How to Set Up a Virtual Network in LayerOne

Tutorial · 7 min read

Virtual networks live under Network in the client portal, beside floating IPs and reverse DNS. An account can create 10 VNets by default. Contact support if you need more. Each VNet is an RFC1918 prefix between /29 and /24. MTU is 1450.

1. Open Network and create a VNet

Sign in, open Network → Private networks, and create a network. Give it a name you will recognize later. Enter a CIDR you do not already use on this account, for example 10.10.0.0/24. Do not use the network or broadcast address as a host IP later.

2. Gateway: none, or your firewall LAN IP

The gateway field is optional. Leave it blank if guests will set their own routes, or if nothing on the LAN should be a default router yet. Set it to the LAN IPv4 of a firewall VM that is already on this VNet when other guests should use that address as gw=. The value is a LAN address on the VNet, not a public IP and not a platform WAN.

If you have not deployed the firewall yet, create the VNet with no gateway, attach the firewall, then set the gateway to the address you gave that NIC.

3. Choose static addresses or DHCP

Automatic IP assignment is on by default. LayerOne places the private address and optional gateway into supported images through Cloud-Init, which is the simplest choice when your network does not run DHCP.

Turn automatic assignment off when pfSense or another server will provide DHCP. The server still connects to the private network, but it receives its address from your DHCP service instead of LayerOne.

4. Attach servers

From the VNet, attach an existing VM and pick a host address inside the CIDR. You can also choose the network at deploy time and supply the private IP there. A server may attach to more than one virtual network (a firewall with LAN plus OPT). The platform does not route between those VNets.

Checkout and the API require a public IPv4, or a VNet plus a private IP, or both. Private-only means no public IPv4 and no internet path.

5. Reboot after an address change

Reboot the server after changing its network, gateway, or automatically assigned address so the guest operating system can apply the new configuration. Then open the server's Network page to confirm the private address.

6. Optional: deploy without a public IP

Turn public IPv4 off during deployment when the server should stay isolated. You can still reach it from the browser console or from another server connected to the same private network. Public IPv4 cannot be added or removed after deployment, so keep it enabled if you are unsure whether the server will need direct internet access.

Know the current limits

• No LayerOne-provided NAT or internet gateway
• No IPv6 on private or public interfaces
• No editable network-wide forwarding rules
• No routing between your private networks unless one of your servers provides it

Use each server's Firewall page for its inbound and outbound rules.

Related

• Why configure a virtual network
• Using pfSense with LayerOne
• Docs: create a private network
• Client API (private_network and private_ip on create)