Private networks

Updated 2026-10-30

A private network (VPC) connects your servers over your own IP range, separate from the internet. Servers can live on a private network with no public IP; a NAT gateway gives them outgoing internet access, and an Elastic IP maps a public address to one of them when it must be reachable.

When to use one

• Databases, caches and queues that should never be exposed publicly.
• App servers behind a load balancer, which can reach private-only servers over the network.
• Fewer paid IPv4 addresses: only the entry points need one.
• Internal traffic between servers that stays off the public interface.

Create a network

1. Open Networks in the console and choose Create network.
2. Name it, for example prod.
3. Choose an IP range, such as 10.0.0.0/16.
4. Create it.

The examples below use addresses from 10.0.1.0/24 inside that range.

Choose a range that will not overlap with your office network or a VPN you plan to connect, because overlapping ranges cannot be routed cleanly.

Attach servers

• New servers: select the network in the networking step of create a server. To make the server private-only, deselect the public IPv4 and IPv6.
• Existing servers: open the server, go to Networking and attach it to the network.

On the server, the private address appears on its own interface:

ip -brief address

Test from one server to another:

ping -c 3 10.0.1.5      # example private address

Bind services to the private address

Make internal services listen only on the private interface. Examples:

# PostgreSQL: /etc/postgresql/16/main/postgresql.conf
listen_addresses = '10.0.1.5'

# Redis: /etc/redis/redis.conf
bind 10.0.1.6

And allow only the network range in pg_hba.conf, UFW or a firewall:

sudo ufw allow from 10.0.0.0/16 to any port 5432 proto tcp

NAT gateway: internet for private servers

A private-only server cannot download updates or call external APIs on its own. A NAT gateway fixes that:

1. In the console, create a NAT gateway for the network.
2. Confirm. Outgoing traffic from servers in the network now leaves through the gateway's public address.

Check from a private server:

curl -4 https://ifconfig.me
sudo apt update

The NAT gateway only handles connections started from inside. Nothing on the internet can open a connection to your private servers through it.

Elastic IP: reach one private server from outside

An Elastic IP is a public IP NATed to a server that lives on a private network. Use it when a single private server must accept connections from the internet, for example a mail relay or a VPN endpoint, without giving it a public interface.

1. Create an Elastic IP in the console.
2. Assign it to a private server in the network.
3. Allow the needed ports in the server's firewall.

For several servers behind one address, a load balancer is usually the better choice.

Connect to private servers

Use a jump host with a public address:

ssh -J [email protected] [email protected]     # example addresses

Or run a VPN on one server and route the network range through it; see the WireGuard guide. The browser console also works for every server, public or not.

Plan the layout

A common small production layout:

You can draw exactly this in the Composer, see the monthly cost and apply it in order.

API

Networks are available through the API at https://api.wolkra.com/v1/networks. See API tokens.

More on the product pages: private networks, NAT gateways and IP addresses.