Across Europe.
One encrypted
backbone.
A compact European network, run properly. Anycast, dual-stack, RPKI-validating - the backbone our own services run on, and open to selective peering.
How it works
A private, encrypted backbone - anycast to the nearest city.
Six points of presence across Europe run on one encrypted mesh, each announcing the same anycast prefixes. Packets take the shortest path in, and the network routes around a site that goes quiet - no rented backbone, no shortcuts, just clean routing we run ourselves.
Anycast, everywhere
The same prefixes are announced from every core city, so traffic lands at the nearest one - and reroutes to the next if a site drops. No single POP is a single point of failure.
A private encrypted backbone
Six European cities linked by our own encrypted mesh - real tunnels we run end to end, not a rented MPLS cloud.
Clean, dual-stack routing
RPKI-validating on every session, IRR objects published and kept current, IPv4 and IPv6 as first-class citizens. We keep our table tidy.
Built to a standard
The network our own services run on.
Karmuz is the backbone behind the things we build, so it's held to the standard we'd demand of any provider. Every session is RPKI-validated and IRR-filtered, every prefix carries a sane max-prefix, and nothing is oversubscribed. When something needs attention it reaches a person who can act on it, not a ticket queue. Small footprint, run seriously.
Routing hygiene
Clean routing is the whole point.
Every route Karmuz Network accepts is checked before it reaches the table. We run RPKI Route Origin Validation and drop RPKI-invalid announcements outright, so a hijacked or fat-fingered prefix never rides AS209990. On top of that, each peer and transit session is filtered against IRR data with a sensible max-prefix limit, and bogons, martians and unallocated space are rejected at the edge - on import and on export - so nothing leaks in either direction.
What we originate is held to the same bar. Our prefixes are registered in the IRR and covered by RPKI ROAs, routes carry BGP communities for predictable traffic engineering, and IPv4 and IPv6 are treated as equals - dual-stack everywhere, never an afterthought. The payoff is a network that behaves the way you expect: shortest-path anycast in, graceful failover when a site goes quiet, and no surprises for the networks we peer with.
- RPKI ROV - invalids dropped
- IRR-filtered prefix lists
- Per-session max-prefix limits
- Bogon + martian filtering, both ways
- Signed ROAs on every prefix
- MANRS-aligned operations
Peering
Open, selective, and easy to reach.
Karmuz Network keeps an open but selective peering policy and is present at several European internet exchanges, with room for private interconnects where the traffic justifies it. Opening a session is deliberately simple: find AS209990 on PeeringDB, match a few sensible requirements - a registered ASN, RPKI-signed and IRR-registered prefixes, and a shared exchange or a cross-connect - and send a request. We keep our PeeringDB record current, reply as people rather than a ticket queue, and turn sessions up quickly. Because the same backbone carries our own services, we care about the quality of every adjacency, not the raw count - a peer that improves latency or resilience for real users is always worth the session.
Live status
6 / 6 sites up · ~105 sessions · RPKI valid
Looking glass
Run diagnostics from our edge.
DNS, WHOIS, TLS, ping and traceroute - one query, every angle.
We choose our peers.
Think we'd be a good fit? The policy has everything you need to open a session.
