Why Configure a Virtual Network on LayerOne

Infrastructure · 6 min read

Use a LayerOne virtual network when two or more of your servers need a private LAN. Servers on the same network can reach one another, while traffic cannot enter from or leave for another network unless you route it through a firewall or router you control. Set the network MTU to 1450 inside guests that need it.

LayerOne does not add internet access, DHCP, or routing between your private networks. That gives you a clear boundary: your servers stay isolated by default, and you decide whether a pfSense, OPNsense, VyOS, or Linux router should connect them to anything else.

Isolation without a public address

A dedicated IPv4 remains the default when you deploy a VPS. Turn it off when the server should be private-only, with no direct inbound or outbound internet path. You can reach that server through the browser console or through another server connected to the same private network. This works well for CI runners, staging databases, internal APIs, and services that should not have a routable address.

Private-only does not mean “internet access behind LayerOne NAT.” There is no outbound path unless you provide one through a server connected to both the private network and the public internet.

East-west between your own VMs

Choose an RFC1918 range from /29 through /24. Use it for an application server talking to a database, a build worker reaching an artifact host, or a jump host reaching the rest of your environment. Another customer may use the same private range without sharing your network.

A server—especially a firewall—may connect to more than one private network. LayerOne presents each connection as a separate network interface; your firewall or router decides what, if anything, can pass between them.

A firewall as the only WAN path

For internet access or traffic between private networks, connect a firewall to a public IPv4 for WAN and to one or more private networks for LAN or OPT. Run NAT, DHCP, VPN, and routing inside pfSense, OPNsense, VyOS, or another guest you manage. Set the private network gateway to that firewall's LAN address when other servers should use it as their default route; leave it blank when the network should have no default route.

The Network Optimized no.appliance plan is designed for a lightweight firewall. Choose a larger plan when your appliance needs more memory, storage, or inspection capacity.

When you do not need one

A single public VPS that only speaks HTTPS to the world does not need a VNet. Extra public IPv4 is the floating-IP add-on, not a private network. IPv6 is not available yet.

Related

• How to set up a virtual network in LayerOne
• Using pfSense with LayerOne
• Docs: create a private network