--- title: "VPC and firewall: private networks on your own servers · Frazer" description: "A private network for every project on servers you own: subnets in IPv4 and IPv6, a firewall compiled from organization and network policies, NAT with fixed addresses, private names and connectivity tests." url: https://frazer.ai/network index: https://frazer.ai/llms.txt tokens: 2708 --- > For agents: every page on frazer.ai is indexed at https://frazer.ai/llms.txt. # VPC and firewall: private networks on your own servers · Frazer **VPC and firewall** frazer.ai # A VPC on servers you own. Closed to the internet until you open it. Every project gets a private network that spans its sites: subnets in IPv4 and IPv6, a firewall compiled from your organization’s rules and your own, NAT with fixed addresses, and private names. Clusters, databases and load balancers plug into it, and every change is a plan you read before it applies. [Create a network](https://frazer.ai/start?product=network) [Read the docs](https://frazer.ai/docs) *The network acme-prod-vpc in the Frazer console, ready at site ovh-vint-hill. Its general subnet holds the seven nodes of cluster acme-production-1 with pod and service ranges in IPv4 and IPv6, next to an endpoint NAT subnet and a router with NAT on two servers. The network connects to the internet through NAT, to a Postgres endpoint and Frazer Registry by private address, to automatic private names, and to a firewall of four tiers and seventeen rules.* The network acme-prod-vpc at one site: its subnets and what they connect to product UI, demo organization 01 · How it works Fig. 1 ## Describe it once. Frazer builds it on your servers. A network, its subnets, firewall policies, routes, NAT and addresses are API objects. One plan checks the address plan, compiles the firewall and states what will change. Applying it sends signed desired state to your site, where the network runs as an overlay on your servers’ private L2. **Fig. 1** From the objects you describe, through one plan, to a site 02 · Firewall Fig. 2 ## One firewall, four tiers. Compiled into one list per target. Policies live at the organization, the project and the network. Inside a tier the lowest priority number wins and a tie goes to deny; “go to next tier” hands a decision down. Frazer flattens every tier into one ordered list per target and shows it to you, next to the network policy from your Git that applies inside the cluster. Every edit is a plan that says what it opens and to whom. A rule that admits the internet is flagged as a risk and waits for an approval. *Firewall policies of the network acme-prod-vpc in the Frazer console. Four tiers in order: organization, project, network and the implied defaults. For the workload checkout-api the effective ingress rules are listed with the reason each applies, followed by the network policy from Git; the internet reaches checkout-api on port 443 and is denied on port 22. Beside it, an edit to the rule allow-db is shown as a plan: it opens TCP 5432 on the database endpoint to three more VMs, with two blocking checks passed and one warning.* Firewall policies: the four tiers, the effective rules for one workload, and an edit as a plan product UI, demo organization 03 · IPv4 and IPv6 ## Both address families. From the first network. Every network is dual-stack inside from day one, so nothing has to be rebuilt later. IPv4 stays the primary family, IPv6 is never NATed, and public IPv6 addresses are free. The address plan of a network, per family | Layer | IPv4 | IPv6 | | --- | --- | --- | | Network | From your organization’s RFC 1918 plan | A random ULA /48, or your own /48 | | Subnet | /20 by default | A /64 from the network’s /48 | | Cluster pods | /14 secondary range, routed per node | A ULA /56 per cluster, a /64 per node | | Cluster services | /20 secondary range | A ULA /112 | | Internet egress | The site’s NAT, fixed addresses | Never NATed; a public /64 per subnet | | Public addresses | From your site’s pool, $3 a month each | From your site’s /56, free | Overlapping ranges are refused by the database for both families. 04 · Can A reach B? ## Can A reach B? Ask before you change. A connectivity test reads Frazer’s own model: routes, the compiled firewall, NAT, load balancers and endpoints. It returns every hop with the rule that allowed or dropped the packet. The Assistant runs the same test through MCP when you ask why something cannot connect. When the model says yes and the packet still fails, a trace follows the same packet through the data plane and a live probe sends real packets from the source. ``` # A network for the project, one subnet at your site $ frazer network networks create main --project acme-production --dry-run $ frazer network subnets create vint-hill-a --network main --site ovh-vint-hill \ --range 10.10.0.0/20 \ --secondary-range pods=10.64.0.0/14 --secondary-range services=10.96.0.0/20 # Open 443 to tagged targets at the organization tier $ frazer network firewall-policies rules add base --org acme --allow tcp:443 \ --target-tags web --source 0.0.0.0/0 # A static public address in the region (addresses.md §4) $ frazer network addresses create web --location us-virginia1 ``` ``` $ frazer network connectivity-tests run --from vms/etl-worker-1 \ --to databases/storefront --port 5432 Result Unreachable · TCP 5432 · 4 hops 1 Source VM etl-worker-1 · 10.20.6.14 2 Subnet vint-hill-10-20-0-0-20 · same subnet as the endpoint 3 Firewall org 500 