Private networks
Create isolated regional networks, subnets, routes, and droplet interfaces.
Private networks connect droplets within a project and region. Subnets allocate addresses; routes determine destinations; firewall policies determine which traffic is permitted.
Create a network
Open Networking → Networks → Create network and select the project and region. Add at least one subnet before attaching a droplet. IPv4 and IPv6 can be enabled independently when supported by the region.
Create the network without assuming public egress. Add subnets for each required address family. The network starts without external routes; use an explicit gateway or approved peering for another routing domain.
DNS defaults to the regional resolver configuration. Custom resolver addresses and search domains must be reachable from the intended guest path. Saving them does not rewrite manually configured resolver files inside unsupported images.
The Network API creates the routing domain; Subnet API allocates ranges separately. A region cannot change after creation.
Subnet host bits must be zero in a CIDR declaration. Overlapping subnets in the same routing domain are rejected. Isolated networks can reuse a private range, but peering or external routing later requires a non-overlapping address plan.
Address allocation
Infra reserves infrastructure addresses and allocates the remaining addresses to interfaces. The subnet page shows usable capacity and reserved addresses. Request a specific address only when it is free and inside the usable range; an invalid or already reserved address is rejected.
Addresses remain reserved while an interface exists, including when its droplet is stopped. Deleting an interface releases its reservation after network cleanup. Do not use a released address as a durable workload identity.
Attach interfaces
Select the network during droplet creation or use Droplet → Networking → Add interface. The network must belong to the same project and region. Hot attachment requires hypervisor and guest support; otherwise stop the droplet first.
Infra configures the virtual interface and metadata. The guest must apply its address, routes, and DNS settings. An interface shown as attached does not prove that the guest has configured it.
Routes and connectivity
The network contains routes to its own subnets. Use route tables for explicit next hops, egress gateways for outbound translation, and peering for a consented connection to another project network. A route target must be reachable and permitted by region policy. Routes do not bypass firewalls.
A network does not span regions by default. Mesh networking provides the node transport within a region; it is not a project-level grant of connectivity to every other network. Inter-region connectivity requires a configured gateway and an address plan suitable for both sides.
Modify or delete
Add a new subnet when a network needs more addresses. An occupied subnet cannot be replaced with a different range. Move interfaces through an explicit readdressing plan and update DNS and application configuration before removing the old range.
Deletion is blocked by interfaces, load balancers, gateways, or route dependencies. The review lists their IDs. Removing an empty network does not release separately reserved public addresses.
For connection failures, compare interface state, guest routing, firewall attachments, and path MTU in Troubleshooting.