General information about Public Cloud networks

Last update: November 03 2026Open in Markdown

All virtual machines can be connected to private and public networks.

Public Cloud clusters are hosted on two network infrastructure types. Depending on this, different methods for configuring internet access are available.

Network infrastructure types

A Public Cloud cluster can be hosted on the legacy (NSX-V) or new (NSX-T) network infrastructure. The network architecture type affects supported functionality, methods for configuring internet access, available features, and more.

You can check the network infrastructure type used in clusters in the Clusters section of the VMware-based Public Cloud product overview guide.

	NSX-V (legacy type)	NSX-T (new type)
Network types	private networks, including the preconfigured default_net network; Direct Connected subnets	private networks, including the preconfigured default_net network; public subnets
Connecting VMs to the internet with NAT	Via a private network and Edge Gateway	Via a private network and Edge Gateway
Connecting VMs to the internet without NAT	Via a Direct Connected subnet. The VM receives a public IP address directly; traffic does not pass through the client's Edge Gateway	Via a public subnet. The VM receives a public IP address directly, but the subnet is connected to the Edge Gateway
Connecting VMs to the internet without an Edge Gateway and Firewall	Via a Direct Connected subnet	✗
Traffic filtering between external and internal networks (North-South)	Via Firewall on the Edge Gateway	Via Firewall on the Edge Gateway
Traffic filtering between internal networks (East-West)	Via Firewall on the Edge Gateway	Via Distributed Firewall
Available VPN types	IPsec VPN, SSL VPN, L2 VPN	IPsec VPN
Edge Gateway size	You can select the size and change it	The size cannot be selected
Edge Gateway redundancy	High Availability (can be configured)	Active-Standby (used by default)
Load balancing technology	NSX Edge Load Balancer	NSX Advanced Load Balancer

Private network

A network can be available within a virtual data center or a group of them and can be of one of the following types:

• Routed — a private network that connects virtual machines in a virtual data center to the Edge Gateway. Available from the internet if NAT rules are configured. When a virtual data center is created, the preconfigured default_net network of type Routed is created automatically;
• Isolated — a private network that connects virtual machines to each other. It is available only within a virtual data center and is not accessible from the internet. You can share this network between virtual data centers within an organization, see Create a shared network between virtual data centers for details.

Preconfigured private network default_net

The preconfigured private network default_net is created automatically when creating the first virtual data center and Edge Gateway in a location. You can use it to connect virtual machines to the internet.

Characteristics of the default_net network:

• static IP pool: 10.0.0.101 – 10.0.0.132;
• DNS: Primary DNS 188.93.16.19 and Secondary DNS 188.93.17.19;
• the network has internet access: it is connected to an Edge Gateway with configured NAT and Firewall rules;
• a DHCP server with an address pool of 10.0.0.2 – 10.0.0.100 is running on the network's Edge Gateway.

Public subnets

• Direct Connected subnet — used for clusters on the legacy network architecture type (NSX-V). Allows configuring internet access without using an Edge Gateway, NAT, or Firewall configuration; learn more in the Connection via Direct Connected subnet section;
• public subnet — used for clusters on the new network infrastructure type (NSX-T). Allows configuring internet access via an Edge Gateway with Firewall configuration and without NAT configuration; learn more in the Connection via public subnet section.

Internet access

Virtual machines can be connected to the internet using one of two schemes depending on the network infrastructure type.

Legacy type (NSX-V)

	Edge Gateway and private subnet (by default)	Direct Connected subnet
Edge Gateway required	✓	✗
NAT configuration required	✓	✗
Firewall configuration required	✓	✗

New type (NSX-T)

	Edge Gateway and private subnet (by default)	Public subnet
Edge Gateway required	✓	✓
NAT configuration required	✓	✗
Firewall configuration required	✓	✓

Connection via Edge Gateway and private network

An Edge Gateway is a software router through which virtual machines access the internet. Virtual machines in a virtual data center are connected by a private network that connects to the Edge Gateway, and the Edge Gateway connects to the internet.

When the first virtual data center in a location is created, an Edge Gateway is automatically created with the preconfigured default_net private network and basic Firewall and NAT rules; learn more in the Edge Gateways guide. You can add private networks to the Edge Gateway, configure Firewall rules and NAT rules for SSH/RDP access. Additionally, you can configure VPN and load balancing.

Connection via Direct Connected subnet

For your information

Connection via a Direct Connected subnet is available only in clusters on the legacy network infrastructure (NSX-V).

A Direct Connected subnet is a subnet with public addressing that is connected to the global Internet and added to a virtual data center directly without using the client's Edge Gateway. Virtual machines connect directly to the subnet and receive IP addresses from this network. Connecting VMs to the internet via a Direct Connected subnet does not require configuring Firewall or NAT.

If the VMware Tools utility (the open-vm-tools package) is installed inside the virtual machine and network interface, the IP address will be added automatically during VM build.

A Direct Connected subnet can contain from 5 to 253 IPv4 addresses. The limit for Direct Connected subnets is five per organization. To increase the limit, create a ticket.

Learn more about working with Direct Connected subnets in the Manage Direct Connected subnets guide.

Connection via Edge Gateway and public subnet

For your information

Connection via an Edge Gateway and a public subnet is available only in clusters on the new network infrastructure (NSX-T).

A public subnet is a subnet with public addressing that is connected to the global Internet and added to a virtual data center through the client's Edge Gateway. Virtual machines connect to the public subnet and receive IP addresses from it.

By default, traffic through a public subnet is blocked; to access the internet, you must configure Firewall on the Edge Gateway.

Blocked ports

To protect the Selectel infrastructure from malicious network activity, we have blocked certain ports, including port 25 (email mailings).

If the port is not subject to these restrictions, check its availability from the OS side using the Nmap utility.