitions sda1, sda2. Controller numbers can change between boots, so identify a disk by its serial number, never by its name alone. - EFI system partition (ESP): the firmware reads it directly and knows nothing about mdadm, so on UEFI servers it usually sits outside the arrays. Only the first disk’s ESP is mounted on /boot/efi; keeping the second copy in sync is up to you (last section of this guide). #### Check the array status ```bash cat /proc/mdstat ``` A healthy mirror shows `[2/2] [UU]`: two members expected, two up. ```text md1 : active raid1 nvme1n1p3[1] nvme0n1p3[0] 974452736 blocks super 1.2 [2/2] [UU] bitmap: 2/8 pages [8KB], 65536KB chunk ``` A degraded mirror shows `[2/1]` and an underscore in place of the missing member: `[U_]` or `[_U]`. To see which member failed: ```bash mdadm --detail /dev/md1 ``` ```text State : clean, degraded Active Devices : 1 Working Devices : 1 Failed Devices : 1 Number Major Minor RaidDevice State 0 259 3 0 active sync /dev/nvme0n1p3 - 0 0 1 removed 1 259 7 - faulty /dev/nvme1n1p3 ``` Most distributions also schedule a periodic consistency check. While it runs, `/proc/mdstat` shows `check` with a progress bar: that is normal and runs at low priority. #### Get an email when a disk fails The `mdmonitor` service watches all arrays and sends an email when a member fails or an array becomes degraded. Set the recipient in `/etc/mdadm/mdadm.conf` (Debian, Ubuntu) or `/etc/mdadm.conf` (AlmaLinux, Rocky Linux): ```conf MAILADDR root ``` Forward root’s mail to your own mailbox with an alias in `/etc/aliases`. mdadm hands the message to `/usr/sbin/sendmail`, so the server needs a mail transfer agent: Postfix, or a small relay such as msmtp that forwards through your mail provider. Restart the monitor, then send a test alert for every array: ```bash systemctl restart mdmonitor mdadm --monitor --scan --oneshot --test ``` Prefer chat or paging? A `PROGRAM /usr/local/bin/raid-alert` line in the same file runs your script on every event (it receives the event name, the array and the member device). If you already run Prometheus, node_exporter exposes the array state in its `node_md_*` metrics. #### Replace a failed disk The example assumes `nvme1n1` failed and `nvme0n1` is healthy. Replace the names with yours and read every command twice. > **Back up first.** Until the rebuild finishes, a degraded mirror has no redundancy: if the remaining disk fails, the data is gone. Copy anything you cannot lose before you start, and never point these commands at the healthy disk. 1. **Record the serial numbers** of the failed disk and of the healthy one. If the failed disk has vanished completely, the healthy disk’s serial is enough. `lsblk -d -o NAME,SIZE,MODEL,SERIAL smartctl -i /dev/nvme1n1` 2. **Remove the failed partitions from the arrays** (skip any that already show as removed): `mdadm --manage /dev/md0 --fail /dev/nvme1n1p2 --remove /dev/nvme1n1p2 mdadm --manage /dev/md1 --fail /dev/nvme1n1p3 --remove /dev/nvme1n1p3` 3. **Open a ticket.** Give the serial of the disk to replace, the serial of the disk to keep, and the output of `cat /proc/mdstat` and `smartctl -a` for the failing disk. Under our [SLA](https://dedijet.com/legal/sla), a failed component is replaced within 4 hours of diagnosis, 24/7. Depending on the chassis, the swap may need a short shutdown: agree on a time window in the ticket. 4. **Copy the partition table** to the new disk once it is installed (package `gdisk`). Check the new disk’s name and serial with `lsblk` first. With GPT, the usual case, `--replicate` names the *new* disk and the last argument is the *healthy* source. Then give the copy its own GUIDs: `sgdisk --replicate=/dev/nvme1n1 /dev/nvme0n1 sgdisk --randomize-guids /dev/nvme1n1` For legacy MBR disks (`lsblk -o NAME,PTTYPE` shows `dos`), use `sfdisk -d /dev/nvme0n1 | sfdisk /dev/nvme1n1` instead. 5. **Add the new partitions** to the arrays. The rebuild starts immediately: `mdadm --manage /dev/md0 --add /dev/nvme1n1p2 mdadm --manage /dev/md1 --add /dev/nvme1n1p3` 6. **Watch the rebuild.** The server stays usable meanwhile, with slower disk I/O. `watch -n 5 cat /proc/mdstat` `md1 : active raid1 nvme1n1p3[2] nvme0n1p3[0] 974452736 blocks super 1.2 [2/1] [U_] [====>................] recovery = 22.5% (219351680/974452736) finish=62.9min speed=200000K/sec` The kernel keeps rebuild speed between `dev.raid.speed_limit_min` and `dev.raid.speed_limit_max` (KiB/s per disk). The default ceiling, 200000 KiB/s (about 200 MB/s), is what the example above shows. On an idle NVMe server you can raise it temporarily with `sysctl -w dev.raid.speed_limit_max=2000000`. #### Keep both disks bootable Your data is now mirrored again, but the boot loader lives outside the arrays. Check how the server boots: ```bash [ -d /sys/firmware/efi ] && echo UEFI || echo BIOS ``` ##### Legacy BIOS Install GRUB on the new disk: `grub-install /dev/nvme1n1` on Debian and Ubuntu (then run `dpkg-reconfigure grub-pc` and select both disks so future updates reach them), or `grub2-install /dev/nvme1n1` on AlmaLinux and Rocky Linux. ##### UEFI 1. **Format and fill the second ESP** (packages `dosfstools` and `rsync`): `mkfs.vfat -F 32 /dev/nvme1n1p1 mkdir -p /mnt/esp2 mount /dev/nvme1n1p1 /mnt/esp2 rsync -rt --delete /boot/efi/ /mnt/esp2/ umount /mnt/esp2` 2. **Add a firmware boot entry** for that disk. List the existing entries with `efibootmgr -v` and reuse the loader path of your OS, for example `\EFI\ubuntu\shimx64.efi`, `\EFI\debian\shimx64.efi` or `\EFI\almalinux\shimx64.efi`: `efibootmgr --create --disk /dev/nvme1n1 --part 1 --label "Linux (disk 2)" --loader '\EFI\ubuntu\shimx64.efi'` 3. **Re-sync after boot loader updates.** The ESP rarely changes, mostly when GRUB or shim packages are updated: repeat the `rsync` step after those updates, or run it from a cron job. On Ubuntu, `dpkg-reconfigure grub-efi-amd64` can register both ESPs so GRUB updates are written to each. 4. **Add `nofail` to the `/boot/efi` line** in `/etc/fstab` (for example `umask=0077,nofail`). Without it, a server whose first disk died may stop in emergency mode because it cannot mount that disk’s ESP. To test, pick the second disk once in the firmware boot menu from the [IPMI console](https://dedijet.com/docs/ipmi-kvm-console). #### If the server does not boot Open the IPMI console to see where the boot stops; the firmware boot menu lets you choose the other disk. If that does not help, start [rescue mode](https://dedijet.com/docs/rescue-mode) from your dashboard, assemble the arrays and repair the system from there: ```bash mdadm --assemble --scan cat /proc/mdstat ``` #### Next steps - Catch failing disks before they drop out of the array: check disk health with smartctl and nvme-cli. - Protect what RAID cannot: add backup space and test a restore. - Stuck in the middle of a disk swap? Contact support: hardware issues are handled by engineers, 24/7. ### Log in with SSH keys and disable password authentication https://dedijet.com/docs/ssh-keys · updated 2026-10-14 · 5 min read Create an Ed25519 SSH key on Linux, macOS or Windows, install it on your server, then turn off password logins safely, without locking yourself out. Any server with SSH open to the internet receives automated password-guessing attempts around the clock. With key-based authentication, those attempts are pointless: the server only accepts a login from someone who holds your private key. This guide sets up keys, then disables passwords without cutting off your way back in if something goes wrong. #### Generate a key pair Use Ed25519: the keys are short, fast and supported by every current OpenSSH release. Create the key pair on **your own computer**, never on the server. ##### Linux and macOS ```bash ssh-keygen -t ed25519 -C "you@laptop" ``` Accept the default location, `~/.ssh/id_ed25519`, and set a passphrase. The passphrase encrypts the private key on disk; an agent lets you type it once per session instead of on every connection. On macOS, `ssh-add --apple-use-keychain ~/.ssh/id_ed25519` stores it in the keychain. ##### Windows 10 and 11 The OpenSSH client is built in. In PowerShell: ```powershell ssh-keygen -t ed25519 -C "you@laptop" ``` The private key is saved as `%USERPROFILE%\.ssh\id_ed25519`, the public key as `id_ed25519.pub` next to it. To use the agent, run `Get-Service ssh-agent | Set-Service -StartupType Automatic` once in an elevated PowerShell, then `Start-Service ssh-agent` and `ssh-add`. > **Tip:** With a FIDO2 security key, `ssh-keygen -t ed25519-sk` creates a key that also requires a touch on the device for each login. Only the `.pub` file ever leaves your computer. If a private key is copied somewhere it should not be, treat it as compromised and replace it. #### Install the public key on the server The examples use the account `deploy` (created in [First steps](https://dedijet.com/docs/first-steps)) and the address `203.0.113.10`. For root, use `root@` instead. ##### With ssh-copy-id (Linux and macOS) ```bash ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@203.0.113.10 ``` It logs in with the account password once and appends the key to `~/.ssh/authorized_keys` on the server, creating the directory and file with safe permissions if they do not exist yet. ##### From Windows, or by hand Windows has no `ssh-copy-id`. This PowerShell command does the same job: ```powershell type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh deploy@203.0.113.10 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys" ``` You can also paste the content of the `.pub` file, as a single line, at the end of `~/.ssh/authorized_keys` on the server. ##### Check permissions sshd ignores keys stored in files that other users can write to. On the server, as the user who will log in: ```bash chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys ls -ld ~ ~/.ssh ~/.ssh/authorized_keys ``` The home directory must not be group- or world-writable either. On AlmaLinux and Rocky Linux, run `restorecon -Rv ~/.ssh` if you created or moved the files by hand, so that SELinux lets sshd read them. Now log in with `ssh deploy@203.0.113.10`. If you are asked for the key’s passphrase, or for nothing at all, the key works. If you are asked for