Skip to content
FrazerDocs
Start building
NetworkProduct pagePricing

VPC and firewall

Every project gets a private network, a VPC, that spans the sites where the project runs. Subnets in IPv4 and IPv6 live at one site each, and a firewall compiled from your organization’s rules and your own decides what reaches them. Networks run on your own servers and on the Frazer fleet. They are closed to the internet until you open them, and every change is a plan that says what it opens and to whom.

Product overview: VPC and firewall.

How it works

Section titled “How it works”

A network belongs to a project and is global: one network spans every site the project uses, and each subnet lives at one site. Two projects can both use 10.10.0.0/20 and never see each other until someone connects them. Clusters, VMs, managed databases and load balancers attach to subnets.

Every new project gets a network called default, with a subnet at each site where the project has capacity, no internet ingress and NAT on. You can create a cluster without designing a network first: Frazer proposes free ranges for its nodes, pods and services.

Networks, subnets, firewall policies, routes, NAT and addresses are API objects. One plan checks the address plan, compiles the firewall and states what will change; applying it sends signed desired state to the site. On your own servers, the network runs as an overlay on the servers’ private network at the site. A site whose network cannot carry an overlay runs in site mode, one flat private VLAN per organization, with the same API, address plan, firewall objects and console.

  • Network: a VPC in a project. Its IPv4 ranges come from your organization’s address plan; its IPv6 range is a random ULA /48, or your own, fixed at creation.
  • Subnet: a range at one site: an IPv4 primary range, an IPv6 /64 from the network’s /48, and secondary ranges (pods, services) for a cluster.
  • Firewall policy: ordered rules attached to the organization, a project or a network.
  • Tag: a label that rules target. Binding a tag needs the tags.bind permission, so nobody widens a rule by tagging a resource.
  • Route: a destination and a next hop: a VM, an IP, a VPN tunnel, an attachment, internet or drop.
  • NAT: internet egress for subnets from fixed addresses. Each site has a default NAT.
  • Address: a reserved IP, internal (in a subnet) or external (from your site’s IP pool).
  • IP pool: a site’s block of public addresses. It lives in a host project and is shared to projects, each with a count of addresses.
  • Endpoint: a managed database or Frazer Registry as an address and a private name inside your subnet.
  • Connectivity test: whether a source can reach a destination, with every hop and the rule that decided it.

Address plan

Section titled “Address plan”

Every network is dual-stack inside from the first subnet. IPv4 is the primary family.

Layer IPv4 IPv6
Network From your organization’s RFC 1918 address plan A random ULA /48, or your own /48
Subnet /20 by default A /64 from the network’s /48
Cluster pods A /14 secondary range, routed per node A ULA /56 per cluster, a /64 per node
Cluster services A /20 secondary range A ULA /112
Resolver The subnet’s .2 address A fixed address in the subnet’s /64
Internet egress The site’s NAT, from fixed addresses Never NATed: an external IPv6 address, or a public /64 per subnet
Public addresses From your site’s pool, billed per address From your site’s pool, free

Overlapping ranges are refused by a database constraint, for both families. The same check runs at plan time across peered networks, VPN-learned routes, attachments and Frazer Access routes. A subnet warns at 80 % use; you can add secondary ranges to an existing subnet, and grow a primary range when the space around it is free.

Isolation

Section titled “Isolation”

Each network has its own logical router. Every VM port has anti-spoofing on for both families, and VMs have no path to the hosts’ own network. On the Frazer fleet, a network never spans organizations, traffic between hosts is encrypted, and a baseline firewall tier that Frazer owns sits above yours. On your own servers, encryption between hosts is optional, and an existing VLAN at your site can join a network.

Create a network

Section titled “Create a network”

Most projects start on the default network. Create your own when you want your own ranges. A command that changes something shows its plan and asks before it applies; add --dry-run to print the plan only.

  1. Create the network and read its plan:

    Terminal window
    frazer network networks create main --project acme-production --dry-run

    The plan lists what will be created. Run the command again without --dry-run to apply it.

  2. Add a subnet at a site, with the secondary ranges a cluster uses for pods and services:

    Terminal window
    frazer network subnets create vint-hill-a --network main --site ovh-vint-hill \
        --range 10.10.0.0/20 \
        --secondary-range pods=10.64.0.0/14 --secondary-range services=10.96.0.0/20

    The subnet is dual-stack (--stack-type IPV4_IPV6 is the default) and takes a /64 from the network’s /48. IPV4_ONLY needs a reason and shows as a badge on the subnet.

