A private network is a layer 2 network between your own servers, carried as VXLAN inside our network. Traffic on it stays off the public internet and off the servers’ public interfaces. For jumbo frames, set MTU 9000 on the private interface. The network also carries your own 802.1Q VLAN tags.
The private network arrives as a VLAN on the port that already carries the public network, and the operating system separates the two by tag.
The network arrives untagged on the server’s second port, where the operating system sees an ordinary interface with no VLAN to configure.
You choose the VLAN tag when you create the network. A server can stay on its public network and join several private networks at once, one tag each.
Walk through it in the virtual networks guideA private network’s VLAN can be extended between our datacenters. Web servers in Amsterdam and New Jersey can then sit on the same layer 2 network and address each other with whatever private subnet you assign.
That is the layout for a web cluster. Each site answers visitors on its own public addresses, while the servers keep sessions, caches and uploaded files in step over the private network instead of the public internet. You decide how visitors are split between the sites, by DNS or by load balancers you run yourself.
These are estimates for planning, not measurements.
| Between | Estimated round trip |
|---|---|
| Amsterdam London | ≈ 7 ms |
| Amsterdam Frankfurt | ≈ 8 ms |
| London Frankfurt | ≈ 13 ms |
| New Jersey Chicago | ≈ 18 ms |
| Chicago Dallas | ≈ 22 ms |
| Dallas Los Angeles | ≈ 32 ms |
| New Jersey Dallas | ≈ 38 ms |
| Chicago Los Angeles | ≈ 48 ms |
| London New Jersey | ≈ 72 ms |
| Amsterdam New Jersey | ≈ 75 ms |
A DMZ here is not a separate product. You build it from the servers you already rent, one private network and one firewall group, in two tiers.
Web servers and reverse proxies. Each has a public address for visitors and an attachment to the private network for the tier behind it.
Database and application servers, reached over the private network. Detach a server’s public network through the API and it has no public address at all; it still deploys and reinstalls, and it reaches the internet only through a server of yours in the public tier, because we sell no NAT gateway. A private-tier server that keeps its public address listens for database traffic only on the private interface, and a firewall group closes the database and SSH ports on that address.
Extend the network to a second datacenter and web servers there join the public tier on the same VLAN, reaching the tier behind it over the private network.
A firewall group is a named set of rules that you apply to any number of your public IP addresses. The rules run on the access switch your server plugs into, so traffic a rule blocks is dropped there and never reaches the server’s port. That covers traffic from other Serverside public addresses too, not only from the internet.
Each rule allows, blocks or rate-limits traffic (in packets per second) by protocol (TCP, UDP, ICMP, ICMPv6, GRE or any), port range and source network. Rules from every group on an address are matched in one order, by priority: the lowest number wins. You manage groups from the cloud console or through the API, and a rule change takes effect immediately.
Coming soon Security groups are coming soon.
Keep a firewall on every server as well. It tracks connections, which the switch does not, and it is the only filter on the private interface.
Application servers in two or more datacenters, each behind a reverse proxy on its own public address. They share a Redis session store, the cache and internal APIs on private addresses, and a deploy reaches every site over the same network.
Three PostgreSQL nodes under Patroni with their etcd members, or a MySQL or MariaDB cluster on Galera or Group Replication, all in one datacenter. Give the cluster traffic a VLAN of its own, apart from the one your application servers query it on.
Sizing a database serverOne cluster per datacenter, with Corosync and Ceph on separate private networks. The Proxmox VE documentation asks for a dedicated Corosync network, because storage traffic can delay the cluster heartbeat.
Proxmox clustering and HAA cluster per metro, with etcd inside it. Node-to-node and pod traffic runs on the private network, and only the ingress nodes answer on public addresses.
Ubuntu dedicated serversThe sentry layout from the CometBFT documentation: sentries in the public tier peer with the chain, the validator talks only to them over the private network, and a firewall group closes its peer port on its public address.
Web3 infrastructureProxies such as Velocity take player connections in the public tier. Game servers in several metros reach one database and login backend privately.
Game server hostingPoint backup jobs at a server in another metro over the private network. The backup target runs no public service, so nothing on it listens on its public address.
Proxmox backup strategiesDomain controllers answer Kerberos and LDAP on their private interfaces, and a firewall group blocks ports 88, 389 and 445 on their public addresses.
Windows Server hostingNothing on top of the server you rent. Each of these comes with every dedicated server at no extra cost, with no charge per network, per attached server or per datacenter a network reaches.
Want a second opinion on a layout? Talk to our network team.
Yes. A web cluster can run servers in two metros on one layer 2 network, because the network’s VLAN is extended between our datacenters, and they share sessions and cache on it while both sites serve visitors. Database and Proxmox clusters belong inside a single datacenter.
Ottawa, ON, Canada
Proudly 
Canadian and 
Dutch
In USD by Serverside Networks Inc.
