---
description: Private, isolated IPv4 networks for your Verda instances
revision_date: 20.10.2026
---

# Private Networks

!!! warning "Draft — pilot feature"
    Private Networks is in a limited pilot. It is enabled per project and is only
    offered in some datacenters. Both the feature and this documentation are
    still changing.

A **private network** gives your project its own private IPv4 address space.
Instances attached to it talk to each other over private addresses that are
never routed on the public internet, and are not reachable from any other
customer's network.

This replaces the legacy model, where every instance was assigned a public IP
directly on its network interface and every instance in a project could only
reach other instances over the internet.

## Concepts

| Term | What it is |
|------|------------|
| **Private network** | The top-level container, scoped to one project. |
| **Subnet** | An IPv4 CIDR block inside a private network. Instances take their private IP from a subnet. |
| **Private IP** | The instance's address inside the network. Also called the *overlay IP*. This is the only address configured on the instance's network interface. |
| **Public IP** | Optional. Delivered as 1:1 NAT to the private IP rather than being configured on the interface. |
| **Route** | Sends a subnet's traffic for a destination through one of the network's instances. Today, only `0.0.0.0/0` (internet egress) is supported. |

### Networks and subnets

You can [create](https://docs.verda.com/private-networks/create-a-private-network/#create-a-network) one or more
private networks as you need (e.g. `prod-net`, `staging-net`). For each private network you can create one or more subnets. A
subnet's network address (CIDR format) is chosen when it is created and cannot
be changed afterwards.

### Default network and default subnet

A project can mark one network as its **default**, and one of that network's
subnets as the **default subnet**. When you deploy an instance and ask for
a private address without naming a network or subnet, you get the address from the default subnet.

If your project has no network at all, the first such deploy creates one for you
named `default`, in **auto mode**: its subnet is created on demand, from a
range Verda picks. A network you create
yourself is in **custom mode**, you choose every subnet and every CIDR.

## Availability

- Enabled per project (pilot).
- Enabled per datacenter.

## Next steps

[Create a private network and subnets](https://docs.verda.com/private-networks/create-a-private-network/)

[Deploy an instance onto a private network](https://docs.verda.com/private-networks/deploy-an-instance/)

[Internet access](https://docs.verda.com/private-networks/internet-access/)

[Inside the instance](https://docs.verda.com/private-networks/inside-an-instance/)

[Security model](https://docs.verda.com/private-networks/security-model/)