Private networks

How a private network works

A network belongs to one project and spans all 6 regions. Each server on it gets a second interface with a private address. Traffic between two servers on the network never crosses the internet, and it is not billed.

Round trips over the network run from 5 ms between ee1 and lv1 to 58 ms between ee1 and pt1. Keep a database and the servers that query it in one region. Use the network across regions for replicas, backups and failover. Regions lists the median round trip between every pair.

Managed PostgreSQL, load balancers and Kubernetes clusters join a network too. A database on a network accepts connections from that network alone.

Create a network

Give the network a name and a range from the private address space of RFC 1918. Choose one that does not overlap your office or other clouds, so a VPN can join them later.

$ lc network create app --ip-range 10.20.0.0/16
Created app (10.20.0.0/16), all regions

Attach servers

1. Attach a server when you create it, with the --network flag.
2. Attach a running server with lc network attach, which adds the interface without a reboot.
3. Read the server’s private address with lc server show, followed by its name.

$ lc server create worker-1 --plan s-4 --region ee1 \
    --image debian-13 --ssh-key me --network app
$ lc network attach app --server web-1
$ lc server show web-1
Name     web-1
IPv4     203.0.113.24
Private  10.20.0.11 (app)

A server can sit on several networks, with one interface for each of them.

Servers without a public address

Add --no-public-ip to create a server with no public IPv4 or IPv6 address. Nothing on the internet can reach it, and it reaches the internet only through a gateway. To move a public address between servers instead, use a floating IP.

Reach the internet through a gateway

A server without a public address still needs package updates. A NAT gateway gives the network one way out: servers send outbound traffic through it, and nothing can connect in.

$ lc gateway create out --network app --region ee1 --nat
$ lc network route app --default out

Every server on the network then uses the gateway as its default route. A gateway costs €0.0070 an hour, up to €4.49 a month. The gateways page has its full spec sheet.

Connect an office or another cloud

The same gateway runs site-to-site WireGuard and IPsec tunnels. Your office then reaches servers by their private addresses, and no SSH port has to face the internet.

1. Add a tunnel to the gateway, with your side’s public address and range.
2. Copy the gateway’s public key or pre-shared key into your router.
3. Bring the tunnel up on your side, and test it with ping to a private address.

A firewall filters a server’s public interfaces only. Traffic on a private network passes it by, so bind services that should stay private to the private address.