Connect Cloud VPS and VPS servers, control access and distribute traffic from one panel.
Your database, your application and your workers talk to each other over a network that belongs only to you, and only what you choose faces the internet.
Create a network in the control panel and attach your Cloud VPS and VPS servers to it. Each server gets a private address automatically, and the traffic between them stays inside the network.
A web server and its database that talk only to each other.
Decide which traffic may reach each server. What your rules do not allow is blocked.
A database that only your application servers may reach.
Servers find each other by name, such as web1.office.internal or simply web1, and you can add names of your own.
Connection settings that say db1, not a number to remember.
Order a Cloud VPS or VPS that lives only in your private network, for a database or another service that never needs to face the internet.
Databases, queues and other internal services that nobody on the internet can reach.
See your networks, servers and the connections between them on one map, and open any of them from there.
What is connected to what, at a glance.
Networks, their servers, security groups, load balancers and VPN can be managed with an API key that has the networking scopes.
Building and changing your setup from scripts and deployment tools.
A private network can stay fully private, go out to the internet, or have an address the world can reach – you decide, and you can change it later.
Switch on internet access for any network at any time with an additional public IP address. The network’s servers, also those without a public IP, go out to the internet through it, and nothing from the internet comes in.
Updates and outside services for servers you keep private.
Attach it to a network, and the servers of that network reach the internet through it, or to one server, and the server can be reached at it. The address stays yours for its paid period, and you can move it to another of your networks or servers.
One address that follows the server you point it at – also when you replace the server.
When one server is no longer enough, several share the same job. The load balancer checks every server and sends traffic only to those that answer.
One private address inside the network that spreads TCP and UDP traffic across several of its servers. It needs no internet access.
An application that reaches its database replicas or cache servers at one address.
A public address on the internet in front of several of your servers, running on 3 or 5 servers of its own. It takes TCP, HTTP and HTTPS; HTTPS goes through to your servers, which keep their own certificates.
A website or API whose busy day is shared by several servers.
A VPN is a service of its own: attach it to any of your networks and move it to another one when you need to. You manage it in the control panel.
Connect your computer or phone to a private network with the WireGuard app or the built-in IKEv2 VPN and reach its servers by their private addresses, without opening them to the internet.
You and your team reach servers that have no public IP – your own internet stays as it is.
Join your office, factory or other place to a private network. Its computers reach the servers you choose by their private addresses, as if they stood in the next room.
An office that works with your servers without opening them to the internet.
Send all of a device’s traffic through the VPN and out to the internet from the VPN’s own public IPv4 – no network or server needed.
Going out to the internet from the VPN’s own public IPv4 address, wherever you are.
See when each device was last seen and how many are connected right now. A VPN that stops answering repairs itself, and you can also restart or rebuild it yourself.
Knowing at a glance who is connected right now.
Add a device or a site to your VPN in the control panel, and it gives you the QR code, the file, the IKEv2 settings or the router configuration with your values filled in. This is what the steps look like on each system and router.
Values in angle brackets, such as <your VPN address>, stand for your own – the panel fills them in. Keys and configuration files are shown once, so save them right away.
Each device gets its own WireGuard file, or its own IKEv2 username and password. It reaches the servers you choose, or every server of the network, also the ones you add later.
In the control panel: open your VPN, choose Add device, then the WireGuard app or the built-in IKEv2. Save the QR code, the file or the password right away: they are shown once.
In the WireGuard app
Install WireGuard from the App Store. Tap +, then “Create from QR code”, and scan the code. Turn the tunnel on.
Built-in IKEv2 (no app)
Choose “Built-in IKEv2 (no app)” when you add the device and download the profile. Install it in Settings, then turn the VPN on.
In the WireGuard app
Install WireGuard from Google Play. Tap +, then “Scan from QR code”, and scan the code. Turn the tunnel on.
