Networking | Gewape Cloud Platform Help Center

Networking explained

Everything your servers do on the network is set up under Networking in the console. It looks like a lot of separate pages, but they fit together simply. - Private Networks are the internal networks your servers talk on. Every project gets one by default. - Cloud Routers connect a private network to the internet and to other networks. - Public IPs (Floating IPs) are the public addresses you attach to a server so the outside world can reach it. - Security Rules are the per-server firewall that decides which ports are open. - Firewall Rules are an optional network-wide firewall on top of that. - Load Balancers spread traffic across several servers. - VPN as a Service links your own office or another network privately to your cloud. - Network QoS limits bandwidth where you need to. - Network Map draws the whole thing so you can see how it connects. A typical setup is: servers on the default private network, a router giving them internet access, a public IP on the servers that need to be reachable, and security rules opening just the ports you use. Start with Private networks and subnets and Public IPs.

Last updated on Jul 14, 2026

Create a private network and subnet

A Private Network is an internal network your servers use to talk to each other. Every project already has one, so you only create your own when you want to separate workloads. A network needs a subnet (its range of addresses) before servers can use it. Create the network and subnet 1. Open Networking, then Private Networks, and create a network. 2. Give the Network a name, then define its first subnet: - Subnet Name: a name such as app-subnet. - IP Version: IPv4 for almost everyone. - CIDR: the address range, for example 10.0.0.0/24. This gives you 254 usable addresses. - Gateway IP: leave it to be assigned automatically, or set one. Tick Disable Gateway only for an isolated network with no route out. - DHCP: leave enabled so servers get an address automatically when they boot. - Allocation Pools (optional): limit which addresses in the range DHCP hands out. 3. Create it. Use it When you launch a server, select this network in the Network Config step. Servers on the same network reach each other directly by their private addresses. For the network to reach the internet, connect it to a Cloud Router. To reach a server on it from outside, give the server a public IP.

Last updated on Jul 14, 2026

Create a Cloud Router

A Cloud Router connects a private network to the internet and to other networks. Without one, servers on a private network can talk to each other but cannot reach the internet. The default network already has a router; you create your own when you build custom networks. Create the router 1. Open Networking, then Cloud Routers, and create a router. 2. Fill in: - Name: for example main-router. - External Gateway: set this to the region's external network. This is what gives connected servers outbound internet access. Leave it off only for a router that just joins internal networks. 3. Create it. Connect your networks A router does nothing until you attach subnets to it. 1. Open the router and add an interface for each private subnet it should serve. 2. Choose the subnet and confirm. Once a subnet is attached to a router that has an external gateway, servers on it can reach the internet outbound. Inbound access still needs a public IP and open security rules. To see how your networks and routers connect, open the Network Map.

Last updated on Jul 14, 2026

Public IPs (Floating IPs)

A Public IP, also called a Floating IP, is an address the internet can reach. Servers sit on a private network by default and have no public address until you attach one. You manage these under Networking, then Public IPs. The address is "floating" because it belongs to your account, not to a particular server. You can move it from one server to another, which is handy when you rebuild a server but want to keep the same address. Attach a public IP The quickest way is from the server itself: 1. Open Cloud Servers, click your server, and choose Associate Floating IP. 2. Pick a spare address or click Allocate IP to get a new one, then associate it. You can also allocate and manage addresses directly under Public IPs. Remember that a public address alone does not let traffic in; you still need to open the ports you want to use. A Floating IP costs a small amount while it is allocated to you, attached or not, so release any you are not using. See Delete things to stop charges.

Last updated on Jul 14, 2026

Security Rules (the firewall around each server)

Security Rules are the firewall that sits around your servers. They are organised into security groups, which are named sets of rules you attach to servers. This is how you decide which ports are reachable and from where, and it is the most common networking task, so it has its own step-by-step guide: How to open a port on your server. You will find these under Networking, then Security Rules. How they work - A rule allows a kind of traffic: a direction (Ingress for incoming), a protocol (TCP, UDP, ICMP), a port or range, and where it may come from (a specific address or the whole internet). - Anything not explicitly allowed is blocked. A new server therefore accepts almost nothing until you add rules. - A security group can be attached to many servers, so a web group that opens ports 80 and 443 can protect your whole fleet consistently. Good habits - Open only the ports you actually use. - Restrict the source to specific addresses where you can, especially for SSH (port 22) and database ports. - Group rules by role (web, db, admin) rather than making one giant group. For the exact steps to add a rule and attach the group, follow How to open a port on your server.

