Private networks and subnets of a dedicated server

A private (local) network is an isolated network within a single data center, without internet access, used to connect servers with each other. In a single pool, all servers (except some Chipcore Line servers) are joined into a private network at the L2 layer via Selectel switches.

Traffic in a private network is not charged.

If only one dedicated server is ordered on an account, a private network VLAN is not allocated. A private network VLAN is automatically allocated when ordering a second and subsequent dedicated servers on the account. One private network VLAN is allocated per account in one pool. If you need a private network VLAN, for example, to configure connectivity with a firewall or a cloud server, create a ticket.

You can view which VLAN is assigned to a port in the control panel: in the top menu, click Products → Dedicated Servers → Servers → server page → Ports tab.

To establish network connectivity between dedicated servers located in the same pool, specify the same VLAN on the private port of each server and configure addressing on the network interfaces in the server OS.

To establish network connectivity between dedicated servers in different pools or with other Selectel products, use Selectel Global Router.

When you configure a private network interface on the server, the assigned subnet and IP address are not added to the control panel. You can manually add a private subnet to the control panel to keep track of IP addresses and monitor used ones.

If you add or change the server's private IP address in the control panel, this will not affect the network interface settings; you must change them on the server yourself.

The network interface for a private network will be configured automatically only during OS autoinstallation based on Linux. For Windows OS, you can configure the private network interface only manually.

Private IP addresses

Private IP addresses are formed from standard ranges.

Servers with these addresses are not directly accessible from the internet.

If traffic is exchanged within a single private subnet, the traffic within it is not metered.

Standard private IP address ranges

10.0.0.0 — 10.255.255.255 (subnet mask: 255.0.0.0 or /8);
100.64.0.0 — 100.127.255.255 (subnet mask 255.192.0.0 or /10) — this subnet is recommended according to RFC 6598 for use as addresses for CGN (Carrier-Grade NAT);
172.16.0.0 — 172.31.255.255 (subnet mask: 255.240.0.0 or /12);
192.168.0.0 — 192.168.255.255 (subnet mask: 255.255.0.0 or /16).

Assign a private IP address to a server

If you add or change the server's private IP address in the control panel, this will not affect the network interface settings; you must change them on the server yourself.

The network interface for a private network will be configured automatically only during OS autoinstallation for Linux. For Windows OS, you can configure the private network interface only manually.

You can add private IP addresses to the control panel only for pre-configured servers with the 1 Gbps Private Network option available.

Add a private subnet to the control panel.
Add a private IP address to the accounting system.
Change network settings on the server.

1. Add a private subnet to the control panel

In the control panel, in the top menu, click Products and select Dedicated Servers.
Go to the Network section → Private Subnets tab.
Click Add private subnet.
Select a region.
Select a pool.
Select a VLAN.
In the CIDR field, enter a subnet from the private subnet range.
Click Create.

2. Add a private IP address to the accounting system

In the control panel, in the top menu, click Products and select Dedicated Servers.
In the Servers section, open the server page → Network tab.
In the Private block, click Add IP address.
Select a private subnet.
Enter an IP address.
Click .

3. Change the network settings on the server

If you have not changed the network interface settings on the server, configure the private network interface on the server.

Private networks in Global Router

When connecting a private network to a global router, all subnets belonging to this network will be connected to it. All subnets will communicate at the L3 level.

The private subnet will have the Global Router tag. Three service ports for network equipment will be automatically reserved in the subnet.

You can manage the network and subnets connected to the global router only in the global router section of the control panel: in the top menu, click Products → Global Router.

A private subnet with the Global Router tag cannot be deleted while it is connected to a global router. To delete a private subnet connected to a global router, disconnect the subnet from the global router.

Connect a private network to Global Router

Create a global router.
Connect networks and subnets to the global router.

1. Create a Global Router

In the control panel, in the top menu, click Products and select Global Router.
Click Create router. Each account has a limit of five global routers.
Enter the router name.
Click Create.
If the router was created with the status ERROR or is stuck in one of the statuses, create a ticket.

2. Connect networks and subnets to Global Router

You can connect a new network to the router or an existing network if it is not already connected to any of the account's global routers.

In the Control panel, from the top menu, click Products and select Global Router.
Open the router page → Networks tab.
Click Create network.
Enter a network name. It will only be used in the control panel.
Select the Servers and hardware service.
Select the location of the network.
Select or enter a VLAN.
If you want to create a network to an internal segment (Q-in-Q), specify its tag — a number from 2 to 4094. If a network already exists for the VLAN, you must specify the Q-in-Q segment of this VLAN.
Enter a subnet name. It will only be used in the control panel.
Enter the CIDR — the IP address and mask of the private subnet. You can enter a new subnet or an existing private server subnet if it has not yet been added to any of the global routers in the account. The subnet must meet the following conditions:
- belong to the RFC 1918 private address range: 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16;
- have a size of at least /29, because three addresses will be occupied by Selectel network equipment;
- do not overlap with other subnets added to this router — there must be no identical IP addresses within subnets on the same router;
- if a Managed Kubernetes cluster on cloud servers is connected to the global router network, the subnet must not overlap with the ranges 10.10.0.0/16, 10.96.0.0/12, 10.250.0.0/16, and 10.251.0.0/24. If a cluster on dedicated servers is connected to the network — with the ranges 10.10.0.0/16, 10.222.0.0/16, 10.250.0.0/16, 10.251.0.0/24, and 172.250.0.0/14. These subnets are used in Managed Kubernetes internal addressing, and their use may lead to conflicts in the global router network.
Enter the gateway IP or leave the first address from the subnet, which is assigned by default. Do not assign this address to your devices to avoid network disruption.
Enter the service IPs or leave the last addresses from the subnet, which are assigned by default. Do not assign these addresses to your devices to avoid network disruption.
Click Create network.
Optional: check the network topology on the global router. In the Control panel, from the top menu, click Products → Global Router → router page → Network map.
If you specified a Q-in-Q tag in step 8, enable Q-in-Q on the switch port and configure the network interface of the private network specified in step 10. Learn more in the Configure Q-in-Q section of the Q-in-Q instructions.

Disconnect a private network from Global Router

In the control panel, in the top menu, click Products → Global Router.
Open the router page → Networks tab.
In the network menu, select Delete network.
Enter the network name to confirm the network deletion.
Click Delete. Do not close the window until the network is deleted. After deletion, the Global Router tag will be removed from the private subnet and the addresses reserved for network equipment will be deleted.