Built-in IKEv2 (no app)
Choose “Built-in IKEv2 (no app)” when you add the device. Add the VPN in Settings → Network & internet → VPN with the values the panel shows, or open the profile in the strongSwan VPN Client app.
In the WireGuard app
Install WireGuard from wireguard.com. Download the .conf file, choose “Import tunnel(s) from file” and pick it. Click Activate.
Built-in IKEv2 (no app)
Choose “Built-in IKEv2 (no app)” when you add the device. Paste the lines the panel shows into PowerShell, then connect in Settings → Network & internet → VPN with the username and password.
In the WireGuard app
Install WireGuard from the Mac App Store. Download the .conf file, choose “Import tunnel(s) from file” and pick it. Click Activate.
Built-in IKEv2 (no app)
Choose “Built-in IKEv2 (no app)” when you add the device and download the profile. Install it in System Settings, then turn the VPN on.
CLI (copy-paste)
Install wireguard-tools, download the .conf file and run these commands in the folder you saved it to.
if sudo sh -c 'umask 077; set -C; cat > /etc/wireguard/<device name>.conf' < <device name>.conf; then sudo wg-quick up <device name> else echo "Stopped, nothing was copied or started: /etc/wireguard/<device name>.conf already exists or <device name>.conf is not in this folder. Rename the downloaded file and use the new name in these commands." fi
Built-in IKEv2 (no app)
Choose “Built-in IKEv2 (no app)” when you add the device. The panel shows the NetworkManager commands (package network-manager-strongswan) or a swanctl file.
An office, a branch or any other network behind a router – over IPsec IKEv2 or WireGuard.
In the control panel: open your VPN, then Sites (site-to-site) → Connect a site (router) → pick the router → Router configuration.
Loading the example…
Loading the example…
Loading the example…
Loading the example…
Loading the example…
Loading the example…
Loading the example…
Loading the example…
Loading the example…
Loading the example…
Loading the example…
Loading the example…
CLI (copy-paste)
In Terminal (or WinBox → New Terminal), paste these commands. They add the WireGuard interface, the VPN as its peer, the tunnel address and the routes to the servers.
{
:if ([:len [/interface wireguard find name="<site name>"]] > 0) do={
:put "Stopped, nothing was changed: this router already has an interface named <site name>. If it is not this site's tunnel, use another name in these commands."
} else={
/interface wireguard add name="<site name>" private-key="PRIVATE_KEY_FROM_THE_CONF_FILE"
/interface wireguard peers add interface="<site name>" public-key="<VPN public key>" endpoint-address=<your VPN address> endpoint-port=<VPN port> allowed-address=<server address>/32 persistent-keepalive=25s
/ip address add address=<tunnel address>/32 interface="<site name>"
/ip route add dst-address=<server address>/32 gateway="<site name>"
}
}Do not turn on NAT for this tunnel: the servers see the site computers’ own addresses.
Web interface (step by step)
Endpoint: <your VPN address>:<VPN port> Public Key: <VPN public key> Allowed IPs: <server address>/32 Keepalive: 25 Tunnel address: <tunnel address>/32
Do not turn on NAT for this tunnel: the servers see the site computers’ own addresses.
Web interface (step by step)
Endpoint: <your VPN address>:<VPN port> Public Key: <VPN public key> Allowed IPs: <server address>/32 Keepalive: 25 Tunnel address: <tunnel address>/32
Do not turn on NAT for this tunnel: the servers see the site computers’ own addresses.