the account password, it does not: fix that before going further. `ssh -v` shows which keys your client offers and how the server answers. #### Disable password authentication Run this part as root (`sudo -i`). Current Ubuntu, Debian, AlmaLinux and Rocky Linux releases include every `*.conf` file from `/etc/ssh/sshd_config.d/` at the top of `sshd_config`. For most settings, sshd keeps the **first** value it reads, so a drop-in file whose name sorts first wins. Create `/etc/ssh/sshd_config.d/00-keys-only.conf` with your editor: ```conf PubkeyAuthentication yes PasswordAuthentication no KbdInteractiveAuthentication no PermitRootLogin prohibit-password ``` `prohibit-password` still lets root log in with a key. Use `PermitRootLogin no` once you only log in as your sudo user. Look for older settings that could conflict, then validate the configuration: ```bash grep -ri -E 'passwordauthentication|permitrootlogin' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/ sshd -t ``` `sshd -t` prints nothing when the configuration is valid. Some images ship files such as `50-cloud-init.conf` that set `PasswordAuthentication yes`; the `00-` prefix makes your file win, but removing the old line avoids confusion later. Apply the change; open sessions are not interrupted: ```bash systemctl reload ssh ``` On AlmaLinux and Rocky Linux, the service is called `sshd`: `systemctl reload sshd`. Then check the values sshd actually uses: ```bash sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin)' ``` You should see `passwordauthentication no`. `prohibit-password` may be displayed under its older name, `without-password`. #### Test in a second session before you log out > **Warning:** Keep your current SSH session open until the test below succeeds. It is your safety net: from it, you can still undo the change. 1. **Open a new terminal and log in with your key.** `ssh deploy@203.0.113.10` must work. 2. **Check that passwords are refused.** Force password authentication: `ssh -o PubkeyAuthentication=no -o PreferredAuthentications=password deploy@203.0.113.10` The expected answer is `Permission denied (publickey).` 3. **Only then close the original session.** If the first step fails, delete `00-keys-only.conf` from the session that is still open, reload sshd, and check the key and the permissions again. #### Save typing with an SSH config alias On your computer, add an entry to `~/.ssh/config` (on Windows, `%USERPROFILE%\.ssh\config`): ```conf Host web1 HostName 203.0.113.10 User deploy IdentityFile ~/.ssh/id_ed25519 IdentitiesOnly yes ``` Now `ssh web1` is enough, and tools that run over SSH, such as `scp`, `rsync` and `git`, accept the same alias. `IdentitiesOnly yes` stops the client from offering every key in your agent, which avoids “Too many authentication failures” errors. #### Locked out? Recover with the IPMI console sshd settings only apply to network logins. The local console still accepts the root password, so the [IPMI/KVM console](https://dedijet.com/docs/ipmi-kvm-console) is your way back in: 1. **Open the console.** In your dashboard, open the server, then choose Console (IPMI). 2. **Log in as root** with the root password. 3. **Undo the change** and reload sshd (`sshd` on AlmaLinux and Rocky Linux): `mv /etc/ssh/sshd_config.d/00-keys-only.conf /root/ systemctl reload ssh` 4. **Fix the cause**, usually a missing key or wrong permissions, then put the file back. The console needs a password, so a root account without one cannot log in there. That can happen when a server was installed with an SSH key only. Set a strong root password now with `passwd` and store it in your password manager: SSH keeps refusing passwords, but the console will accept it. Without a password, use [rescue mode](https://dedijet.com/docs/rescue-mode) to set one or to repair the files. #### Next steps Continue with [server hardening](https://dedijet.com/docs/server-hardening). If you also move SSH to another port, allow the new port in your firewall first. On Ubuntu, check `systemctl status ssh.socket`: when the socket unit is active, a port change also needs `systemctl daemon-reload` and `systemctl restart ssh.socket`. Still stuck? Open a ticket from [Support](https://dedijet.com/support) and include the output of `ssh -v`. ### Windows Server: first login, RDP and updates https://dedijet.com/docs/windows-server · updated 2026-10-14 · 5 min read Log in to Windows Server 2025 or 2022 over RDP, install updates, restrict Remote Desktop to your IPs, and configure IPv6 and additional IPv4 addresses. Windows Server 2025 and 2022 Standard install in one click. A new Windows server is online in under 2 minutes after payment confirmation, and the delivery email contains its IP address and the `Administrator` password. #### License and billing The Windows Server license is billed monthly with the server: $2.75 per physical core per month, with a minimum of 8 cores. Prices exclude VAT. | Server | Physical cores | License per month | | --- | --- | --- | | [Intel Xeon E-2236](https://dedijet.com/servers/xeon-e-2236) | 6 (8-core minimum applies) | $22 | | [AMD Ryzen 7 9700X](https://dedijet.com/servers/ryzen-7-9700x) | 8 | $22 | | [AMD Ryzen 9 9950X](https://dedijet.com/servers/ryzen-9-9950x) | 16 | $44 | | [AMD EPYC 9354P](https://dedijet.com/servers/epyc-9354p) | 32 | $88 | The license covers the operating system and up to two simultaneous administrative Remote Desktop sessions. Remote Desktop Services for end users requires separate RDS licensing, which is not included. #### First login over RDP - Windows: run mstsc /v:203.0.113.10 or open Remote Desktop Connection. - macOS: use Microsoft’s Windows App (formerly Microsoft Remote Desktop). - Linux: use Remmina, or xfreerdp /v:203.0.113.10 /u:Administrator (xfreerdp3 on newer distributions). Log in as `Administrator` with the password from the email, and accept the certificate warning: the server uses a self-signed RDP certificate until you install your own. Change the password right away: press `Ctrl`+`Alt`+`End` in the session and choose *Change a password*, or run in PowerShell: ```powershell Set-LocalUser -Name Administrator -Password (Read-Host -AsSecureString "New password") ``` #### Install updates Install the latest cumulative update before you expose any service: - Desktop Experience: Settings → Windows Update → Check for updates. - Any installation, including Server Core: run sconfig in PowerShell and choose option 6 (Install updates). Option 5 (Update setting), then A, switches to automatic updates, installed every day at 3:00 AM server time. Cumulative updates need a reboot, and your services are down until Windows is back. Schedule it for a quiet hour. #### Restrict Remote Desktop An RDP port open to the world receives constant password-guessing attempts from bots. Reduce the exposure step by step. > **Lockout risk.** Create and test the new rule before you disable the old ones. If RDP stops answering, the [IPMI console](https://dedijet.com/docs/ipmi-kvm-console) in your dashboard still gives you the login screen. 1. **Allow RDP only from your addresses.** Create a rule for your IPv4 and IPv6 addresses, then disable the built-in rules that allow everyone: `New-NetFirewallRule -DisplayName "RDP from admin IPs" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 198.51.100.7,2001:db8:abcd::/48 -Action Allow Disable-NetFirewallRule -DisplayGroup "Remote Desktop"` Without the built-in UDP rule, RDP simply runs over TCP. 2. **Keep Network Level Authentication on.** NLA requires valid credentials before a session starts and is on by default. This check returns 1 when it is enabled: `(Get-CimInstance -Namespace root\cimv2\TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-tcp'").UserAuthenticationRequired` 3. **Stop using the name Administrator.** Bots try it first. Create your own administrator, log in with it in a new session, then disable the built-in account: `New-LocalUser -Name "deploy" -Password (Read-Host -AsSecureString "Password") Add-LocalGroupMember -Group "Administrators" -Member "deploy" Disable-LocalUser -Name "Administrator"` 4. **Lock accounts after failed attempts:** here, 15 minutes after 10 wrong passwords. `net accounts /lockoutthreshold:10 /lockoutwindow:15 /lockoutduration:15` 5. **Better still, hide RDP.** Connect through a VPN such as WireGuard and allow port 3389 only from the VPN subnet, or publish RDP over HTTPS with the RD Gateway role, which requires RDS licensing. #### Enable IPv6 Your server comes with a routed /64. Check whether an address from it is already configured: ```powershell Get-NetIPAddress -AddressFamily IPv6 ``` If you only see `fe80::` link-local addresses, find the adapter name with `Get-NetAdapter`, then add an address from your /64 and the IPv6 gateway shown in your dashboard (`fe80::1` in this example): ```powershell New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 2001:db8:1234:5678::1 -PrefixLength 64 New-NetRoute -InterfaceAlias "Ethernet" -DestinationPrefix "::/0" -NextHop fe80::1 ``` With netsh, the equivalent is `netsh interface ipv6 add address "Ethernet" 2001:db8:1234:5678::1/64` followed by `netsh interface ipv6 add route ::/0 "Ethernet" fe80::1`. In the GUI, open `ncpa.cpl`, then the adapter’s *Internet Protocol Version 6 (TCP/IPv6)* properties. Test with `ping -6` towards a host you know has IPv6, and add your own IPv6 address to the RDP rule if you connect over IPv6. More in [Configure your /64 IPv6 subnet](https://dedijet.com/docs/ipv6-setup). #### Add additional IPv4 addresses Additional IPv4 addresses ($2.50 per IP per month, see [Additional IPv4 addresses](https://dedijet.com/docs/additional-ipv4)) go on the same adapter. They are routed to your main IP, so add them with a /32 mask, and mark them `SkipAsSource` so that outgoing connections keep using the main IP: ```powershell New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 198.51.100.20 -PrefixLength 32 -SkipAsSource $true ``` In the GUI: adapter properties → *Internet Protocol Version 4 (TCP/IPv4)* → *Advanced* → *IP addresses* → *Add*, with the subnet mask 255.255.255.255. #### If RDP is unreachable In your dashboard, open the server and choose Console (IPMI). Use the console’s `Ctrl`+`Alt`+`Del` function to reach the login screen, sign in, and check the network and Remote Desktop from PowerShell: ```powershell Get-NetIPAddress -AddressFamily IPv4 Get-NetRoute -DestinationPrefix 0.0.0.0/0 Get-Service TermService Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0 Enable-NetFirewallRule -DisplayGroup "Remote Desktop" ``` The last two lines turn Remote Desktop back on and reopen its default firewall rules; restrict them again once you are back in. If Windows no longer boots, copy your data off from [rescue mode](https://dedijet.com/docs/rescue-mode) before you [reinstall](https://dedijet.com/docs/reinstall-os). #### Next steps - See what the included network protection covers in How DDoS protection works on your server. - Compare Windows Server with the other systems on Operating systems. - Still locked out? Contact support: IPMI access and OS install issues are in scope, 24/7. ## Blog ### How to buy a dedicated server with crypto: BTC, XMR, USDT, ETH and SOL https://dedijet.com/blog/buy-dedicated-server-with-crypto · 2026-10-15 Paying for a dedicated server with cryptocurrency takes about as long as paying by card, without the card: no bank, no billing address and, at DediJet, no identity check. What it does need is a little care, because a crypto payment cannot be charged back. Send the wrong coin, or the right coin on the wrong network, and nobody can undo it. This guide walks through the whole process, from choosing the server to the first login, with the checks that keep your payment safe. #### What you need before you start - One of the coins we accept: Bitcoin (BTC), Ethereum (ETH), Monero (XMR), Tether (USDT) on the TRON network, or Solana (SOL). - A way to send it: your own wallet, such as a hardware, desktop or mobile wallet, or an exchange account that allows withdrawals. - An email address and a password for your account. That is all: no name, no phone number, no ID document. - An SSH key, ideally, so that you can log in without a password from the first minute. Our SSH key guide explains how to create one. #### Step 1: choose the server and the location Start from the workload, not the coin. A game server wants high clock speeds, a database wants ECC memory and fast NVMe, a backup target wants raw capacity. The [solution guides](https://dedijet.com/solutions) recommend three servers per workload, and the [full catalog](https://dedijet.com/servers) shows live stock and the monthly price of each configuration. Prices are the same in every location, so choose the city closest to your users; the [latency checker](https://dedijet.com/network/latency) estimates round-trip times from your city. Only servers marked in stock can be delivered in under 2 minutes. A sold-out configuration shows the closest in-stock alternative. #### Step 2: pick the coin that suits you Every coin funds the same account balance, with the same bonus. They differ in speed, in price stability and in privacy: | Coin | Network accepted | Credited in | Best for | | --- | --- | --- | --- | | [USDT](https://dedijet.com/usdt-dedicated-servers) | TRON (TRC-20) only | About 1 minute | No price swings, fast credit | | [Solana](https://dedijet.com/solana-dedicated-servers) | Solana mainnet, native SOL | About 1 minute | Speed and fees under a cent | | [Ethereum](https://dedijet.com/ethereum-dedicated-servers) | Ethereum mainnet, native ETH | About 3 minutes | Paying from an Ethereum wallet | | [Bitcoin](https://dedijet.com/bitcoin-dedicated-servers) | Bitcoin mainnet, on-chain | 10 to 20 minutes | The most widely held coin | | [Monero](https://dedijet.com/monero-dedicated-servers) | Monero mainnet | About 20 minutes | Privacy: amounts and addresses hidden | Times are measured from the moment you send, and they depend on network congestion and on the fee your wallet sets. If you want your server online as fast as possible, pay with USDT on TRON or with Solana. #### Step 3: create your account, without KYC Configure the server, then create your account in the same flow: an email address and a password of at least 10 characters. You then receive a **recovery key**. Store it in a password manager. It is the only way to reset your password, since we never reset passwords by email, which also means that nobody can take over your account by pretending to be you. Two-factor authentication can be turned on at any time. Your configuration is kept while you sign up, so you land straight on the payment step. #### Step 4: top up your balance Servers are paid from your account balance. When the balance is too low, the payment step asks for a top-up: from $100 per top-up, with the amount that covers your server suggested first. Every full $100 earns a 5% bonus, up to 50% from $1,000, credited together with your payment. The bonus pays for servers, renewals and add-ons like the rest of your balance. When you confirm, we lock the exchange rate for **30 minutes** and show the exact amount of the coin, the address and a QR code. If you send that amount within the window, you are credited the full dollar value, even when the confirmation arrives after the window has closed. #### Step 5: send the payment, and check these four things 1. The network. This is where most lost payments come from. Send USDT on TRON (TRC-20) only, ETH on the Ethereum mainnet only (not Arbitrum, Optimism, Base or another layer 2), native SOL rather than a token on Solana, and on-chain bitcoin rather than Lightning. On an exchange, check the network field of the withdrawal screen before you confirm. 2. The amount that arrives. Some exchanges deduct their withdrawal fee from the amount you type. If 2 USDT of fee comes off a 300 USDT withdrawal, 298 arrive. Add the fee so that the exact amount reaches us. 3. The address. Scan the QR code or copy and paste the address, then compare its first and last characters with the payment page. Clipboard malware that swaps addresses exists. 4. The timing. Send early in the 30-minute window. Exchanges sometimes batch withdrawals or hold them for a security review. #### Step 6: credit and deployment You can follow the payment live on its page in your account. Once it has the confirmations it needs, the credit and its bonus land in your balance, the server is paid from it and its deployment starts automatically: it is online in under 2 minutes after payment confirmation. The IP address, the root password and the out-of-band console then appear on the server’s page in your dashboard, and our [first steps guide](https://dedijet.com/docs/first-steps) takes you from the first login to a secured system. #### The classic mistakes, and what happens | Mistake | What happens | | --- | --- | | Wrong network or wrong coin | The payment reaches an address we cannot credit, and it may be lost. Always copy the network and the address from the payment page. | | Too little sent | You are credited the dollar value of what arrives, with the bonus calculated on it. If the balance still does not cover the server, top up the difference. | | Sent after the 30-minute window | The payment is converted at the rate of the moment it confirms, which may be more or less than planned. | | Bitcoin fee too low | The payment waits in the mempool. If it was sent within the window, the locked rate still applies once it confirms; replace-by-fee speeds it up. | #### What a crypto payment hides, and what it does not Bitcoin, Ethereum, USDT and Solana payments are public: anyone who knows an address can see its transactions, and an exchange knows who made each withdrawal it processed. Monero is different, because it hides the sender, the receiver and the amount on its blockchain. If privacy matters to you, pay with Monero from your own wallet, and read [what we ask and never ask](https://dedijet.com/no-kyc-dedicated-servers) when you open an account. Privacy is not a licence, though. Every server is subject to our [Acceptable Use Policy](https://dedijet.com/legal/acceptable-use), whatever the coin. #### Renewals and refunds A server renews on the same day each month and is paid from your balance; the invoice is issued 7 days before the due date. Keep the balance funded and renewals take care of themselves. The topped-up part of an unused balance is refundable on request, in the coin you paid with and minus the network fee. Bonus credit is not refundable. Every rule is on our [crypto payments page](https://dedijet.com/pay-with-crypto) and in the [billing guide](https://dedijet.com/docs/billing-and-renewals). ### Introducing DediJet: dedicated servers online in under 2 minutes https://dedijet.com/blog/introducing-dedijet · 2026-10-14 Renting a dedicated server often still means waiting at the gate. At many hosts, an order joins a queue, a technician picks a machine and installs an operating system, and the credentials arrive hours or days later. We started DediJet to take that wait out. Today we launch with 15 bare-metal configurations in 8 locations, and every in-stock server is delivered automatically, online in under 2 minutes after payment confirmation. #### Why we started DediJet Cloud platforms taught everyone to expect infrastructure on demand; bare metal mostly did not follow. A manual process is fine for a build-out planned months ahead. It is frustrating when you need one machine tonight: for a game launch, a database that outgrew its VM, or a client project approved this afternoon. Faster technicians are not the fix. Doing the slow work before anyone orders is. Every in-stock DediJet server is already racked, cabled and burned in, then parked in a **ready pool** in its location. When you pay, software takes it from there, at any hour, with no ticket and no human in the loop. #### What launches today We open with **15 configurations in 5 families**, from a 6-core Intel Xeon E-2236 at $59/mo to a 96-core AMD EPYC 9654 (sold out at launch), plus dense storage and NVIDIA GPU servers. Online checkout opens shortly after launch. Until then, you can configure any in-stock server and save the configuration with your email: we send you a link to finish that exact order as soon as payment opens. Nothing is charged before then. | Family | Built for | Configurations | In stock at launch | From | | --- | --- | --- | --- | --- | | [Entry](https://dedijet.com/servers/cheap) | Projects, development and small sites | 3 | 2 | $59/mo | | [Performance](https://dedijet.com/servers/ryzen) | Game servers and busy applications | 4 | 3 | $115/mo | | [Enterprise](https://dedijet.com/servers/epyc) | Virtualization, databases and data | 4 | 3 | $215/mo | | [Storage](https://dedijet.com/servers/storage) | Backups and media archives | 2 | 1 | $225/mo | | [GPU](https://dedijet.com/servers/gpu) | AI, rendering and transcoding | 2 | 1 | $435/mo | At launch, five configurations have no machine in the ready pool, so they carry a **SOLD OUT** label instead of being hidden or quietly back-ordered. Each one points to the closest in-stock alternative. Popular configurations are restocked regularly, and you can ask to be notified when one is back. - 8 locations on 3 continents: New York, Miami, Los Angeles, London, Amsterdam, Frankfurt, Singapore and Tokyo. Each location page shows what is in stock there. - One monthly price: no setup fee on any listed server, cancel anytime. Prices exclude VAT, and extras such as additional IPv4 addresses are priced on the add-ons page. - Crypto payments: Bitcoin, Ethereum, Monero, USDT (TRC-20) and Solana, with the exchange rate locked for 30 minutes. Top-ups earn a bonus of +5% for every $100, up to +50% from $1,000. See paying with crypto. - Minimal data: an email address is all you need to order. No name, phone number or ID document; we may ask for more only when investigating fraud or abuse. Our website sets no cookies of its own and runs no analytics or ad trackers. Every server includes full root access, an IPMI/KVM console, always-on DDoS mitigation, unmetered bandwidth, one IPv4 address and a /64 IPv6 subnet. #### How instant delivery works Before a machine joins the ready pool, it passes a burn-in: a memory test, a CPU stress test and SMART/NVMe health checks on its disks. Once your payment is confirmed, automation: 1. assigns a machine from the pool in the location you chose; 2. configures its network, IPv4 and IPv6; 3. writes the operating system image you picked to the disks; 4. sets your root password or SSH key and shows the credentials in your dashboard. Every in-stock server is online in under 2 minutes after payment confirmation, whatever the system: Linux, Proxmox VE or Windows Server. The example timeline on our homepage reads: order at T+0 s, payment confirmed at T+5 s, system deployed at T+40 s, online at T+1 min 50 s. Your payment network sets the start of that clock: USDT on TRON (TRC-20) and Solana confirm fastest, while Bitcoin typically takes 10–20 minutes. The full walkthrough is on the [instant delivery page](https://dedijet.com/instant-delivery). #### Our principles - **Live stock**: “In stock” means a burned-in machine is waiting in the ready pool. When a configuration runs out, the label says so and the closest alternative is suggested. - **Transparent prices**: One monthly price per server, excluding VAT, with no setup fee. Add-ons have public prices too. - **No lock-in**: Monthly billing and cancellation from your dashboard at any time. A canceled server stays online until the end of the paid month, and its disks are securely erased before the machine returns to stock. - **Engineers on support, 24/7**: Tickets are handled by engineers around the clock, in English. Our first-response targets are 30 minutes for critical issues, such as a server down or a network outage, and 4 hours for everything else. Servers are unmanaged: you administer the operating system and your software; we handle hardware, network, provisioning and IPMI access. - **Filter, don’t null-route**: Always-on, network-level DDoS mitigation is included with every server. Floods and amplification attacks are detected automatically and filtered upstream. Whenever possible we filter rather than null-route your IP address, because a null route finishes the attacker’s job. Application-layer (HTTP) attacks need a reverse proxy, CDN or WAF in front of your site. #### Meet Dex You will spot a small flying robot around the site. That is Dex, our mascot: a 2U server with pilot goggles, a yellow scarf, a dark visor face with two yellow eyes and twin jet thrusters. Dex is the reason the site borrows from airports. Locations are gates labeled with their IATA codes, from NYC to TYO; the stock list on the homepage is a departures board; and a delivery is a takeoff. The theme is there to make a fast process feel calm, never to hide information. Wherever a pun and a plain fact compete, the plain fact wins. #### What’s next - Online checkout. The client area is open: you can top up your balance in crypto with a bonus of up to +50%, save server configurations, add SSH keys, open tickets, turn on two-factor authentication and create API tokens. Online checkout comes next, and with it server management (reinstall, rescue mode, IPMI console, network, reverse DNS). The API documentation shows what you will be able to automate. - More locations, based on demand. We will consider new cities according to where customers ask for them. If a region matters to you, tell us. Customers with an active server reach the team by ticket from their account, 24/7; abuse reports go through the public [abuse form](https://dedijet.com/abuse). #### Take a look around The quickest way to get to know DediJet is the live catalog. Browse [all servers and prices](https://dedijet.com/servers), check what is in stock in each [location](https://dedijet.com/locations), or estimate latency from your users’ cities with the [latency checker](https://dedijet.com/network/latency). If something is unclear, or you need hardware we do not list yet, send us a message. Thanks for stopping by on day one. ### Dedicated server vs VPS: when bare metal is the better deal https://dedijet.com/blog/dedicated-server-vs-vps · 2026-10-14 A VPS and a dedicated server can run the same Linux image and the same application. The difference is what sits underneath: a slice of a shared host, or the whole machine. For small and spiky workloads the slice is often the right call. For workloads that run hard around the clock, bare metal tends to win on predictability and on price per unit of compute. Here is how to tell which case you are in. #### What you actually rent A **VPS** (virtual private server) is a virtual machine. A hypervisor such as KVM runs many VMs on one physical host and divides its CPU threads, memory, disks and network among them. Some plans reserve hardware threads for you. Many oversubscribe: they sell more vCPUs than the host has threads, betting that not every tenant is busy at once. A **dedicated server** is the physical machine itself. Every core, every gigabyte of RAM, the NVMe drives and the network port are yours, and there is no hypervisor under your operating system unless you install one. #### Noisy neighbors and CPU steal On a shared host, each vCPU is a thread that the hypervisor schedules alongside everyone else’s. When other tenants are busy, your vCPU can be ready to run and still have to wait. Linux reports that wait as **steal time**: ```bash top -bn1 | head -n 5 vmstat 1 5 ``` In `top`, steal is the last field of the `%Cpu(s)` line; in `vmstat`, it is the `st` column. In this example, 7.6% of CPU time was stolen: ```text %Cpu(s): 41.2 us, 3.0 sy, 0.0 ni, 47.5 id, 0.3 wa, 0.0 hi, 0.4 si, 7.6 st ``` `st` is the share of time your virtual CPUs wanted to run while the hypervisor served someone else. Short spikes are common; steal that stays high while your application is busy means you are paying for vCPUs that wait in line. On burstable plans, throttling after you run out of CPU credits can look the same. Steal is only the visible part. Even with dedicated vCPUs, tenants share the L3 cache, memory bandwidth and often the storage and network paths, so a neighbor’s batch job can still add jitter to your response times. On bare metal, `st` stays at zero: there is no hypervisor below you. #### Disk I/O: NVMe without a queue in front of you VPS storage is usually a share of local NVMe drives or network block storage, where every read and write crosses the network to a storage cluster. Both are commonly capped per volume, and network storage adds a round trip to every I/O. For databases, search indexes and game worlds, latency per operation matters more than headline throughput: watch `wa` (I/O wait) in `top` and the `r_await` and `w_await` columns of `iostat -x 1`. On a dedicated server, the NVMe drives sit on the machine’s own PCIe bus, and their full queue depth serves your workload alone. Every DediJet configuration includes NVMe, with software RAID 1 by default on two-disk servers. Measure rather than trust a spec sheet; this `fio` run tests 4 KB random reads on a temporary file: ```bash apt install -y fio fio --name=randread --filename=/root/fio.test --size=4G --rw=randread --bs=4k --iodepth=32 --numjobs=4 --ioengine=libaio --direct=1 --runtime=60 --time_based --group_reporting rm /root/fio.test ``` Run it on your current VPS too, and compare the IOPS and the `clat percentiles` (completion latency) in both outputs. #### Bandwidth: per-GB egress or an unmetered port Cloud platforms and many VPS plans meter **egress**: you pay for every gigabyte that leaves, sometimes after an included allowance. The cost grows in a straight line with your traffic: ```formula monthly egress cost = GB sent per month × price per GB ``` A dedicated server with an **unmetered port** works the other way: you pay for the port speed, and traffic is not counted. Every DediJet plan includes unmetered bandwidth at its port speed (1 Gbps or 10 Gbps), around the clock, within the Acceptable Use Policy. A 1 Gbps port running flat out for 30 days moves about 324 TB in each direction. To find where the two models cross, divide a server’s monthly price by the per-GB rate in your quote. For the Ryzen 7 9700X, 149 ÷ rate gives the number of gigabytes beyond which egress alone costs more than the whole server. Our [guide to unmetered bandwidth](https://dedijet.com/blog/unmetered-bandwidth-explained) works through the numbers. #### Root access, IPMI and the hardware itself Both options give you root inside