How We Run Our Network: Three Real Costs of Consumer Access Lines

What the network actually is

We operate several independent Spectrum / Charter access lines in Wyoming, each terminating on our own hardware in a suite we hold. Each line carries its own statically configured address block, and each customer instance is assigned one address from it, exclusively.

There is no address block we bought and announced ourselves; the addresses come from the carrier's access network, ASN AS33588. Instances run as containers or full virtual machines on our hosts, with root over SSH. A separate line, not used for customer traffic, carries out-of-band management.

That is the whole architecture. What follows is what it costs to run, which is the part providers usually leave out.

Cost one: upstream is the real ceiling

Consumer broadband is asymmetric, and the number a customer experiences is the upstream one. Measured on our own lines on 2026-08-08:

Content is pulled into the host over the line's download capacity, then has to go back out over its upload capacity to reach you. So your ceiling is the upload figure — and it is shared by every customer on that line. A block of five addresses fully subscribed works out to roughly 4 Mbps each at full load.

We ruled out our own software as the cause: 20.9 Mbps through our internal WireGuard link against 21.8 Mbps direct, a 4% difference that is exactly encapsulation overhead. The limit is the line tier, not the stack.

The practical consequence is that 'real ISP line' and 'unmetered high bandwidth' cannot both be true of the same product. We sell the first and say so about the second.

Cost two: recovery when nobody is on site

The value of a real access line is that it terminates in an ordinary building. The price is that the building has none of a datacenter's guarantees — no redundant utility feed, no staff, no spares on a shelf.

There are only two ways to pay for that. Send a person each time, which scales linearly with customers and eventually eats the margin. Or invest once, up front: a management line independent of service traffic, an out-of-band KVM wired to the host, a switched outlet on the host's power, power-on-after-loss in firmware, and a UPS.

We took the second. It has failed twice, and both failures are more useful to publish than the setup itself.

• 2026-07-26: our control-plane tunnel egressed from behind the router it was meant to rescue. The router went down and the box became unreachable — a deadlock. The rule we took from it: a rescue path must never depend on the device being rescued. The control plane now defaults to the management line.
• 2026-08-07: the carrier converted our lines from DHCP to static configuration. Our equipment was still configured for DHCP and dropped off one by one as leases expired — including the management line. Our assumed failure mode was 'the out-of-band router hangs, power-cycle it'; the actual one was 'it is alive, but its uplink has no valid configuration', and the switched outlet was useless against that. Recovery came through the one line that had stayed on DHCP: power-cycling its modem gave the management router a valid address again, and the rest was done remotely — at the cost of a full day offline.

The lesson we wrote into the post-mortem: design the fallback against the failure mode you actually get, not the one you imagined. Since then, every line gets its own probe in our monitoring, so that 'alive but without a valid configuration' is a state we can actually see rather than infer. What we claim is that most failures are recovered remotely in minutes — not that a site visit never happens, which nobody can deliver.

Cost three: addresses are consumables

An address can be flagged by some third-party service, and once it is, it is degraded for that service. You cannot prevent it and you cannot predict it.

That produces a continuous stream of work: a customer reports the problem, we verify it, swap the address, and the customer reconfigures. Every occurrence is a ticket, and the stream thickens with every customer added.

There are three honest ways to handle it, and every provider picks one: refuse swaps and refunds, which pushes the cost onto customers; hold spare addresses, which turns it into carrying cost; or leave the segment altogether. There is no free fourth option, and a provider claiming otherwise has simply hidden the cost somewhere you have not looked yet.

What we can't do

• Not high bandwidth. Around 20 Mbps upstream per line, shared. High-bitrate video, large file synchronisation and bulk transfer are the wrong fit.
• Not unlimited traffic. Plans carry a stated monthly allowance, and what happens beyond it is written on the plan page rather than discovered afterwards.
• Not scale. Our address inventory is small and finite, and we would rather say the number than imply a queue.
• Not many regions. One carrier, one ASN, in Wyoming. Geolocation databases register our lines across Wyoming and Montana, which is an ordinary gap between carrier registration and physical location — we mention it so it does not look like a discrepancy when you check.
• Not a guarantee of never needing a site visit. See 2026-08-07 above.