  3. Open a port. This rule, at the organization tier, lets the internet reach port 443 on anything tagged web:

    Terminal window
    frazer network firewall-policies rules add base --org acme --allow tcp:443 \
        --target-tags web --source 0.0.0.0/0

    The plan states the impact, such as how many VMs the rule opens. A rule that admits the internet is flagged as a risk and waits for an approval.

  4. Check what a VM may receive, with every tier compiled into one list:

    Terminal window
    frazer network firewall-policies get-effective --vm etl-worker-1

Write firewall rules

Section titled “Write firewall rules”

Policies live at the organization, the project and the network. Frazer compiles every tier into one ordered rule list per target and shows it to you as the effective rules. There are no stateless subnet rules and no second firewall to reconcile.

Order Tier Who writes it
1 Frazer fleet baseline Frazer, on the Frazer fleet only. No tenant can open the hosts’, Frazer Link’s or server management (BMC) ranges.
2 Organization Organization admins. A project cannot reopen what they deny.
3 Project Project admins.
4 Network Project admins, as part of the network.
5 Implied rules Nobody: deny ingress, allow egress.
  • Evaluation. Inside a tier, the lowest priority number wins, and on a tie, deny wins. A rule with the action goto_next hands the decision to the next tier.
  • Rules. Each rule has a direction, a priority, an action (allow, deny or goto_next), targets, peers, ports and a log switch. Rules are stateful.
  • Targets and peers. All, tags, subnets, instances, Frazer service tags (frazer:database, frazer:cluster-node:{cluster}, frazer:link), address groups and CIDRs. A rule can name other tags as peers.
  • Defaults. No internet ingress. Ingress is allowed from Frazer Link (console SSH, kubectl) and from the network’s own subnets. No rule allows SSH from anywhere unless someone writes it. Outbound port 25 is blocked on both families.
  • Two layers, one view. VPC rules act at each VM’s network card; network policy from your Git acts on pods inside a cluster. Pods have VPC addresses, so a VPC rule can target the pods range of a cluster. Effective rules and connectivity tests show the verdicts of both layers.

Network › Firewall policies shows the effective rules per VM or network card, hit counts and the last hit per rule, shadowed and never-hit rules, and findings for rules that allow 0.0.0.0/0.

Reserve and attach addresses

Section titled “Reserve and attach addresses”

An address is regional. An external one comes from an IP pool at your site: reserving takes a free IP, in one database transaction, from a pool your project owns or one that is shared with it.

Terminal window
# A static address in the region, from a pool your project can use
frazer network addresses create web --location us-virginia1 --dry-run


# Ask for one specific free IP from the pool instead
frazer network addresses create web --location us-virginia1 --address 203.0.113.20


# Attach it to a cluster's gateway; the plan shows the change
frazer network addresses attach web --gateway acme-production-1/gateway-system/public


# Addresses you hold but do not use
frazer network addresses list --filter state=RESERVED

An address moves through RESERVING, RESERVED, ATTACHING, IN_USE, DETACHING and RELEASING, or ends in FAILED.

  • A gateway without a bound address gets an ephemeral one if the project allows it. Promote makes an ephemeral address static in place.
  • You can also bind a gateway from Git with the annotation frazer.ai/address: web. The console shows the address as managed by Git, read-only.
  • A gateway with both families reserves one IPv4 and one IPv6 address in one transaction.
  • An address in use, or protected, cannot be deleted; the error names what uses it. A released public address is quarantined for 24 hours.
  • Move project moves an address to another project of the same organization; the destination must be in the pool’s share.
  • Each address has one reverse DNS name (PTR), for IPv4 and IPv6. On OVH, an IPv4 address can also carry up to 20 OVH edge firewall rules; richer rules, and every IPv6 rule, come from a NETWORK_EDGE security policy attached to the address.

Network › IP addresses lists every address with its status, what uses it, its site and pool, its monthly cost and who bills it, with a quota bar per location. When a pool runs low, Frazer opens an approval to buy more addresses; the approval shows the price.

Reach the internet and other networks

Section titled “Reach the internet and other networks”

NAT and routes. Each site has a default NAT: source NAT on two of your servers with failover, leaving from fixed addresses a partner can allowlist. Static egress addresses are available on request, and there is no per-GB fee.

Terminal window
frazer network nats create default --router vint-hill --all-subnets --addresses auto

Traffic between subnets is routed for you. Add static routes for anything else. A VM with its own public IPv4 address uses 1:1 NAT from its own host. IPv6 is never NATed: a VM with an external IPv6 address, or in a subnet with an external IPv6 range, reaches the IPv6 internet directly, and inbound traffic stays closed unless a rule allows it. A VM with only ULA addresses has no IPv6 internet and uses IPv4 through NAT.