the operating system. The difference is what surrounds it: - Out-of-band access. DediJet servers include IPMI/KVM-over-IP: a browser-based console, power control and virtual media to mount your own ISO. If a firewall rule or a kernel update locks you out, you still have a screen and a keyboard. A VPS console reaches the VM, never the hardware. - Your own hypervisor. Install Proxmox VE in one click, or VMware ESXi with your own license, TrueNAS or NixOS from an ISO, and run VMs and containers without nested virtualization, which many VPS plans disable or slow down. - Real hardware data. SMART and NVMe health, CPU topology and clock behavior, NIC settings: you see the actual devices, not virtual ones. The trade-off: servers are unmanaged, so you are the administrator. Our [first steps](https://dedijet.com/docs/first-steps) and [IPMI/KVM console](https://dedijet.com/docs/ipmi-kvm-console) guides cover the basics. #### Cost math: price per core and per GB of RAM A fair comparison divides the monthly price by what you get. Here are three DediJet servers (monthly prices, excluding VAT): | Server | Price | Cores / threads | RAM | Storage · port | Per core | Per thread | Per GB RAM | | --- | --- | --- | --- | --- | --- | --- | --- | | [Ryzen 7 9700X](https://dedijet.com/servers/ryzen-7-9700x) | $149/mo | 8C/16T | 64 GB DDR5 | 2 × 1 TB NVMe · 1 Gbps | $18.63 | $9.31 | $2.33 | | [Ryzen 9 9950X](https://dedijet.com/servers/ryzen-9-9950x) | $269/mo | 16C/32T | 128 GB DDR5 | 2 × 2 TB NVMe · 1 Gbps | $16.81 | $8.41 | $2.10 | | [EPYC 9354P](https://dedijet.com/servers/epyc-9354p) | $699/mo | 32C/64T | 384 GB DDR5 ECC | 2 × 3.84 TB NVMe · 10 Gbps | $21.84 | $10.92 | $1.82 | Each column divides the full price by one resource, so the figures do not add up. Storage, the unmetered port, an IPv4 address, IPMI and DDoS mitigation are included in every line. Apply the same yardstick to any cloud or VPS quote. One vCPU is usually one hardware thread, not a full core, so compare per thread, or halve the vCPU count to get cores: ```text price per thread = monthly cost ÷ dedicated vCPUs price per core = monthly cost ÷ (dedicated vCPUs ÷ 2) monthly cost = hourly price × 730 ``` Use dedicated vCPUs, not shared or burstable ones, and add what the server price already includes: block storage, egress at your real volume, extra IP addresses. For example, a 16-vCPU instance with 64 GB of RAM must cost less than $149 per month, before storage and egress, to match the Ryzen 7 9700X per thread. Two cautions. A thread on a Zen 5 core boosting to 5.5 GHz and a vCPU on a lower-clocked server part do not do the same work per second, so price per thread is a starting point, not a verdict. And cores are not the only axis: the EPYC 9354P costs more per core, yet it has the lowest price per GB of memory of the three, plus ECC and a 10 Gbps port. Test your real workload with our [benchmark guide](https://dedijet.com/docs/benchmark). #### When a VPS is still the right choice - The workload is tiny. A personal site, a bot or a small VPN endpoint does not need a whole machine. Our lowest-priced in-stock server is $59/mo; if your workload fits a small VM, a VPS will cost less. - Demand is bursty or short-lived. A CI runner for an hour, a load test, a weekly data job: hourly or per-second billing beats a monthly server that sits idle. - You need autoscaling. If your stack scales out automatically with traffic, or down to zero, cloud instances fit that model; DediJet bills monthly. - You rely on managed services. Managed databases, queues and object storage on the same platform are worth a premium to some teams. - You want the platform to absorb hardware failures. Some platforms restart a VM on another host when hardware fails. A dedicated server is one machine: we replace a failed component within 4 hours of diagnosis, but real availability comes from backups and a second server. Many teams end up hybrid: dedicated servers for the steady baseline, cloud instances for the bursts. #### Checklist: which one should you pick? Bare metal is likely the better deal if most of these are true: - The workload runs around the clock at a steady baseline. - You see sustained steal time, or latency jitter your own code does not explain. - Disk latency matters: databases, search, game worlds, build caches. - Egress is a large or unpredictable part of your bill. - You need your own hypervisor, a custom ISO or an out-of-band console. - Your quote, per dedicated vCPU with storage and egress added, is above our per-thread figures. - Someone on your team is comfortable administering a server. Stay on a VPS if you need hourly billing, autoscaling or only one or two vCPUs. Ready to compare? Line configurations up on the [comparison page](https://dedijet.com/servers/compare), or start with the [Performance](https://dedijet.com/servers/ryzen) and [Enterprise](https://dedijet.com/servers/epyc) families. Billing is monthly with no setup fee, so a one-month test with your real workload is a small commitment. ### Ryzen 9 9950X vs EPYC 4464P: which dedicated server for your workload? https://dedijet.com/blog/ryzen-9-9950x-vs-epyc-4464p · 2026-10-14 Both servers are built on AMD’s AM5 platform, both have 64 MB of L3 cache, and both come with 128 GB of DDR5 on our plans. They are $54 a month apart. What decides between them is core count, clock speed, ECC memory and power, and each of those points to different workloads. This comparison sticks to specifications and prices: we do not quote benchmark scores we have not measured. #### Specs at a glance | Specification | Ryzen 9 9950X | EPYC 4464P | | --- | --- | --- | | Architecture | Zen 5 (2024) | Zen 4, EPYC 4004 series (2024) | | Platform | AM5, PCIe 5.0 | AM5, PCIe 5.0 | | Cores / threads | 16C/32T | 12C/24T | | Base–boost clock | 4.3–5.7 GHz | 3.7–5.4 GHz | | L3 cache | 64 MB | 64 MB | | TDP | 170 W | 65 W | | Memory on our plan | 128 GB DDR5 (non-ECC) | 128 GB DDR5 ECC | | Storage on our plan | 2 × 2 TB NVMe | 2 × 1.92 TB NVMe | | Network | 1 Gbps, unmetered | 1 Gbps, unmetered | | Price (excl. VAT) | $269/mo | $215/mo | | Locations | Frankfurt, Amsterdam, London, New York, Los Angeles, Singapore | New York, Miami, Los Angeles, Amsterdam, Frankfurt, Singapore, Tokyo | #### Cores, threads and clock speed The 9950X has four more cores and eight more threads, and it is clocked higher at both ends: 4.3 GHz base versus 3.7 GHz, and 5.7 GHz boost versus 5.4 GHz. It also uses the newer core design. AMD built Zen 5 to do more work per clock cycle than Zen 4, but how much more depends heavily on the code, which is why we do not put a percentage on it. Boost clocks are best-case figures for lightly threaded work. Under a sustained all-core load, each chip settles at whatever frequency its power and thermal limits allow, and here the gap widens: the 9950X is rated at 170 W, the 4464P at 65 W. Expect the 9950X to hold higher clocks when every core is busy, and the 4464P to trade some of that speed for a much lower power draw. One more difference matters for vectorized code such as video encoders, compression and some inference libraries. Both chips support AVX-512, but Zen 5 executes 512-bit instructions on a full-width datapath, while Zen 4 splits them across 256-bit units. #### Cache, memory and ECC On paper the caches are identical. On both chips, the 64 MB of L3 is split into two 32 MB pools, one per core chiplet (CCD), and a core reaches its own chiplet’s pool fastest. Because the 4464P spreads the same cache over fewer cores, each core gets a larger share: about 5.3 MB of L3 per core, against 4 MB on the 9950X. Both platforms use dual-channel DDR5, and both of our plans ship 128 GB. The difference is error correction. The 4464P plan uses **ECC memory**: extra check bits let the memory controller correct single-bit errors, detect multi-bit ones and report both to the operating system. The 9950X plan uses standard, non-ECC DDR5. > **Note:** DDR5’s on-die ECC is not the same thing. It corrects errors inside each memory chip, but it does not protect data on its way to the CPU and reports nothing to the operating system. Only ECC modules let the memory controller check every read and log what it corrects. Memory errors are rare, but a server with long uptimes and a lot of RAM gets many chances to meet one. A flipped bit in a database page, a filesystem structure or a cached object can be written back to disk without anyone noticing. On the 4464P, you can log corrected errors with `rasdaemon`: ```bash apt install -y rasdaemon systemctl enable --now rasdaemon ras-mc-ctl --summary ``` A steady trickle of corrected errors on one module is your cue to open a ticket: under our [SLA](https://dedijet.com/legal/sla), a failed component is replaced within 4 hours of diagnosis. #### Power, platform and upgrades TDP is the headline difference: 170 W for the 9950X, 65 W for the 4464P. Power is included in our flat monthly price, so for you the number matters in two ways: how hard each chip can push under sustained load and, if your organization tracks it, the energy footprint of your infrastructure. The rest of the platform is shared: both CPUs sit in the AM5 socket and support PCIe 5.0, and both plans can take the 10 Gbps port upgrade ($129/mo, unmetered). If you need more memory than these plans carry, more memory channels or many more PCIe lanes, step up to the [EPYC 7443P](https://dedijet.com/servers/epyc-7443p) (24C/48T, 256 GB DDR4 ECC) or the [EPYC 9354P](https://dedijet.com/servers/epyc-9354p) (32C/64T, 384 GB of 12-channel DDR5 ECC, 128 PCIe 5.0 lanes). #### Price per core, per thread and per GB | Monthly, excl. VAT | Ryzen 9 9950X | EPYC 4464P | | --- | --- | --- | | Server price | $269 | $215 | | Per core | $16.81 | $17.92 | | Per thread | $8.41 | $8.96 | | Per GB of RAM | $2.10 | $1.68 | | Windows Server license ($2.75 per physical core) | $44 | $33 | The 9950X costs less per core and per thread. The 4464P costs less in absolute terms and per gigabyte of memory, and it is the one with ECC. For $54 more per month, the 9950X adds four cores, eight threads and higher clocks. If you plan to run Windows Server, the license is billed per physical core ($2.75 per core per month, minimum 8 cores), so the 9950X’s extra cores also add $11/mo in licensing. #### Which workloads favor which ##### Pick the Ryzen 9 9950X for - Game servers. Minecraft and many other game servers run their main simulation loop on one thread, so the 5.7 GHz boost and the Zen 5 core matter most, and 16 cores leave room for several instances. - Compile farms and CI runners. Builds scale with both core count and clock speed, and they are reproducible: if a rare memory error ever breaks a build, you rebuild. 