---
title: "Configure access to and from the internet"
sidebar_label: "Configure access to and from the internet"
sidebar_position: 11
description: "How to configure access to and from the internet for a device via a public floating IP address, public subnet, and how to configure internet access via a cloud router"
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical'
import EditIcon from '@selectel/docux/icons/edit'
import CheckIcon from '@selectel/docux/icons/check'
import CopyIcon from '@selectel/docux/icons/copy'
import { CustomTable } from '@selectel/docux/components';
import CreatePublicSubnet from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/cloud-networks/create-public-subnet.mdx'
import ConnectDirectIpToCloudServer from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/cloud-networks/connect-direct-ip-to-cloud-server.mdx'
import ConnectPrivateSubnetToCloudRouter from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/cloud-networks/connect-private-subnet-to-cloud-router.mdx'
import CreateCloudRouterWithExternalIP from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/cloud-networks/create-cloud-router-with-external-ip.mdx'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Configure access to and from the Internet

For the cloud server, cloud load balancer, and Managed Database cluster, you can configure access to and from the Internet:

* [via a public floating IP address](#internet-access-via-floating-ip);
* [via a direct public IP address](#internet-access-via-direct-ip) — for cloud server only;
* [via a public subnet](#internet-access-via-public-subnet).

If a device only requires Internet access without access from the Internet, you can configure it [via a cloud router](#internet-access-via-cloud-router).

## Select an access method to and from the Internet \{#choose-internet-access-option}

<CustomTable>
  <table>
    <thead>
      <tr>
        <th />

        <th>Public floating IP address</th><th>Direct public IP address</th><th>Public subnet</th><th>Cloud router with Internet connection</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>Internet access</th><td>✓</td><td>✓</td><td>✓</td><td>✓</td>
      </tr>

      <tr>
        <th>Access from the Internet</th><td>✓</td><td>✓</td><td>✓</td><td>✗</td>
      </tr>

      <tr>
        <th>Available for devices</th>

        <td>
          * cloud server;
          * cloud load balancer;
          * Managed Database cluster
        </td>

        <td>
          * cloud server
        </td>

        <td>
          * cloud server;
          * cloud load balancer;
          * Managed Database cluster
        </td>

        <td>
          * cloud server
        </td>
      </tr>

      <tr>
        <th>Minimum number of IP addresses to purchase</th><td>One IP address</td><td>One IP address</td><td>Subnet with size from `/29`</td><td>One external IP address, included in the router cost</td>
      </tr>

      <tr>
        <th>How traffic reaches the device</th><td>To a floating IP address, then NAT 1:1 via a cloud router to the device</td><td>Directly to the port</td><td>Directly to the port</td><td>To the external IP address of the router, then NAT 1:1 via a cloud router to the device</td>
      </tr>

      <tr>
        <th>Available traffic filtering tools</th>

        <td>
          * cloud firewall;
          * security groups;
          * allowed IP/MAC addresses
        </td>

        <td>
          * security groups
        </td>

        <td>
          * security groups;
          * allowed IP/MAC addresses
        </td>

        <td>
          * Cloud firewall
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## Configure access to and from the Internet via a public floating IP address \{#internet-access-via-floating-ip}

To configure access to and from the Internet for devices in a private subnet, you must connect the subnet to a cloud router with Internet access and connect a public floating IP address to the device. The cloud router performs 1:1 NAT via an external IP address, which is allocated when the router is connected to the Internet: it organizes Internet access from the private subnet and handles incoming traffic packets for public floating IP addresses.

You can connect a public floating IP address when [creating a cloud server](/cloud-servers/create/create-server.mdx), [creating a cloud load balancer](/cloud-servers/load-balancers/create-load-balancer.mdx), [creating a Managed Database cluster (example for PostgreSQL](/managed-databases/postgresql/create-cluster.mdx)), and after creation.

The device must be located in a private subnet that meets the requirements. To prepare the subnet, use the [Prepare a private subnet for public floating IP address connection](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx#configure-subnet-for-internet-access) section of the [Public Floating IP Addresses](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx) instruction.

1. [Create a public floating IP address](#create-floating-ip-for-external-access).
2. [Create a cloud router with Internet connection](#create-cloud-router-for-external-access).
3. [Connect the private subnet to the cloud router](#connect-private-subnet-to-cloud-router-for-external-access).
4. [Connect a public floating IP address to the port of the device in the private subnet](#assign-ip-to-port-in-private-subnet-for-external-access).
5. If the subnet gateway does not match the cloud router IP address, [configure a static route to the Internet in the subnet](#public-ip-configure-static-routing-to-internet-on-subnet).

