Connect and networking

Connect with SSH

ssh root@ADDRESS
ssh -p 1020 root@203.0.113.7   # an instance with a Shared IP

ghost instance create --wait ends with a line on stderr that says where the new instance is: instance ID (HOSTNAME) is running at ADDRESS. For an instance with a Shared IP it ends with the SSH command, such as ssh -p 1020 root@203.0.113.7. The instance’s Overview shows the address, and for a Shared IP the SSH command for the port that goes to the instance’s port 22.

The keys are installed for root, so log in as root: the image’s usual default user, such as ubuntu or debian, gets no keys and is not set up.
SSH password login is off.
Add other users with a --cloud-init-file.

Kinds of public address

Every instance reaches the internet one of these ways. The offering lists which it has, with their prices; the IP filter on Capacity and --ip dedicated|shared on ghost catalog offerings choose between the two kinds of address.

Host	Address	What the instance gets	Choose it with
Cloud host	Dedicated IP	A public IPv4 address of its own from the host’s provider	No `--gateway-tier` (the default)
Cloud host	Shared IP	A range of the host’s address’s ports	`--gateway-tier shared_ip`
Home host	Dedicated IP on a shared gateway	Shared bandwidth: its own address on a shared gateway	`--gateway-tier shared_bandwidth`
Home host	Dedicated IP on a gateway of its own	High bandwidth: the address of its own gateway	`--gateway-tier high_bandwidth`
Home host	Shared IP	A range of a shared gateway’s address’s ports	`--gateway-tier shared_ip`

What each costs is on Pricing and billing.

Home instances: gateway tiers

A home instance has a public IPv4 address on a hosted gateway, and home-mode offerings require a tier: shared_bandwidth, high_bandwidth or shared_ip; the spellings with a hyphen work too. On the website, a home instance starts with the shared bandwidth tier, at its default gateway location where it has one.

Tier	Gateway	What reaches the instance
`shared_bandwidth`	Shares a gateway in one of a few central regions with other home instances	Every protocol and port of its address
`high_bandwidth`	A gateway of its own in the region nearest to the provider’s server, with a lower traffic rate; its address is the gateway’s	Every protocol and port of the address but port 27492, which the gateway keeps
`shared_ip`	Shares a shared gateway’s address with other instances	A range of the address’s ports; see Shared IP and ports

Either way the instance’s traffic crosses the provider’s home connection, so it is never faster than that. Compare the offering’s network readings before paying for high_bandwidth.

When there is no room

An offering lists only the tiers there is room for now.
It names high_bandwidth in full_gateway_tiers while the platform can set up no gateway of its own for another instance; the website shows high bandwidth as At capacity then.
When the gateways have no room for the instance, the creation is refused with capacity_unavailable, and nothing is charged. Its message says what is short: no public address free at the location, with when one is free again and whether high_bandwidth could be placed, or no gateway that can be set up for high_bandwidth or has room for another shared_bandwidth instance.

The offering lists the locations with their distance, their gateway prices and a warning where traffic crosses a congested or long-haul path; the rent form shows each location’s distance and gateway prices. The instance shows its gateway’s location. Move it to another listed location on its Settings tab.

ghost catalog offering <OFFERING_ID>
ghost instance create \
  --offering <OFFERING_ID> \
  --image debian-13 \
  --gateway-tier shared_bandwidth \
  --gateway-location us-charlotte \
  --ssh-key-file "$HOME/.ssh/id_ed25519.pub" \
  --wait
ghost instance gateway-location <INSTANCE_UUID> us-charlotte --yes --wait

The offering lists the locations as gateway_locations, closest to the host first, each with its distance, its gateway’s monthly base charge and traffic price, and whether traffic between the host and it crosses a bottleneck. One is preselected and taken unless you choose another with --gateway-location. instance get shows the instance’s gateway_location.

A shared bandwidth or Shared IP home instance is reached through a shared gateway at one of a few locations.

The default is the closest to its host with room that crosses no bottleneck (a congested or long-haul path), unless you chose another when you created it.
A location across a bottleneck is yours to choose knowingly.
When no listed location without a bottleneck has room, the creation is refused and names the closest location with room, which you may choose.
When you move the instance later, it gets a new public address there, is unreachable for the seconds its move takes, and pays that location’s gateway prices from the move on, as the offering lists them.

When a gateway is taken out of service

Gigahost never moves an instance with a Dedicated IP to another address. When its gateway is taken out of service, a notice asks you to move the instance to another location at a time of your choosing and links to its Settings tab, and it keeps running where it is until you do.

Shared IP and ports

Website
ghost

The instance’s Overview shows the address with the SSH command for the port that goes to the instance’s port 22, every public port with the instance’s port it goes to, and the ports its outgoing connections leave from. Change where a port goes on its Settings tab, under Ports.

ghost instance ports <INSTANCE_UUID>
ghost instance ports <INSTANCE_UUID> set 1021=80 1022=443

instance get shows port_forwards, each public port with the instance’s port it goes to, and outgoing_ports; instance ports shows them with the SSH command, and instance ports ... set sends public ports elsewhere, the others staying.

An instance with a Shared IP has no address of its own. It shares a public address with other instances and gets a range of its ports, TCP and UDP.

