Skip to content

Private Network (VLAN) Between Your VMs

A private VLAN gives your own VMs a private layer-2 network that never touches the public internet. Use it for database replication, backend traffic, clustering, or anything that should not cross the public interface.

VLANs are free. The VLANs themselves and all traffic over them cost nothing.

Panel: VPS/Cloud > VLANs

What you get

Attaching a VM to a VLAN adds a second network card to it. Your existing public card is untouched and keeps handling all internet traffic.

This card has no internet and no DHCP

The private card runs on separate physical cabling. It carries no WAN traffic, has no DHCP and no IP address until you assign one inside the guest OS.

We plug in the cable. You configure the interface.
Cost Free, including all traffic
Quota 5 VLANs per account
VLAN tag Assigned automatically
VMs per VLAN No limit
VLANs per VM One
Reboot needed No, the card is hot-plugged and appears immediately

Step 1: Create the VLAN

Go to VPS/Cloud > VLANs, type a note describing what it is for (for example database backend), and click Create. The tag is assigned for you.

Step 2: Attach your VMs

Use + Add VM on the VLAN's row and pick the VMs.

All VMs on a VLAN must be in the SAME location

Each location has its own separate fabric. A VM in Portugal and a VM in Prague can never reach each other, even though the panel will happily show both as attached to the same VLAN.

If your VMs cannot ping each other, check this first. It is the most common cause.

Choosing which VLAN a VM joins

If you have more than one VLAN, always attach from the + Add VM button on the VLAN you want. The shortcut on the VM's own page always joins your lowest-numbered VLAN.

Step 3: Configure the address inside each VM

Pick any private range you like, for example 192.168.100.0/24, and give each VM a different address in it. Leave the gateway empty on this interface.

The new interface is the one with no IP address, usually ens19.

Linux with netplan (Ubuntu)

# 1. Find the new interface: it is the one without an IP address
ip -br link

# 2. Create /etc/netplan/60-vlan.yaml (replace ens19 with your interface)
network:
  version: 2
  ethernets:
    ens19:
      addresses: [192.168.100.11/24]

# 3. Apply
netplan apply

\"Cannot call openvswitch: ovsdb-server.service is not running\"

You will see this line after netplan apply. Ignore it. Your configuration was applied.

Netplan checks for Open vSwitch every time it runs and prints this when it is not there. Our images do not ship Open vSwitch and do not need it.

Confirm the address really landed with:

ip -br addr show ens19

You should see the interface UP with the address you set.

Linux with /etc/network/interfaces (Debian, classic)

# 1. Find the new interface
ifconfig -a

# 2. Quick test (gone after reboot)
ifconfig ens19 192.168.100.11 netmask 255.255.255.0 up

# 3. Make it permanent: add to /etc/network/interfaces
auto ens19
iface ens19 inet static
    address 192.168.100.11/24

# 4. Bring it up
ifup ens19

Windows

# 1. Find the new adapter: PowerShell as Administrator,
#    it is the one showing no IPv4 address
Get-NetAdapter
Get-NetIPAddress -AddressFamily IPv4

# 2. Assign the address (adjust the alias to what step 1 showed)
New-NetIPAddress -InterfaceAlias "Ethernet 2" `
  -IPAddress 192.168.100.11 -PrefixLength 24

Prefer clicking? Network Connections, right-click the new adapter, Properties, IPv4, set the static IP. Leave the gateway empty.

Then test

Repeat on each attached VM with a different last octet (...100.12, ...100.13) and ping between them.

MTU

Leave it alone. The private interface comes up at MTU 1400 automatically, which is correct.

Do not raise the MTU to 1500

The private fabric cannot carry 1500-byte frames. Large packets will disappear silently: ping works, file transfers and database connections hang.

Cannot ping between your VMs?

Work through these in order.

  1. Are all the VMs in the same location? Different locations cannot reach each other. This is the usual cause.
  2. Did you assign an IP inside every guest? The card is inert until you do.
  3. Does each VM have a different address in the same subnet? Two VMs on the same address is a common slip.
  4. Is a guest firewall blocking it? ufw, firewalld and Windows Firewall all block unknown subnets by default. Allow your private range.
  5. Did you set a gateway on the private interface? Do not. It has none, and setting one can break your internet access.

Detaching and deleting

  • Detaching one VM removes its private card.
  • Deleting a VLAN detaches it from every VM on it.

Clean up the guest configuration yourself

Removing the card does not touch your operating system. Delete the interface from your own netplan / /etc/network/interfaces / NetworkManager configuration as well.

If you leave it behind, the guest may stall at boot waiting for an interface that is no longer there.

Isolation

Your VLAN is yours. VMs belonging to another customer cannot be joined to it, and traffic on your VLAN is not visible to other tenants.

Limits

  • 5 VLANs per account. To create another, delete one first.
  • A VM can be on one VLAN at a time. Detach it before moving it to another.
  • All VMs on a VLAN must be in one location.
  • No internet access over the private card, by design.