Private endpoints and names. An endpoint puts a managed database, Frazer Registry or Frazer Storage at an address in your own subnet, with a private name. No route joins the two networks, overlapping ranges are fine, and the service sees NAT addresses, not yours.

Terminal window
frazer network endpoints create storefront --network main --subnet vint-hill-a \
    --target databases/storefront

The resolver at each subnet’s .2 address answers A and AAAA for automatic names such as {vm}.{subnet}.{network}.{project}.internal and {db}.db.{project}.internal, and for endpoints and load balancers. Private zones and forwarding to your own resolvers: DNS and certificates.

Connect networks. Network › Connectivity has one wizard: pick a source and a destination, and it proposes peering, an endpoint, VPN or an attachment.

Connection What it does
Peering Joins two networks whose ranges do not overlap, with optional route import and export. Not transitive. Across organizations, both sides accept.
Shared VPC A host project shares chosen subnets with other projects through network.subnets.use: a platform team owns ranges and firewall, product teams place clusters in them.
HA VPN Your office or data center to your networks over IPsec with BGP: Frazer Access and VPN.
VLAN attachment At your own site, an existing VLAN (database servers, an office, firewalls) becomes a subnet, or a routed link with BGP.
VPC attachment People’s laptops reach the network over Frazer Access: reach a VPC network.

Control egress

Section titled “Control egress”

Every workload that runs code for you leaves through one egress policy engine: agent cells, CI pools, previews, dev boxes and VMs. A policy lists the destinations a workload may reach, by name. For each it can give methods, paths, byte and request budgets, and a credential that the gateway adds, so the workload never holds it. Policies stack: organization, project, agent, session. A lower level only tightens, and a repository’s settings never loosen. The presets are none, trusted, custom and full; full needs an approval in production. A new or widened policy runs in audit for 7 days.

The network closes the usual ways around a list. The workload’s only resolver is the gateway’s. The gateway resolves and dials every name. The TLS name and the Host header must agree. A raw address needs a range rule. Every refusal is immediate and typed, never a drop.

Terminal window
frazer network egress-policies explain --session s-6b3f --json
frazer network egress-logs tail --org acme --follow --json

Test connectivity

Section titled “Test connectivity”

Ask whether A can reach B before you change anything. A connectivity test reads Frazer’s own model (routes, the compiled firewall, NAT, load balancers, peering, endpoints, VPN routes and access rules) and returns every hop with the rule that allowed or dropped the packet.

Terminal window
frazer network connectivity-tests run --from vms/etl-worker-1 --to databases/storefront --port 5432
Output
Result      Unreachable · TCP 5432 · 4 hops
1 Source    VM etl-worker-1 · 10.20.6.14
2 Subnet    vint-hill-10-20-0-0-20 · same subnet as the endpoint
3 Firewall  org 500 org-delegate-private → go to next tier
4 Firewall  project 1900 deny-db-default · dropped
Nearest     allow-db (project 1000) wants tag db-client; this VM has etl
Fix         bind tag db-client to etl-worker-1 · opens 5432 to 1 VM · Plan

Sources and destinations can be a VM, a node or pod range, a database, an endpoint, a load balancer, an on-premises IP or the internet. Beyond the model, a test can trace the same five-tuple through the data plane, or send real packets from the source as a live probe. Every resource page has a Can A reach B? action that opens a prefilled test, and the Assistant runs the same test through MCP when you ask why something cannot connect.

Flow logs. Flow logs are per subnet, sampled (1 in 100 by default on the Frazer fleet; off on your own sites until you turn them on), with the verdict and the rule ID, and land in your project’s logs with no per-GB fee. Inside clusters, the cluster network’s flow logs show pod flows.

Terminal window
frazer network flow-logs tail --subnet vint-hill-a --filter 'verdict=deny'

Network › Traffic and topology shows a live map (sites, subnets, clusters, VMs, databases, endpoints, gateways, VPN and peerings, weighted by traffic). Alerts cover NAT ports in use, drops by reason, healthy backends, VPN tunnel and BGP state, and address use per subnet.

Access and audit

Section titled “Access and audit”
Who What they can do
Organization admins Write the organization’s firewall policies and its address plan. A project cannot reopen what they deny.
Project admins Create networks, subnets, routes, NAT, addresses and the network’s policy, each as a plan.
Anyone tagging a resource Needs tags.bind.
Anyone attaching an address Needs addresses.use; reserving from a pool needs ipPools.use, checked on the pool and on its share.
Other projects Place resources in a host project’s shared subnets with network.subnets.use.
Agents and MCP clients Read, and run connectivity tests, by default. Firewall, route and peering changes always go through a plan and an approval.