org-delegate-private → go to next tier 4 Firewall project 1900 deny-db-default · dropped Nearest allow-db (project 1000) wants tag db-client; this VM has etl Fix bind tag db-client to etl-worker-1 · opens 5432 to 1 VM · Plan ``` 05 · What you get ## Everything a network needs. Nothing to assemble. - ### One network, every site A network belongs to a project and spans its sites; each subnet lives at one site, IPv4 and IPv6 together. - ### A compiled firewall Organization and network policies flattened into one ordered rule list per target, shown as effective rules. - ### NAT with fixed addresses A default NAT per site on two of your servers with failover, so a partner can allowlist your egress. - ### Address plans that cannot overlap Free ranges proposed for you; overlaps refused by a database constraint, for both families. - ### Private names Every node, database endpoint and load balancer answers under `.internal` from the network’s resolver. - ### Can A reach B? Ask before you change: every hop with the rule that allowed or dropped the packet. - ### Private endpoints A managed database or Frazer Registry as an address inside your subnet, no public IP. - ### Peering, VPN and VLAN attachments Connect networks, share subnets across projects, bring an office or a data-center VLAN in. 06 · Controls ## Closed by default. Every opening is a plan. ### Who may do what Organization admins Write the organization’s firewall policies. A project cannot reopen what they deny. Project admins Create networks, subnets, routes, NAT and the network’s policy, each as a plan. Anyone tagging a resource Needs `tags.bind`, so nobody widens a rule by adding a tag. Agents and MCP clients Read and run connectivity tests by default. Firewall, route and peering changes always go through plan and approval. ### What is logged - Every change: a plan you read first, then a numbered revision of the network. - Every plan states its impact. “Opens 22/tcp from 0.0.0.0/0 on 14 VMs” is a risk flag that needs an approval. - Every connectivity test, with each hop and the rule that decided it. - Flow logs per subnet, with the verdict and the rule ID of every sampled flow. ### At the cap - **No internet ingress** by default. Frazer Link and the network’s own subnets may connect. - Quotas per project and region: **2** public IPv4, **64** public IPv6, **256** internal addresses. - A subnet warns at **80 %** use; secondary ranges can be added later. - Outbound port 25 is blocked by default on both families. - A released public address is quarantined for **24 hours**. 07 · Pricing ## No per-GB network fees. One price for public IPv4. Networks, firewalls, routes and NAT have no fee of their own. A public IPv4 address costs $3.00 a month, whether used or idle; IPv6 addresses are free. [See every price](https://frazer.ai/pricing#lines) Networks, subnets, firewall **$0** · routes, NAT and connectivity tests too Egress No per-GB fee within fair use Inside a site $0 for requests and egress Public IPv4 **$3.00** per address a month, billed hourly whether used or not Public IPv6 **Free** Your provider’s IPs Billed by your provider account; $0 from Frazer Flow logs Count as logs: 50 GB per server included, then $0.20 per GB Questions ## VPC and firewall, answered. Do I have to design a network before I create a cluster? No. Every project gets a network called `default` with a subnet at each site the project has capacity in, no internet ingress and NAT on. A new cluster takes free ranges Frazer proposes: a /20 for nodes, a /14 for pods and a /20 for services. Can two projects use the same address range? Yes. Each project’s network has its own logical router, so two projects can both use 10.10.0.0/20 and never see each other. They meet only when someone connects them, and peering needs ranges that do not overlap. How do organization rules and my rules combine? Policies live at the organization, the project and the network, and are evaluated in that order. Inside a tier the lowest priority number wins and a tie goes to deny; “go to next tier” hands a decision down. Frazer compiles all tiers into one ordered list per target and shows it as the effective rules, next to the network policy from your Git that applies inside the cluster. How does traffic reach the internet? Through the default NAT at each site: source NAT on two of your servers with fast failover, leaving from fixed addresses a partner can allowlist. There is no per-GB fee. IPv6 is never NATed; a subnet reaches the IPv6 internet once it has a public /64. What if my site’s network cannot carry an overlay? It runs in site mode: one flat private VLAN per organization per site, network policy inside clusters, and L2 announcements or BGP for addresses. The API, the address plan, the firewall objects and the console stay the same. Can an agent change my firewall? Not on its own. MCP tools come from the same API: reading and connectivity tests are on by default, and firewall, route and peering changes always go through a plan and an approval. ## More in Network - [**Load balancers** L4 and L7, TLS included](https://frazer.ai/network/gateways) - [**DNS and certificates** Zones and automatic TLS](https://frazer.ai/network/dns) - [**Frazer Access and VPN** Private access for people, devices and agents](https://frazer.ai/network/access) ## Start with the default network. Open it one rule at a time. [Create a network](https://frazer.ai/start?product=network) [Read the docs](https://frazer.ai/docs)