Networking

The API calls a virtual network an SPN, which is why its endpoints sit under /v1/networking/spn. A server joins a network on one of its logical interfaces, the network reaches it as a VLAN, and addresses, firewall groups and reverse DNS all hang off the addresses a public network hands out.

Virtual networks

A network is PUBLIC or PRIVATE:

• A public network carries IPv4 and IPv6 prefixes, and addresses from those prefixes go on the internet.
• A private network carries traffic between your own servers only.

managedBy says who created the network: CUSTOMER for networks you made, SYSTEM for ones the platform set up. List virtual networks leaves system-managed networks out unless you pass include_managed=true.

A new server is attached to a public network when it is created, as the native VLAN of its first logical interface, with an IPv4 prefix and an IPv6 prefix allocated in its datacenter and one address from each assigned to it. A server ordered without a publicNetworkId gets a public network of its own, named Default Public Network, on the organization's next free VLAN tag.

One private network can join servers in different datacenters: its VLAN is extended between our datacenters, so a server in one metro and a server in another sit on the same layer 2 network. Private networks carry jumbo frames, with the host's private interface set to an MTU of 9000. Frames carrying 802.1Q VLAN tags of your own cross the network too, so you can divide it into VLANs you define.

Nothing on a private network is encrypted. Traffic that needs encryption gets it from your own TLS, WireGuard or IPsec.

Every network has a localVlanId between 11 and 4094: the VLAN tag the network carries on your servers' ports. Get VLAN availability returns the tags already in use and the next free one. List available datacenters lists every datacenter on record, without filtering by what each one offers.

Attaching a server

A server attaches to a network through a segment: one of its logical interfaces, whose id appears as segmentId in Get network capabilities and in the service's interfaces. Assign service to virtual network takes the serviceId, the segmentId and isNative:

A port can carry one native network and several tagged ones, so a single server can sit on a public network and two private ones at once.

A server can also run with no public network at all. Unassign service from virtual network detaches it; the cloud console removes private attachments only, so this is an API call. Deploys and reinstalls still work without a public network. There is no NAT gateway, so such a server reaches the internet only through one of your own servers that keeps a public address.

The change reaches the network equipment after the API answers, which is why the call returns 202 Accepted. While it is applied, the service status shows networkChange.status APPLYING; the attachment itself moves through ATTACHING to ATTACHED, or to ATTACH_FAILED. Detaching follows the same pattern with DETACHING and DETACH_FAILED.

Addresses and prefixes

A public network holds child prefixes, one list for IPv4 and one for IPv6, each tied to a datacenter. Get IPv4 prefix returns the prefix with every address in it and the addresses still free. An address is in one of four states: FREE, RESERVED, GATEWAY or ASSIGNED.

Addresses move through two steps. Reserving takes an address out of the free pool for your later use. Assigning binds it to a server's segment and returns an ipAddressEntityId, the id a firewall assignment refers to. Managing IP addresses has the calls.

Reverse DNS is checked forward first: the name you set must already resolve, through an A record, to the address you set it on. A name without that record is refused with RDNS_A_RECORD_NOT_FOUND, one pointing elsewhere with RDNS_A_RECORD_MISMATCH.

IP blocks

An IP block adds a prefix to a public network. List IP block plans shows the sizes on offer, filtered by datacenter_id; Create IP block takes the plan's offeringId, the datacenterId and the publicNetworkId to add it to, and returns the new prefixId with the subscriptionId that bills it.

Firewalls

A firewall is a group of rules applied to addresses:

1. A group has a name of up to 50 characters.
2. Each rule has a type (ALLOW, BLOCK or RATE_LIMIT), a direction (INBOUND or OUTBOUND), a protocol (ANY, TCP, UDP, ICMP, ICMP_V6 or GRE), optional source and destination port ranges and a sourceAddress, and optional packet-length bounds between 64 and 9000 bytes.
3. An assignment applies the group to one address, by its ipAddressEntityId.

Each rule has a priority, and Update firewall group takes a ruleOrder list of rule ids to reorder them. Configuring firewalls covers the validation rules and a worked example.

The rules run on the access switches your servers connect to, and they filter traffic between Serverside public addresses as well as traffic from the internet. They are matched lowest priority first across every group on an address, and a change takes effect immediately. Traffic no rule matches is allowed, so a restriction needs a BLOCK after the ALLOW it narrows. The switches keep no connection state, and they enforce INBOUND rules only: an OUTBOUND rule is stored and not applied. Groups apply to public addresses, so private network traffic is not filtered. The cloud console manages the same groups as the API.

Security scans

Our own scanner runs in production against the addresses in AS55285, yours included, and the API reports what it finds. Get security overview summarises the organization, List security findings lists each finding with filters for severity, plugin, ip and service_id, and Rescan target queues a new scan of one address. Get security scan returns the results for a single server.

You can opt out of the scans.