VPCs and subnets

#What a VPC is

A VPC is a private network. Virtual machines in it talk to each other over private addresses, and reach the internet through the VPC.

• A VPC is divided into subnets. Every VM in a VPC lives in one subnet, chosen when it is created, for its whole life.
• Each subnet has a network ACL, which acts as the firewall for every VM in it.
• A VM in a VPC has no public address of its own. To reach it from the internet, give it a static IP, forward a port to it, or put it behind a load balancer.
• A VPC cannot span regions, and a standard VPS cannot join one.

A VPC costs ₦5,000 a month, excluding VAT, billed by the hour for as long as it exists; subnets are free. Each VPC also takes one of the region's few public addresses for its outbound traffic, so plan on one VPC per environment (production, staging and so on) rather than one per machine.

#Plan the address range

A VPC's range is written in CIDR form, like 10.3.0.0/16.

• Private ranges only: inside 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16.
• Between a /24 and a /16: from 256 to 65,536 addresses.
• Leave room. Subnets are carved out of this range and cannot overlap, so a /16 with /24 subnets gives you plenty of space to grow.

Each subnet must sit inside the VPC's range, be at least a /28, and start on its own boundary: 10.3.1.0/24, not 10.3.1.5/24. Five addresses in every subnet are reserved, the gateway among them, so a /24 has 251 usable.

#Create a VPC

Go to VPCs and press Create VPC.

1. Name the VPC, like production.
2. IPv4 CIDR block: the whole range, like 10.3.0.0/16. A preview shows how much of it the first subnet will use.
3. First subnet name and First subnet block: like app and 10.3.1.0/24. The form tells you how many usable addresses it holds.

The summary shows the region, the range and the cost. Press Create VPC. The VPC's page follows the build and fills in when it is ready.

#Add a subnet

Put machines with different exposure in different subnets, since every VM in a subnet shares its network ACL: web for machines the internet reaches, db for ones it should not.

On the VPC's page, press Add subnet, give it a name and a block inside the VPC's range that does not overlap another subnet, and confirm.

A new subnet lets ping in and everything out. All other inbound traffic is blocked until you add rules to its network ACL.

#Launch a machine into a subnet

On the create form, choose VM in a VPC, then under Network pick the VPC and the subnet. The machine gets a private address from the subnet and keeps it for life.

#What the pages show

• VPCs lists each VPC with its range, status, region and how many machines it holds.
• A VPC's page maps how its range is allocated to subnets, and lists the subnets with their range, usable addresses, gateway and machines.
• A subnet's page shows its addresses (reserved, in use and free), which machine holds each one, and its network ACL.

#Where is port forwarding configured?

Port forwarding is managed per public IP address, rather than on the VPC network itself. To expose private VMs or Kubernetes worker nodes in a VPC to the internet:

1. Go to Network → Static IPs in the sidebar.
2. Press Reserve static IP and select Shared, with port forwarding.
3. Open the reserved address and press Add forward to map a public port (such as 2222 or 8080) to the VM's private IP and port.
4. Ensure the VM's subnet network ACL permits inbound traffic on the private port.

See Static IPs and port forwarding for full configuration details.

#Delete a subnet or a VPC

• A subnet can be deleted from its page once no machine uses it and no Kubernetes cluster runs in it. Destroy or move the machines and delete the clusters first; a subnet that still has clusters is refused with 409 SUBNET_HAS_KUBERNETES_CLUSTERS.
• A VPC can be deleted once it has no subnets. Its public address goes back to the pool. This cannot be undone.