Routing expectations

Scrubbing only helps if attackers cannot reach the same service around Templass.

The intended path

User / attacker
    -> prefix on AS208743
    -> Templass scrubbing (Equinix FR5)
    -> GRE or FR5 cross-connect
    -> your origin

Return traffic should go back out a path you and Templass agreed. Do not leave the origin answering <PROTECTED_PREFIX> on a second public interface.

Addresses

Address	Role
<PROTECTED_PREFIX>	What clients connect to. Issued or accepted by Templass.
<YOUR_PUBLIC_GRE_IP>	GRE outer address only. Not the game/web listener.
Origin management IP	How you SSH or use the provider panel. Keep it off the protected prefix when you can.

Templass does not publish a global list of customer prefixes in these docs.

GRE-specific

• Templass routes (or switches) clean packets into the tunnel.
• You route <PROTECTED_PREFIX> (and replies) so they traverse gre-templass, not your WAN default.
• Asymmetric routing (in via GRE, out via your ISP) will break stateful firewalls and some protocols. Prefer symmetric forwarding unless Templass designed something else for you.

Details: GRE tunnel setup.

Cross-connect-specific

• The FR5 circuit is the clean next hop.
• You still must not announce or host <PROTECTED_PREFIX> on another ISP uplink "as backup" without a plan. That backup becomes the attack path.

Details: Cross-connect / Equinix FR5.

DNS and application cutover

Change DNS A/AAAA records, game server lists, or reverse-proxy upstreams after the tunnel or circuit passes a probe. A low TTL before cutover is useful. Templass does not host your DNS unless a Custom statement says so.

IPv6

Only enable IPv6 for a protected service when Templass has issued an IPv6 prefix or explicit dual-stack notes. Do not assume v6 is on because v4 is.

BGP

BGP to AS208743 is not a default on Essential, Standard, or Premium. If you need sessions, communities, or BYOIP, that is scoped by [email protected] and written into your provisioning notes.

When routing looks "wrong" in traceroute

Traceroute to a protected address should enter AS208743 and should not reveal your origin's transit ASN as the last hop. If it does, the prefix is leaking or DNS still points at the origin. Fix that before you advertise the service.