Give a private network internet access
A new subnet has no internet access at all. Not filtered, not slow — none. A server in it boots fine and then cannot install a package. This guide fixes that, and shows the option most people should use for administrative access.
1. Check you have a free public address
Section titled “1. Check you have a free public address”Ağ → Public IP (Network → Public IP). You need one address that is allocated to your organisation and not attached to anything. An address attached to a server is not free.
If you have none, ask your operator. Addresses come from a pool they manage.
2. Install the gateway
Section titled “2. Install the gateway”Ağ → Ağ Geçidi → Kur (Network → Gateway → Install).
| Field | What to choose |
|---|---|
| Ad (Name) | Anything; gateway is fine |
| Çıkış alacak subnet’ler | Tick the subnets that should reach the internet. data subnets are not listed — they can never have egress |
| Public IP | The address egress will leave from. Pick deliberately if you have several |
| Zero Trust | Optional; see step 4 |
Press Kur (Install). A virtual machine is created and configured; the gateway page shows each subnet leg as it comes up.
3. Verify
Section titled “3. Verify”From a server in an attached subnet:
curl -sS https://example.com -o /dev/null -w '%{http_code}\n'curl -sS https://ifconfig.meThe second command prints your gateway’s public address. That is the point: your egress traffic is attributable to you, not to a shared platform pool whose reputation you do not control.
An existing server may need a reboot to pick up the new default route. New servers get it at boot.
4. Zero Trust: reach your machines without exposing them
Section titled “4. Zero Trust: reach your machines without exposing them”This is the part worth doing even if you only wanted egress.
Instead of giving administrative machines public addresses and firewalling SSH, join the gateway to your Tailscale-style network. It advertises your private subnets as routes; once you approve those routes in your coordination server, your laptop reaches private addresses directly.
Paste the “Add device” command from your coordination server into the Zero Trust field — at install time or later from the gateway page. The key is used once and is not stored.
Result: no public address on your servers, no SSH port open to the internet, nothing to scan. Compare that with a firewall rule allowing 22 from your office address, which breaks the moment you work from somewhere else.
Common problems
Section titled “Common problems”A server still has no internet. Confirm its subnet is actually attached to the gateway — the gateway page lists the legs. Then reboot the server, or check its default route.
The gateway itself is not working. It needs its own public address to be attached and the pool’s gateway address to be configured. If the appliance never becomes ready, that is usually the cause.
Zero Trust shows the device but I cannot reach anything. Subnet routes must be approved in your coordination server. That approval is intentionally outside zone9 — it is your network’s policy decision.
Two of my private networks can now see each other. They cannot. Forwarding on the gateway is default-deny with explicit per-leg rules; sharing a gateway does not join networks.
What a gateway does not do
Section titled “What a gateway does not do”There is no inbound port forwarding. A gateway is an exit, not an entrance. For inbound traffic use a load balancer or a public address on the specific server.