Private networks

A private network is your own isolated layer-3 domain. Servers inside it reach each other over private addresses; nothing outside it can route in.

What runs underneath

Layer	Technology
Isolation	Proxmox SDN — an EVPN zone gives each private network its own VRF, so two networks cannot route to each other even on the same hypervisors
Segments	Each subnet is an SDN VNet, carried over VXLAN between nodes
Alternative mode	Regions can instead use VLAN zones, where each subnet is a tagged VLAN. Simpler, but bounded by the VLAN identifier space and by what the physical switches are configured to trunk
Address allocation	Transactional SQL in the control plane. Nothing downstream invents an address

Both modes present the same product. Which one a region uses is an installation decision; see Network and edge.

Address plan

• Each private network receives a /20 — sixteen possible /24 subnets.
• Each subnet is a /24.
• Allocations come from a private range reserved for tenants, and are unique across the installation, so two networks never overlap.

A /20 per network rather than a single /24 is deliberate: a real deployment wants separate application, data and management subnets from day one, and three of sixteen leaves room to grow.

Subnet tiers

The tier is chosen at creation and cannot be changed afterwards. It is enforced by the API, not merely displayed.

Tier	Intended for	Internet access
app	Application servers, load balancers, storage nodes	Yes, once a gateway is attached
data	Databases and internal state	Never. Attaching a gateway is refused
mgmt	Bastions, management tooling, platform appliances	Yes, once a gateway is attached

This is the cheapest control in the system and worth using properly: putting your database in a data subnet means no future click, no misconfigured route and no compromised neighbour can give it an egress path. The refusal is structural.

Caution

Because data subnets have no egress, appliances that must fetch their own configuration — load balancers, object storage nodes — cannot live there. The API refuses to create them in a subnet without a gateway, and explains why, rather than letting them install and hang.

Creating one

Ağ → Özel Ağlar → Ağ Oluştur (Network → Private networks → Create). Pick a region and a name; the network’s /20 is allocated for you. Then add subnets, choosing a tier for each.

If you create a server without choosing a network, one called default with an app subnet is created for you.

Reaching a private network from outside

Three options, in increasing order of exposure:

1. Zero Trust. Attach a gateway and join it to a Tailscale-style network. Your laptop reaches private addresses directly; nothing is published to the internet.
2. A bastion with a public address in the same network.
3. A public address on the specific server, restricted by a firewall.

Option 1 is the one to reach for first: it exposes nothing.

Deleting

A network cannot be deleted while resources still reference it. If a delete is refused, the message names what is holding it — including resources that are themselves still in a deletion buffer, which is the most common surprise. Wait for the buffer, then retry.

Limits

• One region per network; no cross-region networking of any kind.
• Subnet tier is immutable after creation.
• IPv6 is not implemented.
• In VLAN mode the number of subnets in a region is bounded by the VLAN range the operator configured.