Private networks

Private networks servers are configured with a public and a private interface on a Layer 3 network topology by default.

You can use the Private networking feature to change servers to a Layer 2 topology, allowing for L2 traffic between two or more instances.

Private networking provides a myriad of benefits, with the most important ones being:

  • Traffic doesn't go through the public internet, enhancing security.
  • Private network traffic doesn't count against your bandwidth quota.


Private networking allows you to group servers in the same project within the same location, enabling private communication between them. This is useful when you don't want or need traffic from specific servers going through the internet.

For example, if you have a server running a database that needs to communicate with a web app on a different server, you could have the database server connect privately to the web app server. Another common use case is if you are managing services like DHCP or setting up Kubernetes clusters.

Layer 2 packets don't go through the network layer, and traffic is not filtered in any way. does not charge for traffic from private networks, either inbound or outbound.

Private Network


Create a VLAN

The first step is to create a Virtual Network — commonly referred to as VLAN. You can do that from the dashboard or through the virtual networks API.

Creating a Virtual Network from the dashboard

  1. On your dashboard, select a project and click on Networking → Private networks menu.
  2. Click on Create VLAN on the top-right section of the page. Choose the location and add a description. The description is only used to help you identify what the VLAN is used for.

Assign servers

After creating the VLAN, assign at least two servers to allow the server's private IPs to communicate.

  1. Go to the Virtual Network you created and click on Assign.
  2. Select the server you'd like to assign - Only servers from the facility the virtual network was created in will be listed.
  3. Save and wait a few seconds while the network is provisioned.

Configure the OS

The network provisioning on our switches is handled automatically after you assign your first server to a VLAN. has no access to your servers, an additional step is required, and you need to configure the VLAN on your Operating System.

Load the 8021q module into the kernel and install the VLAN package

sudo modprobe 8021q
sudo apt install vlan

Change netplan

Change the Netplan configuration file in /etc/netplan/50-cloud-init.yaml and add the configuration below to the end of the file.

  • Replace {{VID}} with the VID value from the VLAN you created.
  • Replace with a private address of your choice. This address becomes the private IP of the server within the VLAN. It can be anything you want, but each server in the same VLAN needs a different IP.
  • Replace eno2 with the correct interface name. For servers with bonded interfaces, use bond0.
            id: {{VID}}
            link: eno2
            addresses: []

The vlans section should be at the same indentation level of the ethernet key.

Save the file and apply the configuration

sudo netplan apply

This configuration is persistent, you don't need to do anything else.

Additional Resources