GoKawiilHetzner details how its Cloud network stack handles firewalls, DHCP and VXLAN
Hetzner published a technical overview explaining how its VM hosts manage cloud server networking, including public internet access, Private Networks built on VXLAN with unique network identifiers, and a stateful Cloud Firewall enforced directly on the host. It also described the use of DHCP for assigning IPv4 addresses and cloud-init for configuring IPv6, attaching volumes, and pulling metadata from an internal server at 169.254.169.254.
GoKawiil's interpretation of the reporting above, not reported fact.
The breakdown suggests Hetzner designs its network controls to run as close to the server as possible, which could reduce the overhead and complexity that centralized firewalling and connection tracking would otherwise require. For customers and developers, understanding this architecture may clarify how isolation, security, and automation work across Hetzner's cloud infrastructure.
- Hetzner's cloud firewalls operate directly on VM hosts rather than through centralized overlay hardware.
- Private Networks use VXLAN with per-network identifiers to isolate customer traffic.
- Cloud-init and an internal metadata server automate IPv6, DHCP, and volume configuration for cloud servers.
Source: hetzner.com, 2026-10-09
Published there as: “The Hetzner Cloud network stack – history and technical overview”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.