Skip to content
TebibHost Docs

VPCs and subnets

A VPC (virtual private cloud) is a private network that belongs to one project. VMs in the same VPC reach each other over private addresses; nothing else can, not even your other projects. A subnet is an address range inside a VPC that VMs attach to.

The default network

Section titled “The default network”

Every new project gets a default network, so a VM works without any network setup:

Resource Value
VPC default 10.0.0.0/16 and an IPv6 /80 from TebibHost’s public range
Subnet default 10.0.0.0/24 and an IPv6 /96, dual-stack
Security group default VMs in the group reach each other; all outbound allowed; other inbound denied
DNS resolver 100.67.53.53, in every VPC

A VM created without a subnet lands in the default VPC’s default subnet.

How addressing works

Section titled “How addressing works”
  • IPv4 is private (RFC 1918). VMs get an address, the gateway and the MTU by DHCP. Different projects may use the same ranges; they never meet.
  • IPv6 is public and routed, never NATed. Each VPC gets a /80, each subnet a /96 of it, and each VM a single address by DHCPv6. Because the address is public, the security group is what keeps it closed.
  • Outbound internet: over IPv6, every VM can reach the internet from the start. Over IPv4, a VM needs either a public IP of its own or a NAT gateway in its VPC.

Private DNS

Section titled “Private DNS”

Each VPC has its own resolver at 100.67.53.53. It answers internet names and the names of your VMs: <vm hostname>.internal, or just the hostname (the search domain is internal). Names from other projects don’t resolve.

Terminal window
ssh ubuntu@web-1.internal      # from another VM in the same project

Create a VPC and a subnet

Section titled “Create a VPC and a subnet”

A VPC’s IPv4 range must be inside 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, from /16 to /28. A subnet’s range must sit inside its VPC’s range and not overlap the VPC’s other subnets. A new VPC comes with its own default security group, IPv6 range and DNS.

Open Network in the project. Create the VPC, then add subnets to it.

Put a VM on it at creation: Subnet in the New VM form, or tebib vm create ... --subnet <subnet ID>. A VM stays on the subnet it was created on.

Between VPCs

Section titled “Between VPCs”

Different VPCs never connect over private addresses (there is no peering yet). They can talk over their public IPv6 addresses, if the security groups on both sides allow it.

Delete

Section titled “Delete”

Delete what’s inside first: a subnet with VMs or a NAT gateway in it refuses to go, and so does a VPC with subnets, security groups or a NAT gateway. The VPC’s default security group goes with the VPC.

Limits

Section titled “Limits”
Default
VPCs per project, including the default 5
Subnets per VPC 20

See Limits and quotas.