A VPC network is a private network between your own servers in the same location: internal traffic like database connections and backups moves over private addresses instead of the public internet. Only your servers can join your VPC networks, and attaching one takes a minute with no reboot.
1. Create the network
In the client area open any service and click Log In To Panel under Service actions. In the control panel, open VPC Networks in the sidebar and click Add VPC Network:
- Name: anything recognizable, like
internal. - List type: Range.
- From and To: a private range, for example
10.0.5.1to10.0.5.254. Start at.1, not.0. - Netmask:
255.255.255.0. - Location: the location your servers run in. A VPC connects servers within one location only.
Save, and the network appears in the list. Range hands out addresses automatically as servers attach. The Set type only uses addresses you add by hand to the network's IP table first; for most setups, Range is the right choice.
2. Attach your servers
Open your first server in the control panel, go to Networking, and under Private IP addresses click Attach to VPC Network. Pick the network and attach. The private interface is added to the running server already configured. There is no reboot and nothing to edit in the OS. Repeat for every server that should be on the network.
A server can be attached to several VPC networks at once, and detaching is the trash icon on the private IP row.
3. Verify connectivity
On each server, confirm the new interface and ping a neighbor's private address:
$ ip a $ ping -c 3 10.0.5.2
The private interface (named like ens8) carries your address from the range with a /24.
MTU 1400 is intentional
The private interface comes up with MTU 1400, matching the public one. Leave it as is: raising it breaks traffic on this network in ways that are miserable to debug, and every interface on your servers here uses the same value, so nothing needs tuning.
4. Put it to work
Bind internal services to the private address so they never listen publicly, for example MariaDB with bind-address = 10.0.5.1, and point your app at the database's private IP. If you run a firewall from our firewall guide, allow the private range explicitly:
$ sudo ufw allow from 10.0.5.0/24$ sudo firewall-cmd --permanent --zone=trusted --add-source=10.0.5.0/24 $ sudo firewall-cmd --reload
That admits your own servers while the public side stays locked down.
Different locations need a tunnel
A VPC does not stretch between locations. For a private link between, say, a New York and an Amsterdam server, run WireGuard between their public addresses instead; the VPC still handles everything within each location.
Quick reference
| Task | Where |
|---|---|
| Create a VPC | Log In To Panel, VPC Networks, Add VPC Network |
| Recommended range | Start at .1, netmask 255.255.255.0, type Range |
| Attach a server | Server, Networking, Attach to VPC Network |
| Check it works | ip a, then ping a neighbor's private IP |
| Multiple networks | Yes, per server, attach each separately |
| Cross-location | Not via VPC; use WireGuard |
Where to go next
Move anything that does not need public exposure onto private addresses: databases, Redis, internal APIs, backup targets. With the firewall guide's rules on top, only the ports you actually serve to the public stay reachable.