Private Networking Between Your Servers

Private networking gives each of your servers a second network card with a private address (for example 10.20.0.14 in Ashburn or 10.21.0.14 in Dallas). Your servers in the same region reach each other on those addresses — fast, unmetered, and invisible to everyone else. Use it for a database that should never face the internet, for replication, for internal APIs, or for backups between servers. It is a monthly add-on for each server (the price is on the VPS pricing page); add it from the server's dashboard, and the server restarts once to get the new card.

1. Add It to Each Server

On each server's dashboard, open Add-ons and add Private networking. It is one address per server, shown on the same card once it is set up. Keep the restart ticked unless you would rather restart at a quieter time — the private card only appears after a restart from the dashboard.

2. Check the Address Inside the Server

The platform configures the private card on that restart — on our Ubuntu images it comes up by itself as eth1. If the card has no address after the restart, set it by hand as in step 3.

ip -br addr
# eth0   UP   203.0.113.10/24
# eth1   UP   10.20.0.14/24      <- the private address

From another of your servers in the same region:

ping -c 3 10.20.0.14

Your internet traffic keeps going out through the public card — the private network has no route to the internet, by design.

3. If the Card Has No Address

On an operating system that does not pick up the platform's network settings by itself, such as some Debian, AlmaLinux, Rocky or Windows setups, set the address by hand. Use the address shown on the dashboard with netmask 255.255.255.0 (/24) and no gateway. Find the card's real name with ip -br link and use it in place of eth1. With netplan (Ubuntu):

# /etc/netplan/60-private.yaml
network:
  version: 2
  ethernets:
    eth1:
      addresses: [10.20.0.14/24]

sudo chmod 600 /etc/netplan/60-private.yaml
sudo netplan apply

On Windows, give the second network adapter the address and 255.255.255.0 in its IPv4 properties, and leave the gateway and DNS empty.

4. Bind Private Services to the Private Address

The point is usually to keep a service off the internet. Make it listen only on the private address, and let the firewall say the same thing. For example, PostgreSQL on the database server:

# postgresql.conf
listen_addresses = '10.20.0.14'

# pg_hba.conf — the app server only
host  all  all  10.20.0.15/32  scram-sha-256

sudo ufw allow from 10.20.0.0/24 to any port 5432 proto tcp
sudo ufw deny 5432/tcp

The private network is isolated from other customers, but it is still a network: keep authentication on and treat it as trusted only to the degree you trust your own servers. The UFW article covers the basics.

Between Regions

Ashburn and Dallas each have their own private network. To link servers across regions privately, run a WireGuard tunnel between them over their public addresses.

Common Questions

Who can reach my private address?

Only your own servers in the same region that also have private networking. Traffic is only let through between servers that belong to the same account, so other customers cannot reach your servers and cannot even see that they exist.

Is traffic over the private network counted toward my bandwidth?

No. Traffic between your servers on their private addresses does not count toward either server's monthly bandwidth. You pay only the monthly add-on price for each server that has private networking.

Can servers in Ashburn and Dallas talk privately?

No. Each region has its own private network, so a server in Ashburn and one in Dallas cannot reach each other on private addresses. Use their public addresses with encryption (for example WireGuard) between regions.

Why does adding it restart my server?

The private network card is attached to the server when the platform starts it, so the server needs one restart from the control panel to get it. A reboot from inside the server is not enough. You can choose to restart later; the address works from the first restart.

What happens when I cancel it?

The server is taken off the private network within a minute. Its private network card stays in the operating system until the next restart but carries no traffic.