32 threads keep make -j and parallel test suites busy. - Single-thread-sensitive services. A Node.js event loop, a Redis cache or a legacy application that cannot spread across cores runs fastest on the highest clock. - Vector-heavy work. CPU video encoding, compression and other AVX-512 code can benefit from Zen 5’s full-width datapath. ##### Pick the EPYC 4464P for - Databases. PostgreSQL or MySQL with a large buffer cache in 128 GB of ECC memory. Twelve cores cover many production databases, and ECC protects pages before they are written to disk. - Long-running services with state. Queues, file servers, ZFS pools and blockchain nodes that stay up for months benefit from error correction and error logs. - A tighter budget. At $215/mo, it is the less expensive of the two, with the same memory capacity. - Miami or Tokyo. Of these two servers, only the 4464P is offered in those locations. Only the 9950X is offered in London. ##### Virtualization: either works Both install [Proxmox VE](https://dedijet.com/docs/install-proxmox) in one click. The 9950X gives you more threads to hand out as vCPUs. The 4464P’s ECC protects every guest at once, which matters when one bad bit could land in any of your VMs. Either way, 128 GB of RAM is usually the first limit you hit, so plan your guests around it. #### Decision table | If your priority is… | Choose | Why | | --- | --- | --- | | Highest single-thread clock | Ryzen 9 9950X | 5.7 GHz boost, Zen 5 | | Most cores and threads | Ryzen 9 9950X | 16C/32T vs 12C/24T | | Lowest price per core | Ryzen 9 9950X | $16.81 vs $17.92 | | ECC memory | EPYC 4464P | 128 GB DDR5 ECC | | Lowest monthly price | EPYC 4464P | $215 vs $269 | | Lower power | EPYC 4464P | 65 W vs 170 W TDP | | Game servers, compile farms, CI | Ryzen 9 9950X | Clock speed and threads | | Databases, file servers, long-running services | EPYC 4464P | Error correction and logging | | Virtualization | Either | Threads (9950X) or ECC (4464P) | | A server in London | Ryzen 9 9950X | The only one of the two offered there | | A server in Miami or Tokyo | EPYC 4464P | The only one of the two offered there | | More than 128 GB of RAM | Neither | EPYC 7443P or EPYC 9354P | #### Compare and choose If your workload is clock-bound or thread-hungry and can tolerate the rare memory error, the [Ryzen 9 9950X](https://dedijet.com/servers/ryzen-9-9950x) gives you more compute for the money. If correctness over long uptimes matters more than peak speed, the [EPYC 4464P](https://dedijet.com/servers/epyc-4464p) is the safer home, and the less expensive one. You can line both up against the rest of the catalog on the [comparison page](https://dedijet.com/servers/compare). Billing is monthly with no setup fee, so the most reliable test is your own workload: run it for a few days and measure it with our [benchmark guide](https://dedijet.com/docs/benchmark). ### Game server hardware in 2026: clocks, cache and ping https://dedijet.com/blog/game-server-hardware-guide · 2026-10-14 A game server is an unusual workload. It needs one very fast core more than many slow ones, it cares about cache and memory latency more than raw throughput, and its users notice every millisecond between them and the machine. Here is what matters for common self-hosted games, how to size a server and which DediJet configuration fits which community. #### What limits a game server: the tick budget Most game servers run a loop that advances the world in fixed steps called ticks. Minecraft targets 20 ticks per second, so each tick has a 50 ms budget; a 64-tick CS2 server has 1000 ÷ 64 ≈ 15.6 ms. When a tick takes longer than its budget, the server falls behind: mobs freeze, hits register late, and players call it lag. The critical part of that loop usually runs on **one main thread**. Extra cores help with side work such as chunk generation, networking and saves, and they let you host more servers on one machine. But the speed of a single busy world depends mostly on single-thread performance: clock speed, the work the core does per clock and how quickly it reaches its data. That is why our Performance family is built on high-clock Ryzen CPUs. #### Game by game | Game | First bottleneck | Memory pressure | Watch out for | | --- | --- | --- | --- | | Minecraft Java (Paper, Purpur) | Single-thread speed | Moderate; high with big modpacks | View distance, chunk generation during play | | Minecraft (Folia) | Core count, when players spread out | Moderate to high | Many plugins are not compatible | | Rust | Single-thread speed and RAM | High, grows during a wipe | Player rush on wipe day | | Counter-Strike 2 | One fast core per busy instance | Low | Many match servers per machine | | ARK, Palworld, Valheim | Clock speed and RAM | High for ARK and Palworld, lower for Valheim | Large saves, memory growth over time | | Modded (Forge, NeoForge, Fabric) | Single-thread speed | High | Mod count drives memory and tick time | ##### Minecraft Java Edition The main tick loop is famously single-threaded, so a high-clock core matters most. Run [Paper](https://docs.papermc.io/) or its fork Purpur rather than the vanilla server: both stay close to vanilla gameplay while optimizing much of the work around the tick and loading chunks asynchronously. Folia, also from the Paper project, ticks separate regions of the world on separate threads, which helps large servers whose players spread out, at the cost of plugin compatibility. Give the JVM a fixed heap and leave memory for the operating system: ```bash java -Xms10G -Xmx10G -jar paper.jar --nogui ``` Paper’s documentation recommends a tuned set of garbage collector flags, known as Aikar’s flags, on top of this. The biggest levers on CPU per player are `view-distance` and `simulation-distance` in `server.properties`, and pre-generating the world with a plugin such as Chunky so chunks are not generated during play. Paper’s `/mspt` command shows how much of the 50 ms budget each tick uses. For modpacks, start from the pack author’s recommended memory. ##### Rust Rust servers combine a demanding main thread with large procedural maps and a growing number of player-built entities, so they want both clock speed and memory. Memory use tends to climb across a wipe cycle as bases grow, and the forced monthly wipe brings a rush of players on day one. Size for wipe day, not for the quiet week before it, and watch plugin load if you run a modding framework such as Oxide or Carbon. ##### Counter-Strike 2 A single CS2 match server is light: modest memory, small per-player traffic and a main thread that needs a fast core at 64 ticks per second. Communities usually run many of them. A practical rule of thumb is one physical core per busy match server, plus headroom for the operating system. ##### ARK, Palworld and Valheim Survival sandboxes keep large, persistent worlds in memory, and some grow their memory use the longer they run; a scheduled daily restart is the common fix. ARK clusters run one server process per map, so memory scales with the number of maps. Check whether a game ships a Linux server build before you choose an OS: Windows Server adds a license of $2.75 per physical core per month (minimum 8 cores). #### Why L3 cache matters, and the X3D question Game simulations jump around large data structures: entity lists, chunk data, pathfinding graphs. Whenever the data is not in cache, the core waits for main memory, which takes many times longer than a cache hit. A larger L3 cache keeps more of the world close to the cores, which is why some games respond well to AMD’s 3D V-Cache, an extra layer of L3 stacked on the chiplet. Our [Ryzen 9 7950X3D](https://dedijet.com/servers/ryzen-9-7950x3d) (16C/32T, 128 MB of L3) is sold out at launch. Popular configurations are restocked regularly, and you can ask to be notified. Meanwhile, two in-stock servers cover most needs: - [Ryzen 9 9950X](https://dedijet.com/servers/ryzen-9-9950x), its closest alternative: the same 16C/32T layout and 5.7 GHz boost, a newer Zen 5 core and 64 MB of L3, for $269/mo. - [Ryzen 7 9700X](https://dedijet.com/servers/ryzen-7-9700x): 8C/16T at 3.8–5.5 GHz with 32 MB of L3 on a single chiplet, so every core shares the same cache, for $149/mo. How much extra cache helps depends on the game and even the map, and we have not benchmarked it. Treat V-Cache as a possible bonus rather than a requirement: clock speed and a well-tuned server configuration are the safer bets. #### Storage: NVMe for world saves Game servers write their worlds to disk on a schedule: chunk saves in Minecraft, periodic saves in Rust and the survival games. If a save blocks the main thread, a slow disk turns directly into a lag spike, and big worlds make big saves. NVMe keeps those writes short. Every Performance server ships with two NVMe drives in software RAID 1 by default, so a single drive failure does not take the world with it. RAID is not a backup. Keep copies off the server, especially before a wipe or a major update; our backup space add-on supports SFTP, rsync, BorgBackup and restic, from 1 TB at $5/mo. #### Network: DDoS filtering and ping Game servers attract DDoS attacks, and most game traffic is UDP, the protocol that floods and amplification attacks abuse most. Minecraft Java Edition is the notable exception: it runs over TCP. Every DediJet server sits behind always-on, network-level mitigation that detects UDP, SYN and ACK floods and amplification attacks and filters them upstream. Whenever possible we filter instead of null-routing your IP, which would take the server offline for everyone. Attacks that look like real players, such as bot floods that complete the game’s login, have to be handled in the game: connection