Hetzner opens its eBPF cloud network stack to servers — with new firewall limits and a migration caveat

On October 20, 2026, Hetzner made hcnet, its in-house eBPF-based network stack, available as an opt-in public beta for individual Hetzner Cloud servers. The company says all its load balancers have already used hcnet since August 21. The server beta replaces the prior network stack's stateful firewall handling and increases connection-tracking capacity from 80,000 total shared between IPv4 and IPv6 to 120,000 per family, at no additional cost. Users select Try new network stack in each server's Networking tab and can revert. Both actions briefly interrupt connectivity and may drop existing connections when a firewall is active.

For builders operating high-connection-count services on low-cost cloud instances, firewall conntrack limits can cause connection failures even when CPU and bandwidth remain available. The new per-family limit is an operational change, not merely an internal rewrite. Its different behaviour when conntrack fills, DHCP metadata routing and packet accounting make beta adoption a change to test carefully, not a free performance upgrade to assume.

Hetzner documents 120,000 tracked connections for IPv4 and another 120,000 for IPv6, replacing an 80,000 combined limit. Under the old stack, a full conntrack table dropped packets for new connections. hcnet instead evaluates packets against firewall rules without tracking; flows needing established-connection state may still fail when replies cannot be matched. Tracking is only enabled on servers with an assigned Cloud Firewall.

hcnet compiles Cloud Firewall definitions into eBPF programs verified and JIT-compiled in the kernel and attached before each virtual NIC. Hetzner says the firewall remains stateful, but connection and fragment tracking details may differ. IPv4 fragments arriving before the first fragment may match fewer layer-4 rules; the company says it does not perform IPv6 fragment tracking.

Cloud users can switch or revert per server from the Networking tab, but both actions cause a brief interruption. Existing firewall-protected sessions may drop. DHCP metadata-server routes can remain missing or stale until the lease renews or the server reboots; Hetzner flags this as a known beta limitation. Test metadata-dependent bootstrapping and private-network connectivity before production rollout.

Hetzner says its in-house eBPF stack improves network architecture and permits new functions, and that load balancers were migrated earlier in 2026. No independently reproduced customer throughput or latency benchmark was identified for the new server beta. The documented connection-limit and failover semantics are more useful than unverified speed claims.