What changed, where and when. New peers, outages, upgrades, and the occasional longer note about why things are the way they are.
The Taipei node is offline. It will come back only once we find a suitable hosting provider there, and we cannot give a date yet. Sessions terminating in TPE stay configured on our side; if you need a session sooner, peer with us at another site through peering.natlan.io.
The Frankfurt node is offline. We are moving it to a new hosting provider and expect it back on 25 November 2026. Sessions terminating in FRA stay configured on our side and will come back up with the node; nothing to do on yours.
The TYO1 machine in Tokyo is offline. We are moving it to a new hosting provider and expect it back on 20 November 2026. Its configuration is kept as is: sessions terminating in TYO1 will come back up with the machine, with no action needed on your side. TYO2 keeps the Tokyo site up meanwhile.
The Los Angeles node has been retired. Every peering session it carried was moved to a new node in San Jose, which keeps the same backbone links to Hong Kong and Tokyo and takes the LAX slot on the map. Peers who dialled into LAX: your session now terminates in SJC. Check its endpoint and node key on peering.natlan.io and update your side if it has not come back up. The site page is at /nodes/sjc.
The front page is now a schematic of the real network — sites, backbone and peering, refreshed live from the control plane — with a journal, a looking glass and a page per site. The previous homepage stays up at /classic/.
Prove the ASN is yours at auth.natlan.io — email, PGP or SSH, whichever your maintainer carries — pick a node, and the WireGuard tunnel and BGP session come back in the same response. The portal also shows your session as we see it, and lets you tear it down yourself.
Routes that fail ROA validation are now rejected at import (routes with no ROA are still accepted), and every eBGP session carries an import limit of 8,500 prefixes. The control plane also records what each peer sent before filtering, so a rejected route can be traced to where it came from.
Configuration now lives in one place as desired state, and an agent on every node applies it and reports back. iBGP and OSPF between the sites came under the same control, and every change lands in an audit log. No more SSH in the loop.
Hand-written configs gave way to BIRD templates and deploy scripts. Better — until the question became “which node runs which version?”
NATLAN starts as a couple of machines joined by wg-quick, configured by hand over SSH, with the keys kept in a notes app. Fine for two nodes; the third one broke the system.