# VPS with a private network

A KVM Linux VPS in New York with a free private network between your servers. Switch it on from the order form and your servers on the same host can reach each other on private addresses that only your account's servers on that host can reach. Private traffic doesn't count toward your monthly transfer allowance, and it's kept separate by its own VLAN, not encrypted. We place servers you order on it together.

Orders are open: create an account at my.rack4.io and order a server.

## What you can buy

- [Budget](https://rack4.io/plans): 1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB transfer. $7.99/month or $84.00/year.
- [Standard](https://rack4.io/plans): 2 vCPU, 4 GB RAM, 80 GB NVMe, 4 TB transfer. $12.99/month or $139.00/year.
- [Extreme](https://rack4.io/plans): 4 vCPU, 8 GB RAM, 160 GB NVMe, 8 TB transfer. $24.99/month or $269.00/year.

Every plan includes:

- KVM virtualization with your own kernel and full root access
- NVMe storage, one IPv4 address (IPv6 pending)
- Ubuntu, Debian, AlmaLinux, Rocky Linux, Fedora and Arch Linux from [official cloud images](https://rack4.io/os)
- A serial console in your browser, snapshots, a firewall and an API

## What you get

- A second network card on each server that joins, with its own address from 10.240.0.0/16 (for example 10.240.0.10).
- Only your account's servers can reach it. Other customers' servers are on networks of their own, and the internet can't reach it at all.
- Free, and not counted: traffic between your servers on it doesn't count towards your [monthly transfer](https://rack4.io/help/monthly-transfer-usage).
- Opt-in per server. A server that doesn't join has no private card.

## Turning it on

- When you order: open Optional on the order form and tick "Join my private network". The server is built on the same host as your other private servers, with its private card, and its address is set up on the first boot, so there's nothing to configure. With several servers on one order, all of them join. In the rare case a server can't be built on it, the server is still built and its activity says so: join it from its Network tab.
- For a server you already have: open it in the panel, go to Network, then Private network, and join. The card is plugged into the running server within a minute, no restart; you add the address once, with the lines the panel shows. It joins your private network on the host it runs on, so it reaches your other servers on that host; the page lists which ones.
- From the API or the CLI: send `"privateNetwork": true` when you create a server, or run `rack4 servers create --private`; `rack4 private on` joins a server you have.

[Connect your servers with a private network](https://rack4.io/help/private-network) walks through each one, with the netplan and NetworkManager lines and how to test it.

## What people use it for

- A website or app on one server talking to its database on another, with the database listening only on its private address.
- Backups and file copies from one server to another, without it counting towards your transfer.
- Small clusters: a load balancer in front of app servers, cache and queue servers, replicas.
- [Moving to a bigger server](https://rack4.io/help/move-to-a-larger-server): copy your data across privately, then switch over.

## Where it reaches, and where it doesn't

It connects your servers on the same host in a location, and we place servers ordered on it together. A server's private network page lists the servers it can reach; it doesn't stretch between hosts or locations. It has no gateway, so nothing on it can reach the internet, and nothing is routed in from outside.

A server restored from a backup or from the recycle bin comes back without its private card: join it again once it's built.

## How it's kept separate

Each account's private network is kept apart by network separation on our host (its own VLAN), not by encryption, and a server can only send from its own private address and card; it can't pretend to be another. Traffic on it isn't encrypted and passes through hardware we run, so use TLS or a WireGuard tunnel on top for passwords, database traffic or anything else sensitive.

The [panel firewall](https://rack4.io/help/server-firewall) covers a server's public address, not the private one. To limit which of your servers can reach a service, use a firewall on the server itself.

## Private network questions

### Does the private network cost extra?

No. It's free on every plan, and traffic on it doesn't count towards your monthly transfer.

### Can other customers see my private network?

No. Each account's servers on a host are on a network of their own. Other customers' servers and the internet can't reach it, and a server can only send from its own private address.

### Is traffic on it encrypted?

No, it's kept separate by its own VLAN, not encrypted. Use TLS or a WireGuard tunnel for anything sensitive.

### Can servers in different locations share it?

No. It connects your servers on the same host, and we place servers you order on it together; each server's private network page lists the servers it can reach.

### Do I have to restart a server to add it?

No. Ordered with "Join my private network" ticked, the server is built on it. A server you already have gets the card plugged in while it runs, and you add the address once.