Last updated on Jul 14, 2026

Set up network firewall rules

On top of the per-server Security Rules, there is a network firewall that applies policies at the router, under Networking, then Firewall Rules. Use it for rules you want enforced across a whole network at once. The pieces build up: a rule is one allow/deny decision; a policy is an ordered list of rules; the policy is applied to a router. 1. Create the rules 1. Open Networking, then Firewall Rules, and choose Create Rule. 2. For each rule set: - Protocol: TCP, UDP, or ICMP. - Source and destination: the addresses or ranges it applies to. - Port: the port or range. - Action: Allow or Deny. 2. Group them into a policy 1. Choose Add Policy and give it a name. 2. Add your rules in the order they should be checked. Order matters: the first matching rule wins. 3. Apply the policy Attach the policy to the router that carries the traffic you want to govern. For most customers the per-server security groups are simpler and enough. Reach for the network firewall when you need one consistent policy across many servers, or a central deny rule.

Last updated on Jul 14, 2026

Limit bandwidth with Network QoS

Network QoS caps how much bandwidth a network or a port may use, so one workload cannot saturate a shared link. Manage policies under Networking, then Network QoS. Create a policy 1. Open Network QoS and create a policy with a Name. 2. Add a bandwidth limit rule to it: - Max egress rate: the outbound limit (traffic leaving). - Max ingress rate: the inbound limit (traffic arriving). - Rates are set in kbps. Apply it Attach the policy to a network (every port on it inherits the limit) or to a specific port (just that one). You can also select a QoS policy when creating certain resources. Most people never need QoS. Add it only when you have a concrete reason to shape traffic, such as protecting production from a noisy test workload, or giving a service predictable throughput.

Last updated on Jul 14, 2026

See how everything connects (Network Map)

The Network Map, under Networking, then Network Map, draws your networks, routers, servers and public addresses as a single diagram. It is the fastest way to understand how a project is wired. How to use it 1. Open Networking, then Network Map. 2. The diagram shows each network, the routers connecting them, the servers on each network, and which servers have a public IP. 3. Click an item to jump to its details. Use it to answer, at a glance: - Which servers are on which network? - Is a network connected to a router with an internet gateway? - Which servers are public, and which are private only? The map is read-only, so nothing changes from here. When something is unreachable, the map often shows why, for example a server on a network with no router, or a private-only server you expected to be public. Fix those with Cloud Routers or Public IPs.

Last updated on Jul 14, 2026

Set up a VPN (VPN as a Service)

VPN as a Service creates a private, encrypted link between your Gewape Cloud network and another network, such as your office. Traffic crosses the internet but is encrypted, so the two sides act as one private network. Manage it under Networking, then VPN as a Service. 1. Create the VPN service On the router that connects your network, create a VPN service. This is the anchor for your tunnels. 2. Set the shared security settings Create an IKE policy and an IPsec policy (the encryption settings). The defaults are sensible; whatever you choose here must match the other end exactly. 3. Create the connection Add a site-to-site connection: - Peer address: the public IP of the other side (your office firewall). - Peer subnets: the address ranges on the far side you want to reach. - Pre-shared key: a secret both sides share. Set the same value on the other end. 4. Configure the other end On your office firewall or router, create a matching tunnel with the same policies, peer address (your cloud router's public IP), subnets, and pre-shared key. Both ends must agree exactly for the tunnel to come up. If it will not connect or drops, confirm both peers are online and that the keys and policies still match. See VPN tunnel is down. Because the far end is equipment we do not control, this is one area where reaching support early can save time.

Last updated on Jul 14, 2026

Managing your DNS

DNS is what turns a name like www.yourcompany.com into the address of your server. Where you manage it depends on your setup: at your domain registrar, or through the Gewape Cloud DNS service via the API. Pointing a name at a server 1. Give the server a public IP and note the address. 2. At wherever your domain's DNS is managed, create an A record for the name (for example www) pointing to that address. 3. Wait for it to take effect. Changes are not instant; they spread over minutes to a few hours depending on the record's TTL. Changing DNS safely - Lower the TTL first. A day or two before a planned change, reduce the record's TTL so the new value spreads quickly when you switch. - Write down the current values before you change anything, so you can revert. - Change one record at a time and confirm it resolves before moving on. If you use a custom domain for media buckets, the console gives you the exact record to add and a verify step. For programmatic DNS across many records, the DNS service is documented in the developer docs.

Last updated on May 18, 2026