Networking

Private networks

Servers and VMs get private addresses on your tenant network. Management traffic and workload traffic are kept separate, and nothing is exposed publicly unless you choose to expose it.

Security groups

Security groups work the way you expect from a public cloud: stateful ingress/egress rules attached to servers and VMs, enforced on the hosts themselves. Rules follow the instance — moving or recreating a VM keeps its firewall posture.

Encrypted overlay

Hosts and VMs that can reach your tenant's lighthouse join an encrypted overlay network and reach each other on stable private addresses. Today the lighthouse is reachable only from inside the CloudOps network, so a host at another site cannot join the overlay yet. To connect other sites, use a site-to-site VPN.

Site-to-site VPN

Managed IPsec VPN gateways connect your CloudOps networks to external sites — an office network, another datacenter, or a cloud VPC — with connection status and health visible in the console.