---
description: Attaching an instance to a private network at deploy time
revision_date: 20.10.2026
---

# Deploy an instance onto a private network

!!! warning "Draft — pilot feature"
    Private Networks is in a limited pilot and this page is a work in progress.

Networking is chosen when the instance is created, in the **Network** step of
the deploy form. It cannot be changed afterwards, an instance stays on the
network, subnet, and address it was deployed with for its whole life.

## Public + Private IP

The instance gets both a private address inside your network and a public IPv4
address, so you can SSH to it directly from the internet.

| Control | What it does |
|---------|--------------|
| **Auto assign public IP** | Verda picks a public IPv4 from its pool. |
| **Manually assign public IP** | *Coming soon.* Use a public IPv4 your project already holds. |
| **Subnet** | Which subnet the private address comes from. **Create new** opens the [subnet dialog](https://docs.verda.com/private-networks/create-a-private-network/#create-a-subnet). |
| **Auto assign private IP** | The next free address in the subnet. |
| **Manually assign private IP** | An address you choose. It must be inside the subnet's CIDR, must not be the network or broadcast address, and must not already be in use. |

!!! info
    The public IP is delivered as **1:1 NAT**, not configured on the instance's
    interface. Inside the instance you will only ever see the private address,
    see [Inside the instance](https://docs.verda.com/private-networks/inside-an-instance/).

## Private IP only

The instance gets no public address at all. Nothing on the internet can reach
it, and it has no outbound internet access until you give the subnet a route.

To reach an instance like this you need one of:

- a **jump host**: another instance on the same private network that does have
  a public IP, which you SSH through;
- your own route: for example a VPN or NAT instance you run on the network.

See [Internet access](https://docs.verda.com/private-networks/internet-access/).

!!! danger "Plan your access before deploying"
    An instance deployed with a private IP only, into a network with no jump
    host and no route, is unreachable.

## Public only (Legacy public networking)

Deploying without asking for a private address gives you an instance with legacy public networking:
one public IP configured directly on the interface without a private network or a
subnet. This is the pre-Private-Networks behavior and remains the default.

Legacy and private-network modes are mutually exclusive per instance.