It gets as many ports as the offering’s shared_ip_ports (20).
Each forwards to a port of the instance: by default the first to port 22, for SSH, and every other to the same number on the instance.
The instance’s outgoing connections leave from a range of source ports of its own, so other instances on the address cannot use them up.
The gateway, or a cloud host’s router, follows a change within a minute and drops the connections of a port whose target changed.

Home instances with a Shared IP

A shared_ip home instance shares its gateway’s public address and is placed at a gateway location as a shared bandwidth instance is, --gateway-location included.
When it moves to another gateway, by your choice or because its gateway is taken out of service, it gets that gateway’s address and other ports, each going where the one in its place went. A notice tells you the new address and ports when it moves: update your DNS records and the ports you connect to.

Cloud instances with a Shared IP

A cloud offering whose hosts share their own address lists Shared IP beside Dedicated IP when you rent it (in the API, a shared_ip price among its network_prices beside the price without a tier).
An offering whose hosts have no address left may list only the Shared IP.
--gateway-tier shared_ip on such an offering gives the instance a slice of its host’s address instead of an address of its own; no --gateway-location, since its address is its host’s.
It keeps its address and ports for as long as it exists.

Idle connections

On an instance with a Shared IP, home or cloud, the gateway forgets an outgoing TCP connection that has been idle for about 2 hours, and gives its source port back: the connection’s next packet then fails. TCP keepalive, or anything else the connection sends within the 2 hours, keeps it.

Bandwidth limits

Every instance’s bandwidth is limited, each direction alike, by how it reaches the internet and its size:

How it reaches the internet	Limit
A Shared IP, home or cloud	20 Mbit/s
Home, Dedicated IP on a shared gateway (shared bandwidth)	100 Mbit/s
Home, a gateway of its own (high bandwidth)	No limit
Cloud, Dedicated IP, up to 15 vCPUs	50 Mbit/s per vCPU: 200 Mbit/s with 4 vCPUs, 750 Mbit/s with 15
Cloud, Dedicated IP, 16 vCPUs or more	No limit

The limit is applied on the instance’s gateway for a home instance and on its host for a cloud instance.
Capacity, the offering page and the rent form show each choice’s limit beside its traffic price, and the instance’s Overview shows its own as Bandwidth. The quote ghost instance create prints names the limit of the chosen network, and ghost instance get shows an instance’s as bandwidth.
An upgrade gives the instance its new size’s limit, and a change of these limits by Gigahost reaches a running instance without a restart.

Mail

An instance cannot send mail straight to other mail servers: its outgoing TCP connections to port 25 and to port 465 (SMTPS) are dropped, on every host. That way an instance that sends spam cannot put the addresses of its host or of Gigahost’s gateways on blocklists.

Send mail through a mail service instead, with a login on port 587 (submission) or through its HTTPS API, which every instance may use.
Receiving mail works on every port.
The API and ghost instance get show outgoing_mail_allowed on each instance, false unless support lifted the block for your account.
To have it lifted, open a support ticket in the networking category saying what the mail is for. Once lifted, every instance of the account sends freely within a minute, running ones too.

MTU of a home instance

A home instance’s network interface has an MTU of 1420, that of the WireGuard tunnel to its gateway, and the MSS of TCP connections through the tunnel is clamped to 1380, so ordinary traffic needs nothing of you.

A tunnel of your own inside the instance, such as a WireGuard or other VPN server, carries its packets inside that one and needs a smaller MTU: 1340, the tunnel’s 1420 less WireGuard’s 80 bytes, works for WireGuard. With the default of 1420 its connections stall.

Gateway traffic of a home instance

Website
ghost

The instance’s Overview shows under Gateway traffic what its gateway counted over the last hour and the last day in each direction, incoming and outgoing apart.

ghost instance gateway-traffic <INSTANCE_UUID>

The API serves the same figures at GET /v1/instances/{instance_id}/gateway-traffic.

A home instance’s gateway counts for the instance, in each direction:

what reached the gateway for the instance’s address;
what it passed on; outbound, this counts only the instance’s own packets, not the tunnel’s;
what its firewall dropped;
while the gateway carries no other instance, also the packets its tunnel toward the instance discarded while the tunnel was down.

These figures are for information only; billing never uses them. What the gateway bills is under Traffic.

Rotate a home instance’s gateway keys

ghost instance rotate-gateway-keys <INSTANCE_UUID> --wait

Replace a home instance’s WireGuard key on its host if it may be lost or compromised.

On a running instance, the tunnel to the gateway is down from the moment the host installs the new key until the gateway applies it, a few seconds, so connections through it may stall or drop. The job finishes once the gateway reports a handshake with the new key.
On a stopped instance, the host keeps the new key for the instance’s next start, and the job finishes without waiting for a handshake.

An address after deletion

A cloud instance’s public IPv4 address rests for an hour after the instance is deleted, so that what is still meant for the instance, such as the traffic your DNS records send there, reaches no other customer meanwhile; after that another instance may get it.

Update your DNS records within the hour.
Remove the address from your SSH known_hosts before you reach a new instance at an address you used before.
The address of an instance whose creation failed was never the instance’s and is free at once.
A shared_bandwidth home instance’s address rests for an hour too, and a high_bandwidth home instance’s address goes with its gateway.