Private Networks

A private network (VPC) gives your servers an isolated network they talk over using internal IPs, with nothing exposed to the public internet. Add routes on top and you control where traffic for any destination goes: through a firewall VPS, a NAT Gateway, or an appliance you run yourself.

It's the building block for multi-tier applications (web in front, database on a private subnet), private clusters, NAT egress, and anything where servers should reach each other without public IPs.

Create a network

Rules for the range

Tip

Pick a range that doesn't collide with anything else you'll ever need to reach — your office LAN, another provider's VPC, or a Kubernetes pod CIDR. Overlaps aren't rejected at creation; they show up later as traffic silently going the wrong way.

Attach servers

Open a machine's Network tab (VPS or baremetal) and Attach it. The server takes the next free internal IP from the range.

• The server must be in the same project and location as the network, and be active or stopped.
• A VPS must be restarted for the change to take effect. Baremetal applies the switch configuration in the background, but you still have to configure the VLAN inside the OS.

Note

"Attached but they can't reach each other" is almost always a VPS that hasn't been restarted since attaching.

Routes

By default a network only knows how to reach its own CIDR. A route tells it to send traffic for some other destination through a next hop you choose.

Typical uses: send all outbound traffic through a firewall VPS, or route a remote subnet through an appliance's internal address.

What's allowed

• The destination can't be the network's own CIDR (that's already connected) and can't sit in a reserved range (loopback, link-local, multicast). A supernet like 0.0.0.0/0 is fine.
• An IP next hop must be inside the network's CIDR, and can't be .0, .1 or the broadcast address.
• A server next hop must be in the same project and already attached to this network, otherwise it's unreachable and the route is rejected.
• Address families must match — an IPv4 destination needs an IPv4 next hop.
• Up to 30 routes per network. The same destination can have more than one next hop (treated as equal-cost paths); only an exact duplicate is refused.

Important

Routes created automatically by a NAT Gateway are managed for you and can't be deleted directly. Delete the gateway and its route goes with it.

Warning

A route steers where the network sends traffic. It does not configure the next-hop server. That box still has to be set up to forward, NAT or filter as you intend — enabling IP forwarding is usually the step people forget.

What it doesn't do

• It isn't a public network. Private IPs are reachable only by your attached servers in the same location. For outbound internet from a private-only server, route through a NAT Gateway.
• It doesn't span locations. A network lives in one location. Connect locations with a routing appliance and routes.

Troubleshooting