throttles, whitelists and anti-bot plugins. Close every port you do not use, and allow SSH before you enable the firewall. This example opens Minecraft Java’s default port; adapt it to your game: ```bash ufw allow 22/tcp ufw allow 25565/tcp ufw enable ``` For ping, place the server where most of your players are, using the [latency checker](https://dedijet.com/network/latency) and our guide to [choosing a server location](https://dedijet.com/blog/choosing-a-server-location). The Ryzen 5 7600 and Ryzen 7 9700X are offered in all 8 locations; the Ryzen 9 9950X in Frankfurt, Amsterdam, London, New York, Los Angeles and Singapore. #### Running several servers with Pterodactyl One dedicated server can host a whole community: a Minecraft network, a Rust server and a few CS2 matches side by side. [Pterodactyl](https://pterodactyl.io/) is a popular open-source panel for that: its Wings daemon runs each game server in its own Docker container. - Give each server a CPU limit, a memory limit and a disk quota, so one runaway world cannot starve the others. - Pin your busiest servers to their own cores with CPU pinning, and leave a core or two for the operating system and the panel. - Give friends and staff subuser access to one server’s console and files, not root on the machine. #### Which DediJet server for your community These are rules of thumb, not measurements: your mods, plugins, view distance and player habits matter more than any table. Prices are monthly, excluding VAT. | Community | Server | Specs | Why | | --- | --- | --- | --- | | A friends server or one small public world | [Ryzen 5 7600](https://dedijet.com/servers/ryzen-5-7600), $115/mo | 6C/12T, 3.8–5.1 GHz, 64 GB DDR5, 2 × 1 TB NVMe | Fast Zen 4 cores and plenty of RAM for a world or two | | A growing public community, modpacks or a few game servers | [Ryzen 7 9700X](https://dedijet.com/servers/ryzen-7-9700x), $149/mo | 8C/16T, 3.8–5.5 GHz, 64 GB DDR5, 2 × 1 TB NVMe | Higher Zen 5 clocks, one shared cache, room for a handful of instances | | A server network: many instances, big modpacks, several games | [Ryzen 9 9950X](https://dedijet.com/servers/ryzen-9-9950x), $269/mo | 16C/32T, 4.3–5.7 GHz, 128 GB DDR5, 2 × 2 TB NVMe | Highest boost clock among our in-stock servers, 16 cores to pin servers to, 128 GB RAM | If you are migrating, size from your current server’s peak memory use and tick times. If you are launching, leave room for the first-week rush. #### Next steps Browse the [Performance family](https://dedijet.com/servers/ryzen) for current stock, see our [game server solutions](https://dedijet.com/solutions/game-servers), and read the [DDoS protection guide](https://dedijet.com/docs/ddos-protection) before your first wipe day or launch. Then work through the [server hardening guide](https://dedijet.com/docs/server-hardening) before you share the address with players. ### How to choose a server location: latency, routes and the law https://dedijet.com/blog/choosing-a-server-location · 2026-10-14 Location is one of the few infrastructure decisions you cannot fix later with a faster CPU. The distance between your server and your users sets a floor on latency that no hardware removes, and the country your data sits in decides which rules apply to it. Here is how to reason about both, using the same formula as our latency estimates. #### The physics: about 200 km per millisecond Light travels through optical fiber at roughly two-thirds of its speed in a vacuum: about 200,000 km per second, or **200 km per millisecond**. A request and its answer cross the distance twice, so every 1,000 km between you and your users adds at least 10 ms of round-trip time (RTT). Real paths are longer than the map. Cables follow coastlines, railways and roads; traffic changes networks at specific interconnection points; and BGP chooses routes by business policy, not geography. Routers add a little delay at every hop. Our latency figures therefore multiply the great-circle distance by 1.3 for routing detours, divide by 200 km/ms, double the result for the round trip and add 2 ms for equipment: ```formula estimated RTT (ms) = 2 × (distance in km × 1.3 / 200) + 2 ``` | From → to | Great-circle distance | Fiber minimum (straight line) | Estimated RTT | | --- | --- | --- | --- | | Toronto → New York | ≈ 550 km | 5.5 ms | ≈ 9 ms | | Madrid → London | ≈ 1,260 km | 12.6 ms | ≈ 18 ms | | Mumbai → Singapore | ≈ 3,900 km | 39 ms | ≈ 53 ms | | New York → London | ≈ 5,570 km | 55.7 ms | ≈ 74 ms | | São Paulo → Miami | ≈ 6,570 km | 65.7 ms | ≈ 87 ms | | Sydney → Singapore | ≈ 6,310 km | 63.1 ms | ≈ 84 ms | | Sydney → Los Angeles | ≈ 12,080 km | 120.8 ms | ≈ 159 ms | | Frankfurt → Singapore | ≈ 10,260 km | 102.6 ms | ≈ 135 ms | These are estimates, not measurements: congestion or an indirect route can add much more, and the return path can differ from the outgoing one. #### Why round-trip time matters more than bandwidth Most interactions on the internet are a series of round trips, and each one waits for the speed of light: - Connection setup. A new HTTPS connection over TCP spends one round trip on the TCP handshake, one on a TLS 1.3 handshake and one on the request itself before the first byte of the response arrives. Three round trips at an estimated 20 ms take 60 ms; at 150 ms, they take 450 ms. - TCP slow start. A fresh connection starts by sending about 10 packets (roughly 14 KB) and roughly doubles that each round trip. Delivering 1 MB this way takes around seven round trips whatever your port speed: about 140 ms at 20 ms RTT, more than a second at 150 ms. - Pages and APIs. A page that loads HTML, then CSS, then fonts chains round trips. An API client that makes 20 sequential calls pays the RTT 20 times. - Databases. Every query costs at least one round trip. A request that runs 30 queries one after another spends 30 RTTs waiting: negligible inside one location, where a round trip typically takes well under a millisecond, and 2.4 seconds at 80 ms. - Games. RTT is the ping players see. The server’s tick rate decides how often the world updates; the ping decides how old each update is when it arrives. This is why a server close to its users often feels faster than a more powerful one far away. #### Start with your users, then your data 1. Find your users. Group your traffic or player base by country or metro area from your server logs, and weight each group by what matters to you: revenue, active players or contractual obligations. 2. Estimate the RTT from each group to each candidate location with the latency checker, and pick the location that keeps most of your weighted users within your target. 3. Put compute next to your data. If your database, object storage or the third-party APIs you call heavily live in one region, place your application servers there too. App-to-database chatter is usually more sensitive to latency than user-to-app traffic. 4. Split only when one location cannot serve everyone well. An audience spread across Europe, Asia and the Americas usually needs more than one location. #### Internet exchanges and subsea cables Two pieces of public infrastructure explain why some cities make better hubs than others. **Internet exchange points (IXPs)** are places where networks hand traffic to each other directly. Where many networks meet, paths between them tend to be short. Europe shows it clearly: Frankfurt is home to DE-CIX, Amsterdam to AMS-IX and London to LINX, three of the largest internet exchanges in the world. **Subsea cables** carry almost all traffic between continents, and they land in a handful of regions: - New York is a classic landing region for transatlantic cables to the UK and continental Europe. - Miami is a primary gateway between North America, the Caribbean and Latin America. - Los Angeles and the rest of the US West Coast anchor many trans-Pacific routes to Asia and Oceania. - Singapore links Southeast Asia with India, Australia, the Middle East and Europe. - Tokyo sits at the Asian end of many trans-Pacific cables and is Japan’s main interconnection hub, an estimated 17 ms from Seoul. DediJet’s network is multi-homed: each location connects to several transit providers over BGP, with redundant uplinks. Still, a well-connected city does not promise a short path to every user, which is why measuring matters. #### The law: where your data lives A server’s location also decides where your data physically sits, and regulations or contracts may care about that. Some facts to frame the conversation with your legal team: | DediJet locations | Jurisdiction | Main data protection framework | | --- | --- | --- | | Frankfurt, Amsterdam | European Union (Germany, Netherlands) | GDPR, plus national laws | | London | United Kingdom | UK GDPR and the Data Protection Act 2018 | | New York, Miami, Los Angeles | United States | Federal rules by sector, such as HIPAA for health data, and state laws, such as California’s CCPA | | Singapore | Singapore | Personal Data Protection Act (PDPA) | | Tokyo | Japan | Act on the Protection of Personal Information (APPI) | - Location is not the whole story. The GDPR applies to organizations established in the EU, and to those that offer goods or services to people in the EU or monitor their behavior, wherever the server sits. Hosting in Frankfurt does not remove obligations, and hosting in New York does not avoid them. - Transfers have rules. The GDPR, the UK GDPR, Singapore’s PDPA and Japan’s APPI all restrict sending personal data abroad unless the destination offers comparable protection or another safeguard applies, such as contractual clauses or consent. - Contracts can be stricter than the law. Public-sector, health and finance customers may require data to stay in a given country or region. > **Note:** This is general information, not legal advice. Ask a qualified lawyer how these rules apply to your data. #### When one location is not enough - Regional servers. Game communities and SaaS products with users on several continents often run one server per region, each close to its users, and route people with GeoDNS or per-region hostnames such as eu.example.com. - Asynchronous replication across regions. A synchronous commit waits at least one round