### 1. Create a public floating IP address \{#create-floating-ip-for-external-access}

<Tabs queryString="create-floating-ip-for-external-access">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Network** section → **Public Floating IPs** tab.
    3. Click **Create IP address**.
    4. Select the [location](/infrastructure/locations.mdx) where the public floating IP address will be created.
    5. Specify the number of public floating IP addresses — 1.
    6. Click **Create**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Create a public floating IP address:

       ```bash
       openstack floating ip create external-network
       ```
  </TabItem>
</Tabs>

### 2. Create a cloud router with Internet connection \{#create-cloud-router-for-external-access}

<CreateCloudRouterWithExternalIP />

### 3. Connect a subnet to the cloud router \{#connect-private-subnet-to-cloud-router-for-external-access}

<ConnectPrivateSubnetToCloudRouter />

### 4. Connect a public floating IP address to the device port in the private subnet \{#assign-ip-to-port-in-private-subnet-for-external-access}

<Tabs queryString="assign-ip-to-port-in-private-subnet-for-external-access">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Network** section → **Private networks** tab.
    3. Open the network page → **Ports** tab.
    4. In the cloud server or load balancer port card, click **Connect public IP**.
    5. Select a public floating IP address.
    6. Click **Connect**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Connect the public floating IP address to the port:

       ```bash
       openstack floating ip set --port <port> <floating_ip_address>
       ```

       Specify:

       * `<port>` — the ID of the cloud server or load balancer port; you can view it using the `openstack port list` command;
       * `<floating_ip_address>` — the ID or public floating IP address; you can view it using the `openstack floating ip list` command.
  </TabItem>
</Tabs>

### 5. Configure a static route to the Internet in the subnet \{#public-ip-configure-static-routing-to-internet-on-subnet}

If, when [connecting a subnet to a cloud router](#connect-private-subnet-to-cloud-router-for-internal-access), you specified a router IP address that differs from the subnet gateway, you must [configure a static route](/cloud-servers/cloud-networks/static-routes.mdx#configure-static-routing-on-subnet) to the Internet in the subnet via a cloud router. When configuring, specify:

* destination subnet — `0.0.0.0/0`;
* gateway (next-hop) — cloud router IP address.

## Configure access to and from the Internet via a direct public IP address \{#internet-access-via-direct-ip}

:::info

Direct public IP addresses are unavailable in [pools](/infrastructure/locations.mdx#pool) uz-1 and ke-1.

:::

If your server uses a public floating IP address and you want to switch to a direct public one, use the [Switch a cloud server from a floating public IP address to a direct public IP address](/cloud-servers/cloud-networks/configure-access-to-internet.mdx#change-floating-ip-to-direct-ip) section

<ConnectDirectIpToCloudServer />

## Switch the cloud server from a public floating IP address to a direct public IP address \{#change-floating-ip-to-direct-ip}

:::info

Direct public IP addresses are unavailable in [pools](/infrastructure/locations.mdx#pool) uz-1 and ke-1.

:::

Switching from a [floating](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx) to a [direct public IP address](/cloud-servers/cloud-networks/direct-public-ip-addresses.mdx) will allow you to stop using a cloud router — traffic will go directly to the cloud server port.

Note that:

* The server's IP address will change because floating and direct public IP addresses are allocated from different public ranges;
* you will not be able to use a cloud firewall to filter traffic;
* you will not be able to set allowed IP/MAC addresses for the port. Traffic on a port with a public direct IP address can only be sent from a single IP/MAC address pair.

To switch to a direct public IP address:

1. [Connect a direct public IP address to the cloud server](#connect-direct-ip-to-server).
2. If you had security groups configured other than the [default group](/cloud-servers/security-groups/about-security-groups.mdx#default-security-group), [assign them to the new port](#assign-security-groups-to-new-port).
3. [Change the default gateway on the cloud server](#change-default-gateway-on-server).
4. Optional: [check Internet access to and from the Internet](#check-internet-access).
5. Optional: [delete the cloud router](#delete-cloud-router).
6. Optional: [delete the public floating IP address](#delete-floating-ip).

### 1. Connect a direct public IP address to the cloud server \{#connect-direct-ip-to-server}

<ConnectDirectIpToCloudServer />

### 2. Assign security groups to the new port \{#assign-security-groups-to-new-port}

<Tabs queryString="assign-security-groups-to-new-port">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/servers/list/), on the top menu, click **Products** and select **Cloud Servers**.
    2. In the **Servers** section, open the server page → **Ports** tab.
    3. In the old port card, check the list of security groups in the security group field.
    4. In the new port card, in the security groups field, click <EditIcon />.
    5. In the **Security Groups** field, select the groups that were assigned to the old port.
    6. Click **Save**.
  </TabItem>
</Tabs>

### 3. Change the default gateway on the cloud server \{#change-default-gateway-on-server}

<Tabs queryString="change-default-gateway-on-server">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/vpc/default/servers/list/), on the top menu, click **Products** and select **Cloud Servers**.
    2. In the **Servers** section, open the server page → **Ports**.
    3. In the <MoreVerticalIcon /> port menu, select **Set subnet gateway as default**.
    4. [Update the network settings on the server](/cloud-servers/cloud-networks/update-network-settings.mdx#configure-static-routing).
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Configure the default gateway for the cloud server:

       ```bash
       openstack server set \
         --property x_sel_server_default_addr='{"ipv4":"<gateway>"}' \
         <server>
       ```

       Specify:

       * `<gateway>` — the gateway of the service subnet where the direct public IP address is located. You can view it in the control panel: on the top menu, click **Products** → **Cloud Servers** → server page → **Ports** tab → port card → in the **Gateway** field, click <CopyIcon />;
       * `<server>` — the ID or name of the cloud server; you can view it using the `openstack server list`.

