How the Coritan network works

Traffic reaches your services over the Coritan network in one of two ways, depending on the address it is sent to. Traffic to a floating IP enters at one of our points of presence, where DDoS Shield filters it. Traffic to the shared address of the machine a server runs on goes to that machine directly. The public Network page describes the network for buyers; this page explains what it means for the services you run.

Point of presence (PoP)

A Coritan site where our routers connect to the internet. A PoP announces our address ranges, filters the traffic it receives and passes the rest on to the machine your service runs on.

Anycast

Announcing the same address range from more than one PoP. The internet delivers each packet to the PoP that its routing finds nearest, so traffic enters our network close to where it was sent from.

Floating IP

A public address that belongs to your account and that you attach to an instance or a server (Floating IPs). The IPv4 address that comes with a Cloud Compute instance is a floating IP too; its IPv6 /64 is not, because it stays with the instance.

Shared address

The address of the machine a server on App Deployment runs on. Every server on the machine uses it, each on ports of its own (Manage server ports).

Coritan announces the ranges its floating IPs come from at its points of presence. Traffic to one of them takes this path:

• It enters our network at a PoP that announces the address, usually the one nearest the sender.
• DDoS Shield filters it there, with the protection settings of that floating IP (Change a floating IP's DDoS protection).
• What passes goes on to the machine that runs the instance or server the address is attached to.

Traffic your instance or server sends from a floating IP, replies included, leaves our network through the Coritan router nearest its machine, one in the same location when there is one. If the machine cannot reach a router, that traffic stops until it can, and it never leaves by another route.

When you move a floating IP to another instance or server, its traffic follows it to the new machine (Attach and detach a floating IP).

A server with no floating IP is reached on the shared address of its machine, at its own port. That traffic goes to the machine directly and does not pass through a PoP, so DDoS Shield does not filter it.

To put a server's traffic behind DDoS Shield, attach a floating IP to it. With a floating IP, the server can also take a game's default port, so players join with the address alone (Manage server ports).

Coritan's nameservers, ns1.coritan.com to ns8.coritan.com, are anycast addresses too. A query for a zone we host enters at the nearest PoP and is answered in that PoP's region (How DNS hosting works). A load balancer that places clients by Answering location uses that PoP as the client's location (How DNS load balancing works).

In a location that offers IPv6, a Cloud Compute instance gets an IPv6 /64 at no charge, and you can order a floating IPv6 address and attach it to an instance there (Add IPv6 to an instance, Floating IPs). IPv4 subnets and the addresses of App Deployment servers are IPv4 only. In a location without IPv6, every address you order is IPv4. For IPv6 with a product you buy through sales, ask the sales team (Bare metal, colocation and IP transit).

Coritan's web edge serves Coritan's own sites, such as www.coritan.com, and the names you proxy through Coritan DNS. It answers over IPv6 once its machines have IPv6 addresses. From then on our nameservers give those names AAAA answers beside their A answers, so visitors on IPv6 networks reach them over IPv6 (How DNS hosting works). Until then, those names have A answers only, and visitors on IPv6 networks reach them over IPv4.

Our nameservers answer over IPv6 in the same way once they have IPv6 addresses: ns1.coritan.com to ns8.coritan.com then have AAAA records beside their A records, and a resolver on an IPv6 network can ask them directly. Until then, resolvers reach them over IPv4.

Other parts of Coritan take IPv6 addresses that you host elsewhere:

• A DNS zone can hold AAAA records (DNS record types).
• A load balancer can send clients to IPv6 origins (Create an origin pool).
• An API key's allow-list can name IPv6 addresses and ranges (Manage API keys).

Each Cloud Compute plan includes a monthly traffic allowance, and the order page shows it with the plan (How instance traffic is counted).

The dashboard has no page for BGP sessions, private peering, cross-connects or announcing your own address space. The Network page offers them under Custom connectivity, so ask the sales team (Bare metal, colocation and IP transit).

• DDoS Shield filters traffic to floating IPs. Traffic to a server's shared address does not pass through it.
• IPv6 reaches Cloud Compute instances and floating IPv6 addresses only in locations that offer it. App Deployment servers and IPv4 subnets are IPv4 only. The web edge, which serves Coritan's own sites and your proxied names, and the nameservers take traffic over IPv6 once they have IPv6 addresses.
• A floating IP comes from a pool in one region; choose one in the region where its instance or server runs (IP pools and regions).