# Connect your servers with a private network

> A private network between your Rack4 servers in one location, for databases, backups and moves. Nobody else can reach it, and it is free.

Source: https://rack4.io/help/private-network · Updated: 2026-11-06

Turn on the private network on each server that should be on it: open the server in the panel, go to **Network**, then **Private network**, and choose **join the private network**. Each server gets a second network card with an address like `10.240.0.10`, and your servers can then reach each other on those addresses.

## What it is

- **Only your servers.** Each account's servers in a location share a network of their own. Other customers' servers and the internet can't reach it, and the host itself takes no part in it.
- **Same location.** Servers in the same location can join; the panel lists your other servers on it.
- **Free, and not counted.** Traffic on it doesn't count towards your [monthly transfer](https://rack4.io/help/monthly-transfer-usage).
- **No restart.** The card is plugged into the running server. A server that's off gets it when it next starts.

Good uses: a website talking to its database on another server, backups from one server to another, and [moving to a bigger server](https://rack4.io/help/move-to-a-larger-server).

## Turn it on

In the panel: the server, then **Network**, then **Private network**, then **join the private network**. It's plugged in within a minute. The page then shows the server's private address and network card, and the lines to set it up.

From the command line:

```bash
rack4 private on web-1
rack4 private status web-1
```

Or with the API: `PUT /servers/:id/private-network` with `{"enabled": true}`.

## Set the address up on the server

The card arrives without an address; you add it once. Open the [serial console](https://rack4.io/help/serial-console) first, so a mistake can't lock you out of SSH. The panel shows these lines with your server's own address and card filled in.

**Ubuntu and most Debian images** (netplan: `ls /etc/netplan` shows a file). Save this as `/etc/netplan/60-rack4-private.yaml`, with your address and, for `<mac>`, the network card's MAC from the panel, keeping the indentation exactly as shown:

```yaml
network:
  version: 2
  ethernets:
    private:
      match:
        macaddress: "<mac>"
      addresses:
        - 10.240.0.10/16
```

Then:

```bash
sudo chmod 600 /etc/netplan/60-rack4-private.yaml
sudo netplan try
```

`netplan try` puts the network back if you don't confirm within two minutes, but it leaves the file in place: if something went wrong, delete the file before you try again.

**AlmaLinux, Rocky and Fedora** (NetworkManager: `nmcli general` answers). With your address, and the card's MAC for `<mac>`:

```bash
IF="$(ip -o link | awk -F': ' '/<mac>/ {print $2}')"
sudo nmcli con add type ethernet con-name rack4-private ifname "$IF" ipv4.method manual ipv4.addresses 10.240.0.10/16 ipv6.method disabled
sudo nmcli con up rack4-private
```

## Check it works

On the server, `ip -br addr` lists the private address. Then ping another of your servers on its private address:

```bash
ping -c 3 10.240.0.11
```

If it doesn't answer, check that the other server has joined and has its address set up too.

## Security

- Only your own servers can reach a private address. Nothing is routed off the private network: it has no gateway, so it can't reach the internet either.
- The [panel firewall](https://rack4.io/help/server-firewall) covers your server's public address, not the private one. To limit which of your servers can reach a service, use a firewall on the server itself.
- A server can only send from its own private address and card; it can't pretend to be another.

## Turn it off

Choose **leave the private network** on the same page, or run `rack4 private off web-1`. The card is unplugged; anything using the private address stops working. Delete the netplan file (or `sudo nmcli con delete rack4-private`) afterwards.

A server restored from the recycle bin comes back without its private network: join again if you need it.