What is recorded:

  • Every change: a plan you read first, then a numbered revision of the network.
  • Every plan’s impact. “Opens 22/tcp from 0.0.0.0/0 on 14 VMs” is a risk flag that needs an approval.
  • Every connectivity test, with each hop and the rule that decided it.
  • Flow logs with the verdict and the rule ID, per subnet.
  • Address-hours per address, for billing.

Limits and quotas

Section titled “Limits and quotas”
Limit Default
Public IPv4 addresses per project and region 2
Public IPv6 addresses per project and region 64 (an external IPv6 range counts as 1)
Internal addresses per project and region 256
Addresses in an IP pool The pool’s capacity is a hard limit
Network cards per VM 8, each in a different network
Subnet use warning At 80 %
Quarantine of a released public address 24 hours
OVH edge firewall rules per IPv4 address 20

Quotas are never zero. A request over a quota is refused with QUOTA_EXCEEDED (errors). Request more from the project’s quota page: a request up to your tier’s ceiling is approved automatically, and a larger one goes to an approval.

Pricing

Section titled “Pricing”

Networks, subnets, firewalls, routes and NAT have no fee of their own, and there are no per-GB network fees within fair use. Public IPv4 addresses are billed per address each month, and public IPv6 addresses are free. An address billed by your own provider account costs nothing from Frazer.

VPC and firewallOn your serversOn the Frazer fleet
PriceIncluded: networks, subnets, firewall policies, routes, NAT and VPN · flow logs count as logsIncluded · no NAT or per-GB fee within fair use
public addressesIPv4 $3.00 / address-month, used or idle; $0 when your provider account bills it · IPv6 freeIPv4 $3.00 / address-month · IPv6 free

Every line, with the estimator: pricing.

Troubleshooting

Section titled “Troubleshooting”
Symptom Cause Fix
A VM cannot reach a port on another resource A firewall rule drops the traffic, or no rule allows it Run a connectivity test. It names the rule that dropped the packet and the nearest rule that would allow it.
A firewall change waits It admits the internet or opens a port widely, so the plan flagged it An approver reviews it in Approvals.
QUOTA_EXCEEDED when you reserve an address The project holds its quota of public addresses in the region Release an unused address (frazer network addresses list --filter state=RESERVED) or request a higher quota.
No free address in the pool The pool’s capacity is a hard limit Ask the host project’s admins to buy addresses for the pool, or to give your project a larger share.
An address cannot be deleted It is IN_USE or protected Detach it from what the error names, or turn off its deletion protection.
A subnet or a peering is refused Its range overlaps one already in use Take a free range that Frazer proposes.
A subnet warns at 80 % use Its primary range is filling up Add a secondary range, or grow the primary range when the space around it is free.
A VM has no IPv6 internet It has only ULA addresses Give its subnet an external IPv6 range, or the VM an external IPv6 address.
Outbound mail on port 25 never leaves Port 25 egress is blocked by default on both families Ask support to open it. Frazer then sets reverse DNS for both addresses and checks that it matches.

Reference

Section titled “Reference”

CLI

CommandWhat it does
frazer network networks createCreate a VPC network in a project.
frazer network subnets createCreate a subnet at one site, with secondary ranges for cluster pods and services.
frazer network firewall-policies rules addAdd a rule to a firewall policy.
frazer network firewall-policies get-effectiveShow the effective firewall rules of a VM, every tier compiled into one ordered list.
frazer network addresses createReserve a static internal or external address.
frazer network addresses attachAttach an address to a gateway, a load balancer or a VM.
frazer network addresses listList the project's addresses, filtered by state.
frazer network nats createCreate a NAT that gives subnets internet egress from fixed addresses.
frazer network endpoints createPut a managed database or Frazer Registry at an address inside your subnet.
frazer network connectivity-tests runTest whether a source can reach a destination, with every hop and the rule that decided it.
frazer network flow-logs tailStream a subnet's flow logs, with a filter.

All of them: CLI reference.

Terraform and OpenTofu

ResourceWhat it manages
frazer_network_subnetA subnet of a network at one site, with its stack type and external IPv6 range.
frazer_network_addressA reserved internal or external address.

All of them: Terraform and OpenTofu reference.

MCP tools

ToolWhat it does
connectivityTests.runRun a connectivity test and return every hop with the rule that allowed or dropped the traffic.

All of them: MCP tools reference.

Section titled “Related”