Mumbai
India, and its neighbours Nepal, Bangladesh, Sri Lanka and Bhutan. Mumbai is the only one of the three regions on the subcontinent.
Your own VPN and remote desktop, in three regions.
A VPN for you, your team or your customers, and Windows Server desktops over Remote Desktop, in three regions. Every server has its own kernel and Full root / Administrator access, a 1 Gbit/s port, and Prism in front of it.
Put it near the people who use it. Every packet goes through the server, so the distance to it counts.
Singapore
Malaysia, Indonesia, Thailand, Vietnam and the Philippines, all a short hop across the region. It is also the nearest of the three to Australia and East Asia.
Limburg
Germany sits near the middle of Europe, so the rest of the continent, the United Kingdom and Scandinavia are all within Europe itself. It is the only one of the three regions west of the Middle East.
A VPN moves bytes, so traffic sets the size. Each plan's monthly allowance, per day and as an average rate.
| Plan | Traffic a month | About a day | Average rate, all month |
|---|---|---|---|
| Nano | 1 TB | 33.3 GB | |
| Mini | 2 TB | 66.7 GB | |
| Starter | 4 TB | 133 GB | |
| Growth | 6 TB | 200 GB | |
| Pro | 8 TB | 267 GB | |
| Elite | 10 TB | 333 GB | |
| Max | 14 TB | 467 GB | |
| Titan | 18 TB | 600 GB |
The allowance spread evenly over a 30-day month. Real use comes in peaks: any one moment can run at the full 1 Gbit/s port, and what counts is the total by the end of the month. A VPN carries everything its users browse, stream and download, so this, more than the processor, is the figure to size it by.
One port for the tunnel, checked on the way in. Everything else can stay closed.
A rule for the tunnel
Add a UDP rule for your VPN's port with VPN as the service: WireGuard is usually set up on 51820, OpenVPN on 1194. Then set Default for unlisted ports to Deny all. Choosing between them? WireGuard vs OpenVPN compares the two.
Protocol validation, switched on by you
Prism has a validator for common tunnel protocols. It is off on a rule you add by hand, because it drops anything that does not speak the protocol: turn it on when you can test a connection. Protocol validation
Remote Desktop, checked too
A Windows server's rule for TCP 3389 can run the Remote Desktop validator, the same way.
- per protocolVPNProtocol check
- tcp/3389Remote DesktopProtocol check
- tcp/22SSHRate limited
- all otherUnlisted portsDeny all
A VPN for people you know. What the Acceptable Use Policy allows, and what it does not.
Allowed
- A VPN for yourself, your organisation or your customers, restricted to the people you intend to serve
- A reverse proxy or load balancer in front of your own services
- A proxy for your own game server
- Security testing of your own servers, telling us first about anything high volume
Not allowed
- An open proxy, open mail relay or open recursive DNS resolver
- An anonymising service that relays other people's traffic without identifying them, such as a Tor exit node
- BitTorrent clients, trackers or seedboxes
- Sending traffic with forged source addresses
If you provide a VPN to others, you are responsible for your own obligations to them and under the law, including any duty under the CERT-In Directions to keep logs and records about your own users. See the Terms of Service.
A Windows desktop, wherever you are. Windows Server 2019, 2022 and 2025, over Remote Desktop.
Pick the image, connect with Remote Desktop
Choose Windows Server 2019 or 2022 at checkout, or 2025 by reinstalling from the panel. You get Administrator access and connect with any Remote Desktop client. Windows VPS sizes a plan for each Windows job.
Lock it down first
A desktop reachable from the internet is a target. The help center covers the first hour on a new Windows server.
VPN and remote desktop questions
Can I run WireGuard or OpenVPN?
Yes. Every server is a KVM virtual machine with its own kernel and Full root / Administrator access, so you install the VPN software you want; WireGuard has been part of the Linux kernel since version 5.6. Only TCP, UDP and ICMP reach the server through the filter, so a tunnel has to run over TCP or UDP: IPsec needs UDP encapsulation (NAT traversal) to get through.
Can I run a VPN for my customers?
Yes, provided it is restricted to the people you intend to serve. An open proxy, or an anonymising service that relays other people's traffic without identifying them, is not allowed. If you provide a VPN to others, you are responsible for your own obligations to them and under the law, including any duty under the CERT-In Directions to keep logs and records about your own users.
Which plan does a VPN need?
Very little processor for a handful of users: Nano is where most start. The monthly traffic allowance is the figure to watch, from 1 TB on Nano to 18 TB on Titan.
What happens if I use more than my traffic allowance?
We may limit the server's port speed until the next billing period begins, or suspend it if the excess traffic harms our network or other customers, as the Terms of Service set out. Moving to a larger plan raises the allowance straight away.
Which Windows versions can I install?
Windows Server 2019, 2022 and 2025 Standard: 2019 or 2022 at checkout, or 2025 by reinstalling from the panel. Remote Desktop listens on TCP 3389, and Prism has a validator for it.
Is the VPN port protected?
Yes, like every port. Traffic passes 17 Tbps of upstream mitigation capacity, then Prism on the host, which also has a validator for common tunnel protocols. Protocol validation is off on a rule you add by hand; switch it on once you can test a connection.
Which region should I choose?
The one nearest the people using it. Every region has the same hardware, 1 Gbit/s port, protection and prices.
Start with Nano. Your VPN, in a region you choose.
1 vCPU, 2 GB and 1 TB of traffic a month, with 17 Tbps upstream mitigation and Prism in front of it.