    3. [Update the network settings on the server](/cloud-servers/cloud-networks/update-network-settings.mdx#configure-static-routing).
  </TabItem>
</Tabs>

### 4. Optional: check Internet access to and from the Internet \{#check-internet-access}

1. Open the CLI.

2. Check server availability by the new IP address:

   ```bash
   ping <direct_public_ip>
   ```

   Specify `<direct_public_ip>` — the direct public IP address that you [connected to the server](#connect-direct-ip-to-server).

3. Connect to the server.

4. From the server, check availability of any public IP address, for example:

   ```bash
   ping 8.8.8.8
   ```

### 5. Optional: delete the cloud router \{#delete-cloud-router}

You can delete a cloud router if it was used only for Internet access. Use the [Delete cloud router](/cloud-servers/cloud-networks/cloud-routers.mdx#delete-cloud-router) subsection of the [Cloud Routers](/cloud-servers/cloud-networks/cloud-routers.mdx) guide.

### 6. Optional: delete the public floating IP address \{#delete-floating-ip}

After deletion, the public floating IP address will return to the pool of public addresses. You will not be able to purchase the same floating IP address again.

Use the [Delete public floating IP address](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx#delete-public-floating-ip) subsection of the [Public floating IP addresses](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx) guide.

## Configure access to and from the Internet via a public subnet \{#internet-access-via-public-subnet}

To configure access to and from the Internet via a [public subnet](/cloud-servers/cloud-networks/public-subnets.mdx), you need to connect the device to the public subnet. For a load balancer and a Managed Database cluster, this can only be done when [creating a load balancer](/cloud-servers/load-balancers/create-load-balancer.mdx) and [creating a cluster (example for PostgreSQL](/managed-databases/postgresql/create-cluster.mdx)). A cloud server can be connected to the public subnet either when [creating the server](/cloud-servers/create/create-server.mdx), or after it has been created — to do this, you need to add the cloud server to the public subnet via a port.⁠

1. [Create a public subnet](#create-public-subnet).
2. [Add the cloud server to the public subnet via a port](#add-cloud-server-to-subnet-via-port).

### 1. Create a public subnet \{#create-public-subnet}

<CreatePublicSubnet />

### 2. Add the cloud server to the public subnet via a port \{#add-cloud-server-to-subnet-via-port}

<Tabs queryString="add-cloud-server-to-subnet-via-port">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/vpc/default/servers/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Open the server page → **Ports**.
    3. Click **Add port**.
    4. Select a public subnet.
    5. Enter the port IP address.
    6. Click **Add port**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Create a port in the public subnet:

       ```bash
       openstack port create \
         --network <subnet> \
         --fixed-ip subnet=<subnet>,ip-address=<port_ip_address> \
         <port_name>
       ```

       Specify:

       * `<subnet>` — the ID or name of the public subnet; you can view it using the `openstack network list`;
       * `<port_ip_address>` — the port IP address;
       * `<port_name>` — the port name.

    3. Add a port to the cloud server:

       ```bash
       openstack server add port <server> <port>
       ```

       Specify:

       * `<server>` — the ID or name of the cloud server; you can view it using the `openstack server list`;
       * `<port>` — the ID or name of the port; you can view it using the `openstack port list`.
  </TabItem>
</Tabs>

## Configure Internet access via a cloud router \{#internet-access-via-cloud-router}

You can configure Internet access for devices in a private subnet without external access from the Internet.

To do this, you need to connect a cloud router with internet access to the private subnet where the device is located. If the cloud router is connected to the internet, it performs 1:1 NAT for access from the private network to the internet via the router's external IP address. The external address is used only for device access to the internet; it cannot be used to connect to devices in the subnet.

1. [Create a cloud router with Internet access](#create-cloud-router-for-internal-access).
2. [Connect the private subnet to the cloud router](#connect-private-subnet-to-cloud-router-for-internal-access).
3. If the subnet gateway does not match the cloud router IP address, [configure a static route to the Internet on the subnet](#router-configure-static-routing-to-internet-on-subnet).

### 1. Create a cloud router with Internet connection \{#create-cloud-router-for-internal-access}

<CreateCloudRouterWithExternalIP />

### 2. Connect a subnet to the cloud router \{#connect-private-subnet-to-cloud-router-for-internal-access}

<ConnectPrivateSubnetToCloudRouter />

### 3. Configure a static route to the Internet in the subnet \{#router-configure-static-routing-to-internet-on-subnet}

If, when [connecting the subnet to the cloud router](#connect-private-subnet-to-cloud-router-for-internal-access), you specified a router address that is different from the subnet gateway, you must [configure a static route on the subnet](/cloud-servers/cloud-networks/static-routes.mdx#configure-static-routing-on-subnet) to the Internet via the cloud router. When configuring, specify:

* destination subnet — `0.0.0.0/0`;
* gateway (next-hop) — cloud router IP address.

<Formbricks />