Skip to content

Networks

A network is a private, isolated IP network on one of your infrastructures. Virtual machines join networks to get an IP address and talk to each other; routers connect networks to each other and to the outside world.

A network belongs to one project and one infrastructure, and has one address range (CIDR), for example 10.0.0.0/24. Resources on different networks can't reach each other unless a router connects them. You can keep environments such as development and production fully separate by giving each its own networks.

You manage networks under COMPUTE & NETWORK > Networks.

Create a network

  1. Go to Networks and click Create Network.
  2. Under Where it runs, choose the project and the infrastructure. Optionally give the network a name and description.
  3. Under Details, set the Address range (CIDR). The console picks IPv4 or IPv6 to match the range you type.
  4. Decide whether to turn on DHCP (see below). It is off by default.
  5. Click Create Network.

Things to know:

  • A network is single-stack. It is either IPv4 or IPv6, not both.
  • Write the range as its network address: 10.0.0.0/24, not 10.0.0.1/24. The form offers to correct a host address for you.
  • The range and IP protocol can't be changed later. Pick a range that doesn't overlap networks you may want to connect with a router.

You can also create a network from the virtual machine wizard: on the network step, click + next to the network list. The network goes into the VM's project and infrastructure, and DHCP is off by default there too.

Turn DHCP on for networks that hold VMs

With DHCP off, nothing hands VMs their address and gateway when they boot. Most images expect DHCP, so a VM on such a network usually ends up without working networking. Leave DHCP off only if you configure addresses another way.

DHCP settings

When you turn DHCP on, the form fills in a Gateway (the first address of the range) and one Address pool covering the rest of the range. You can change them and add:

  • DNS servers that VMs should use.
  • More address pools. Pools must sit inside the range, must not overlap and must not contain the gateway.
  • Static routes, pushed to VMs as extra routes (a destination range via a next hop). These are configured on each VM. Routes on a router are a different thing: see Static routes.

The Gateway is the address VMs send traffic to when it isn't for their own network. To give the network a way out through a router, attach the router using this address as its Fixed IP. See Make a router the network's gateway.

To change DHCP later, open the network and click Manage DHCP. Turning DHCP off removes the gateway, address pools and static routes, and keeps the DNS servers.

Import an existing network

If a network already exists in your cloud, you can import it instead of creating a new one.

  1. Go to Networks and click Import Network.
  2. Choose the project and the infrastructure.
  3. Under Network in your cloud, pick the Network and then its Subnet. Networks that your cloud marks as external or shared carry an External or Shared badge.
  4. Click Import Network.

The range, IP protocol and DHCP settings are read from your cloud.

Networks that are external or shared in your cloud, or that belong to another cloud project, can only be imported Read-only. They can't be made Managed or owned later, so you can remove them from the platform only with Detach.

For Read-only and Managed, taking ownership and what can't be imported, see Imported resources.

External networks

An external network is your cloud's provider network, the one that leads outside your cloud. Routers use it as their external gateway. You can't create one in the platform: someone in your organization, usually an organization administrator, imports it from the cloud and shares it with the projects that need it.

Manage a network

Open a network from the list to see its details. From its page you can:

  • Edit its name and description.
  • Manage DHCP.
  • Sync it, which re-applies its settings to your cloud. Use it when the network is Degraded or has drifted from what the platform shows.
  • Check Used IP Addresses: every address in use on the network, read live from your cloud, with what holds it (VM, router, DHCP, load balancer, port and so on) and whether the platform manages it.
  • See who it is shared with, and its Action History.

Changes work while the network is Active or Degraded. In Error you can only delete or detach it. See Resource statuses. On a Read-only import, DHCP changes and Sync aren't available until management is enabled.

Share a network with other projects

Projects you share a network with can attach their own VMs and routers on the same infrastructure to it, and use an external network as a router's external gateway. See Share a resource.

Delete or detach a network

  • Delete destroys the network in the platform and in your cloud. It can't be undone.
  • Detach removes the network from the platform and leaves it in your cloud. You can import it again later.

Both are in the network's Actions menu, and you confirm by typing the network's name. Imported networks can only be detached until your project takes ownership of them (see Imported Resources).

Both are refused while any VM or router uses the network, including VMs and routers in projects it is shared with. Use View dependencies to see them.

Leftover ports in your cloud

A delete is also refused while ports the platform doesn't track still use the network in your cloud, for example an interface left behind by a deleted VM, a load balancer address or a port created by hand. The error names the blocking ports. Remove them in your cloud and try again. Detach doesn't check for these ports.

Quotas

Each network, created or imported, uses one networks unit. See Resource Quotas.

Permissions

Task Permission
Create network_create
Import network_import (as Managed: also network_control_update)
Edit name and description network_metadata_update
Change DHCP network_dhcp_update
Sync, cancel an action network_action_update
Switch Read-only / Managed network_control_update
Take ownership network_authority_update
Change sharing network_share
Delete / Detach network_delete / network_detach

network_update includes metadata, DHCP and action updates. The create and import forms also need some organization-level permissions to pick where the network runs: see What project members typically need. Full list: Permissions Reference.