trip for the replica: an estimated 135 ms between Frankfurt and Singapore. Keep synchronous replicas in the same location and replicate asynchronously to the distant one. - Encrypted links between locations. The free private VLAN, available on request, connects your servers within one location. Between locations, traffic crosses the public internet, so protect it with WireGuard or IPsec. - Backups somewhere else. Keep at least one copy of your backups outside the location of the primary server. - The same hardware everywhere. The Ryzen 5 7600 and Ryzen 7 9700X are offered in all 8 locations, which keeps a multi-region fleet uniform. Replication traffic between regions is not billed by the gigabyte either: every plan’s bandwidth is unmetered at its port speed. #### Estimate, then measure Start with the [latency checker](https://dedijet.com/network/latency) to shortlist locations from your users’ cities, then see what is in stock in each of our [8 locations](https://dedijet.com/locations). Once a server is running, measure the real path from where your users are: ```bash mtr -rwc 50 203.0.113.10 ping -c 20 203.0.113.10 ``` `mtr` combines traceroute and ping, so you can see where along the route delay or packet loss appears. Our [network testing guide](https://dedijet.com/docs/network-testing) explains how to read the output. With monthly billing and no lock-in, moving to a better location later is a migration, not a contract negotiation. ### Unmetered bandwidth explained: what a 1 Gbps port really gives you https://dedijet.com/blog/unmetered-bandwidth-explained · 2026-10-14 “Unmetered” is one of the most useful words in a server listing, and one of the least explained. It does not mean infinite traffic. It means the traffic on your port is not counted or billed by the gigabyte, so the only ceiling is the port speed itself. Here is what that ceiling works out to, how it compares with other billing models, and how to tell whether you need 1 Gbps or 10 Gbps. #### The math: from 1 Gbps to 324 TB Network speeds are quoted in bits, storage in bytes, and a byte is 8 bits: ```text 1 Gbps = 1,000,000,000 bit/s ÷ 8 = 125,000,000 byte/s = 125 MB/s = 0.125 GB/s ``` A 30-day month has 30 × 24 × 3,600 = 2,592,000 seconds. At 100% utilization: ```text 0.125 GB/s × 2,592,000 s = 324,000 GB ≈ 324 TB per direction ``` Ethernet is full duplex, so that is up to 324 TB out and another 324 TB in, at the same time. A 10 Gbps port moves ten times as much: about 3.24 PB per direction. These are decimal units; tools that count in binary units will show 324 TB as roughly 295 TiB. | Port speed | Per second | Per hour | Per day | Per 30 days | | --- | --- | --- | --- | --- | | 100 Mbit/s | 12.5 MB | 45 GB | 1.08 TB | 32.4 TB | | 1 Gbps | 125 MB | 450 GB | 10.8 TB | 324 TB | | 10 Gbps | 1.25 GB | 4.5 TB | 108 TB | 3.24 PB | #### What you actually get: goodput and distance A 1 Gbps link never delivers 125 MB/s of application data. Each full 1,500-byte packet spends 52 bytes on IP and TCP headers (with the usual TCP timestamps), and Ethernet adds 38 bytes of framing and inter-packet gap on the wire. That leaves 1,448 useful bytes out of every 1,538 sent, about 94%. A single clean TCP transfer on 1 GbE therefore tops out around **940 Mbit/s of goodput**, about 117 MB/s, which makes a saturated month closer to 305 TB of payload than 324 TB. On 10 GbE, the same overhead leaves about 9.4 Gbit/s. Distance matters too. TCP can only keep as much data in flight as its window allows, and filling a link takes a window as large as the bandwidth-delay product: ```text 1 Gbit/s × 0.150 s RTT = 150 Mbit ≈ 18.75 MB in flight ``` A single flow to a user 150 ms away will not fill your port if the socket buffers are smaller than that. Parallel transfers, larger buffers and a modern congestion control algorithm such as BBR help. Check your current settings: ```bash sysctl net.ipv4.tcp_congestion_control net.ipv4.tcp_rmem net.ipv4.tcp_wmem ``` Then measure rather than guess, with `iperf3` against a host you control. `-P 4` runs four parallel streams and `-R` tests the reverse direction: ```bash iperf3 -c 203.0.113.10 -P 4 -t 30 iperf3 -c 203.0.113.10 -P 4 -t 30 -R ``` Your port speed is the ceiling. What you reach toward a specific user also depends on the path: their provider, congestion on their side and the round-trip time between you. #### Three ways bandwidth gets billed ##### Per-GB egress Common on cloud platforms. Every gigabyte leaving your server is billed, inbound traffic is often free, and an allowance is sometimes included. The cost grows in a straight line with traffic, so a viral launch or a popular download shows up directly on the invoice. ##### 95th percentile Common for colocation and IP transit. The provider samples your port’s throughput every 5 minutes, sorts the month’s samples, discards the top 5% and bills the highest remaining value. A 30-day month has 8,640 five-minute samples, so the top 432, or 36 hours of peaks, are free; sustained peaks beyond that set the bill. ##### Unmetered port You pay for the port speed, and traffic is not counted. The bill is the same whether the port idles or runs flat out all month. The trade-off is a hard ceiling: you cannot burst beyond the port speed. | Model | You pay for | Bill predictability | Bursts | | --- | --- | --- | --- | | Per-GB egress | Every GB sent | Low: follows your traffic | No ceiling, every GB billed | | 95th percentile | Your sustained peak rate | Medium | About 36 hours of peaks per month are free | | Unmetered port | The port speed | High: flat monthly price | Up to the port speed | #### What unmetered means at DediJet - The full port, 24/7. Every plan includes unmetered bandwidth at its port speed, 1 Gbps or 10 Gbps, around the clock. Traffic on your port is not counted or billed by the gigabyte. - Within the Acceptable Use Policy. The bandwidth-specific rule is simple: you may not resell it as IP transit. Serving your own sites, streams, game servers, mirrors and backups is exactly what it is for. - 10 Gbps when you need it. Several servers, such as the EPYC 7443P and EPYC 9354P, include a 10 Gbps port. On 1 Gbps plans, a 10 Gbps upgrade costs $129/mo, also unmetered. - Attacks filtered upstream. Always-on, network-level DDoS mitigation filters floods before they reach your port, at no extra cost. The full rules are in our [Acceptable Use Policy](https://dedijet.com/legal/acceptable-use). #### Sizing examples Start from your monthly volume, then look at your peaks. Spread evenly over 30 days, common volumes need these average rates: | Monthly transfer | Average rate over 30 days | | --- | --- | | 10 TB | ≈ 31 Mbit/s | | 50 TB | ≈ 154 Mbit/s | | 100 TB | ≈ 309 Mbit/s | | 324 TB | 1 Gbit/s | | 1 PB | ≈ 3.09 Gbit/s | Averages hide peaks, so size the port for your busiest hour, not for the monthly total. ##### Video streaming A 1080p stream typically runs at 5–8 Mbit/s per viewer, depending on codec and encoder settings. With about 940 Mbit/s of usable throughput, 940 ÷ 8 ≈ 117 and 940 ÷ 5 = 188: a 1 Gbps port serves roughly 120–190 concurrent 1080p viewers at full load, and a 10 Gbps port about ten times that. Leave headroom for peaks. A CDN in front of your origin changes the math entirely. ##### Game servers Game traffic is small next to video: per-player rates range from kilobits to a few megabits per second, depending on the game, tick rate and view distance. A game server usually runs out of CPU long before a 1 Gbps port fills up. The exceptions are downloads, such as mods, maps and resource packs sent to joining players, and patch days. ##### Backups and restores Here the question is time, not volume. A 2 TB nightly backup that must finish within 6 hours needs 2,000 GB × 8 ÷ 21,600 s ≈ 741 Mbit/s sustained. That fits a 1 Gbps port, with little headroom. Incremental tools such as BorgBackup or restic shrink the nightly volume. A full restore of 10 TB at about 117 MB/s takes roughly 24 hours on 1 Gbps, and about 2.4 hours on 10 Gbps if your disks keep up. For copies off the server, our backup space add-on starts at 1 TB for $5/mo. #### When to upgrade to 10 Gbps - Your busiest hour regularly approaches the ~940 Mbit/s goodput ceiling. - You stream to more concurrent viewers than one 1 Gbps port carries. - Restores or migrations must finish in hours rather than a day. - You serve large files, such as game patches, ISO images or datasets, to many users at once. - You replicate large volumes between servers or locations. Before paying for 10 Gbps, check that the rest of the machine can keep up. NVMe drives can feed a 10 Gbps port; a handful of hard drives may not, and a single TCP flow over a long distance will not fill it without tuning. #### Choosing your port If your peak hour stays well below the ~940 Mbit/s goodput ceiling, a 1 Gbps unmetered port is all you need, and your bill will not move with your traffic. Streaming platforms, download mirrors and backup targets are where 10 Gbps earns its price. Compare port speeds across the catalog on the [comparison page](https://dedijet.com/servers/compare), find the upgrade on the [add-ons page](https://dedijet.com/servers/add-ons), and see how traffic is handled on our [network page](https://dedijet.com/network). For video workloads, our [streaming page](https://dedijet.com/solutions/streaming) goes further. ## Legal documents - [Terms of Service](https://dedijet.com/legal/terms): The contract between you and DediJet: ordering, payment, renewals, refunds, suspension and each side’s responsibilities. - [Service Level Agreement](https://dedijet.com/legal/sla): Our 99.9% network availability and 4-hour hardware replacement commitments, the service credits and how to claim them. - [Acceptable Use Policy](https://dedijet.com/legal/acceptable-use): What you may and may not do with our servers and network, and how we handle abuse reports. - [Privacy Policy](https://dedijet.com/legal/privacy): What personal data we collect (very little), why, how long we keep it, and your rights. - [Cookie Policy](https://dedijet.com/legal/cookies): One session cookie when you log in, no tracking cookies. What we store on your device, and when Cloudflare may set a security cookie.