Your network
Prefixes, ASN, and endpoints stay under your control.
Remote Protection
Protected transit over GRE, IPIP, and BGP.
Clean traffic is delivered over GRE or IPIP tunnels with BGP on our anycast network. Announce your prefixes, bring your own IP or ASN, and keep attack volume off your upstream.
GREGeneric Routing Encapsulation
IPIPIP-in-IP tunnels
BGPPrefix announcement
BYOIPBring your own IPs
BYOASBring your own ASN
Traffic path
From your network to a filtered edge — then clean delivery back.
Remote Protection is a routing path, not a port ACL. Prefixes ride our anycast fabric; attack volume never reaches your tunnel endpoint.
GRE / IPIP tunnel
Encrypted handoff to the nearest NorthShield PoP.
Protected edge
3Tbps+ XDP scrub across London, Frankfurt, and Istanbul.
Clean delivery
Only legitimate traffic reaches your tunnel endpoint.
PoP termination
Three edges. One protected fabric.
Terminate GRE or IPIP at the PoP closest to your infrastructure. BGP announcements and scrub capacity are available at every location.
London
LD4Telehouse West
UK and Western Europe tunnel termination with regional scrub.
ldn01.edge-filter.northshield.network
Frankfurt
FR7Equinix FR7
Continental European handoff into the DE-CIX ecosystem.
fra01.edge-filter.northshield.network
Istanbul
IL4Datacasa
Türkiye and nearby markets on a local anycast edge.
ist01.edge-filter.northshield.network
Capabilities
What you get on the protected path.
Tunnel connectivity, prefix control, and edge filtering — engineered for operators who announce their own space.
GRE and IPIP tunnels
Connect your infrastructure over GRE or IPIP for protected transit and stable handoff to your endpoint.
BGP route announcement
Announce prefixes through our protected fabric so traffic stays inside the mitigation path.
BYOIP
Keep your own addresses on the protected edge without changing how customers reach your services.
BYOAS
Announce your ASN when routing design requires autonomous-system-level ownership.
Filtered before handoff
Attack volume is dropped at our edge — your tunnel and upstream stay clear during events.
Documented onboarding
Tunnel parameters, BGP policy, failover, and escalation paths are locked before cutover.
Bring your own
Keep your IPs and ASN. Change the path they take.
BYOIP and BYOAS let you present the same service identity while traffic is scrubbed on NorthShield before it reaches you.
BYOIP
Bring your own IP addresses
Announce your prefixes on our protected edge without renumbering services or changing how players, customers, or partners reach you.
BYOAS
Bring your own ASN
Keep ASN-level routing ownership when your design requires it — with sessions and communities documented before production cutover.
Onboarding
Four steps from design to live prefixes.
Share your ranges and tunnel preference. We engineer the path, validate announcements, and cut over with clear escalation.
01
Share prefixes, ASN requirements, and preferred tunnel type.
02
Establish GRE or IPIP to the nearest PoP.
03
Announce IP space with BGP on the protected fabric.
04
Receive clean traffic with NOC-backed escalation paths.
- GRE and IPIP tunnel provisioning
- BGP session and prefix policy
- BYOIP onboarding and validation
- BYOAS routing review
- Protected path engineering
- Failover and handoff planning
- Attack event summaries
- Routing change documentation
Announce your prefixes through a protected edge.
Share your IP ranges, ASN requirements, tunnel preferences, and traffic profile. We will design the right GRE, IPIP, and BGP protection path.