Private networks between your servers

You manage private networks under Servers · Networks (at the top of the server list). In a VPS or container's Network tab, Private networks shows which ones it is in, with address, interface and MAC.

Create a network

1. 1

   Under New network, enter a name such as “Backend”.

2. 2

   Choose an Address range from the suggestions, or enter a private range under Custom, such as 10.20.0.0/24. Ranges from /29 (6 addresses) to /16 are possible; it must not overlap with another of your networks or with networks our servers or Docker need themselves.

3. 3

   Press Create.

Add servers

1. 1

   Open the network and choose one of your VPS or containers under Add a server. In a server's Network tab it also works through Add to a network.

2. 2

   Enter an address or leave the field empty: the server then gets the next free one. We never hand out the range's first address by ourselves, so it stays free for a router of your own, for example.

3. 3

   Press Add. The steps show how far it is; afterwards the server is listed as Connected.

• On a VPS we set the address through the guest agent inside the system. Some servers only take a new network card after their next restart; the list then says Active after the next restart.
• A container gets its address at its next start.
• Remove takes a server out of the network again, confirmed by holding.

Set up yourself

If no guest agent runs in the server, for example after installing from your own ISO image, the list says Address not yet set in the system. Then enter the address yourself on the private network's interface (recognisable by the MAC in the Network tab), with the values under Set up yourself: prefix and MTU; the private network has no gateway and no DNS server. We also try again every ten minutes.

Firewall inside the network

Traffic between the servers of a network passes by default, ahead of your firewall's rules. Switch off Allow traffic inside the network, and your firewall decides here too. In the network, each server only sends from its own address.

Good to know

• Each network is a sealed-off segment of its own (technically a VXLAN). Only your servers in the network see its traffic. It is not encrypted on top: for confidential data use TLS or WireGuard as you would anywhere else.
• Servers on different hosts share the same network as if they were on one switch; VPS and containers can be mixed.
• The private network has no way to the internet. That still goes through the public address.
• At most 10 networks per account, 64 servers per network and 3 networks per server.
• A network can be deleted once no server is left in it; its address range becomes free again.
• Networks are managed by you and by people in your account's team with the “Edit network” right. Adding or removing a server needs the “Edit network” right on that server.