Private networks
A private IPv4 range that only your own servers can use to talk to each other.
Built, not open to the public yet
This feature is built and has been tested against simulated hosts and a test database. It has not yet been proven on real hardware, and nothing here can be ordered today.
Not there yet
- One host per network. Networks across hosts, a NAT gateway and security groups are planned.
- Real-hardware testing is still to come.
How they work
- Create a network in one location with a private range, written with its network address: an RFC 1918
IPv4 range from /16 to /24, for example
10.20.0.0/24. Two of your networks cannot overlap. Two organisations can use the same range without ever seeing each other. - Attach servers of your organisation in that location, on the same host. Each gets an address from the range (you choose it, or the lowest free one). The first host address is kept for a later gateway and the network and broadcast addresses are never given out.
- A network holds up to 32 servers, and a server can join up to 2 networks. There is also a limit on networks per organisation.
- Detach a server, or delete a network that has no servers in it. Detaching asks you to confirm.
Isolation
Each network is its own bridge on the host. A server cannot send frames with another server's address, answer DHCP, send IPv6 or spanning-tree traffic, or reach outside its range. These rules are tested as a model; they have not yet been run on a real host.
Setting up the server
The panel shows the interface, its MAC address and the address with its prefix length. You set the address inside the server yourself. A cloud-init snippet is not generated yet.
Firewall
The firewall filters the server's public interface only. It does not apply to the private network. When you attach a server that has a firewall policy, the panel asks you to acknowledge that.
Price
No price is set for private networks yet. They are limited, not charged. If that changes, the panel will show the price before you pay.
Not built
- Networks across more than one host, a NAT gateway and security groups.
- IPv6 on private networks, and a firewall policy on the private interface.
- Reverse DNS and outgoing mail for private addresses (they are never mail-eligible).