CLI (copy-paste)
Paste these commands at the VyOS prompt (1.4 or newer), not in configuration mode. They add the WireGuard interface wg707 with the VPN as its peer and the routes to the servers, then commit and save; if wg707 is already there, they change nothing. If the input firewall drops everything by default, allow UDP to the listen port and the traffic from the servers on wg707.
if cli-shell-api existsEffective interfaces wireguard wg707; then echo "Stopped, nothing was changed: this router already has an interface named wg707. If it is not this site's tunnel, use another name in these commands." else W=/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper $W begin $W set interfaces wireguard wg707 address '<tunnel address>/32' $W set interfaces wireguard wg707 private-key 'PRIVATE_KEY_FROM_THE_CONF_FILE' $W set interfaces wireguard wg707 peer vpsnet public-key '<VPN public key>' $W set interfaces wireguard wg707 peer vpsnet address '<your VPN address>' $W set interfaces wireguard wg707 peer vpsnet port '<VPN port>' $W set interfaces wireguard wg707 peer vpsnet allowed-ips '<server address>/32' $W set interfaces wireguard wg707 peer vpsnet persistent-keepalive '25' $W set protocols static route <server address>/32 interface wg707 $W commit $W save $W end fi
Do not turn on NAT for this tunnel: the servers see the site computers’ own addresses.
Web interface (step by step)
Allowed IPs: <server address>/32
Do not turn on NAT for this tunnel: the servers see the site computers’ own addresses.
CLI (copy-paste)
Download the .conf file, then run these commands in the folder you saved it to:
if sudo sh -c 'umask 077; set -C; cat > /etc/wireguard/<site name>.conf' < <site name>.conf; then echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-vpsnet-forward.conf sudo sysctl --system sudo systemctl enable --now wg-quick@<site name> else echo "Stopped, nothing was copied or started: /etc/wireguard/<site name>.conf already exists or <site name>.conf is not in this folder. Rename the downloaded file and use the new name in these commands." fi
Do not turn on NAT for this tunnel: the servers see the site computers’ own addresses.
The same values as one WireGuard file
[Interface] PrivateKey = PRIVATE_KEY_FROM_THE_CONF_FILE Address = <tunnel address>/32 [Peer] PublicKey = <VPN public key> Endpoint = <your VPN address>:<VPN port> AllowedIPs = <server address>/32 PersistentKeepalive = 25
Do not turn on NAT for this tunnel: the servers see the site computers’ own addresses.
Every router the control panel has instructions for. The step-by-step guides show every screen and value and say what they were tested with; for the other routers the panel gives a ready recipe, shown in “How to connect”.
A private network, its security groups and its names cost nothing extra: you pay for your servers as usual.
Paid additions are billed monthly. You see the exact price before you pay, and automatic renewal is yours to switch on or off.
With automatic renewal on, renewal is attempted 7 days before the end of the term. Without it, the service works until the end of its paid term and then ends by itself.
Cloud VPS and VPS servers. Container VPS servers and dedicated servers cannot be attached.
No. Create a network, attach the servers you already run or order a new one straight into it. Your servers keep their public addresses unless you order them without one.
No. Networks, security groups and names inside the network are included: you pay for your servers as usual.
Yes, when its network has internet access through an additional public IP address. Without it the server stays fully private.
To reach your servers from your computer or phone while your own internet stays as it is; to send a device’s traffic out to the internet from the VPN’s own public IPv4 (Internet VPN); to join your office, factory or other place to the network (site-to-site); to join the networks of two accounts, each with its own VPN. A VPN is attached to one network at a time and can be moved to another.
The internal one when the traffic comes from inside the network: it has a private address and takes TCP and UDP. The public one when the traffic comes from the internet: it has a public address, runs on 3 or 5 servers of its own and takes TCP, HTTP and HTTPS; its network needs internet access. Both send traffic only to the servers that answer.
Security group rules, names and VPN access apply within seconds while your servers keep running. When you attach a server, the panel tells you beforehand whether it joins while running or needs a restart.
With automatic renewal on, we try to renew the service 7 days before the end of its paid period. If payment succeeds, the service is extended for the next period. With automatic renewal off, the service keeps working until the end of the paid period and then ends by itself.
Yes. Create an API key with the networking:read or networking:manage scope; paid additions also need networking:order. The API is described in the published OpenAPI files.
Sign in to the control panel, open Networks and create your first network.