fm network
Reference for the fm network command group (auto-generated from fm network --help).
fm network
text
Manage network resources including VPCs, subnets, security groups, and public IPs.
Examples:
fm network vpc list
fm network vpc create --name my-vpc --cidr 10.0.0.0/16
fm network security-group list
fm network public-ip allocate
Usage:
fm network [command]
Aliases:
network, net
Available Commands:
gateway Manage a VPC's outbound internet path
public-ip Manage public IPs
security-group Manage security groups
subnet Manage subnets
vpc Manage VPCs
Flags:
-h, --help help for network
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm network [command] --help" for more information about a command.fm network gateway
text
Manage the gateway for a VPC.
A gateway is how a VPC reaches the internet outbound. A VPC has at most one. A
VPC without one is isolated: no outbound internet access, and no DNS resolution
or managed-service connectivity either, because both are reached over the same
path.
There is one mode, "public-ip": the VPC leaves through its own router gateway.
What differs is WHICH address that gateway uses, and that is the whole decision.
no --public-ip-id the platform picks the address and keeps it HIDDEN. It has
no id, is in none of your public IP lists, draws nothing
from your Public IP quota and never reaches an invoice.
Nothing pins it, so it is redrawn if the router or the VPC
is rebuilt. Do NOT publish it, put it in DNS, or give it to
a partner to allow-list.
--public-ip-id a Public IP of yours becomes the source address. It is
pinned to the VPC, listed in "fm network public-ip list",
counted against your Public IP quota and billed as a Public
IP. This is the address that is safe to publish.
"fm network gateway adopt-public-ip" turns a hidden address into a Public IP of
yours in place, without changing the address or interrupting traffic.
The "nat" mode is WITHDRAWN and can no longer be chosen. A VPC still in nat mode
keeps working and still reads here; move it off with
"fm network gateway set-mode --vpc-id <vpc-id> --mode public-ip --yes".
Usage:
fm network gateway [command]
Aliases:
gateway, gw
Available Commands:
adopt-public-ip Take ownership of a gateway's existing outbound source address
create Give a VPC outbound internet access
delete Remove a VPC's outbound internet access
get Show a VPC's gateway
list List the tenant's gateways
set-mode Change how a VPC's outbound traffic is addressed
Flags:
-h, --help help for gateway
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm network gateway [command] --help" for more information about a command.fm network gateway adopt-public-ip
text
Turn this VPC's existing outbound source address into a public IP you own.
A gateway created without --public-ip-id carries a PLATFORM-ALLOCATED address.
It has no id, appears in none of your public IP lists, draws nothing from your
Public IP quota and never reaches an invoice — but if the router or the VPC is
ever rebuilt the platform draws a new one at random, so it is not an address to
give a partner to allow-list or to publish in DNS.
Adopting records that same address as a public IP in your tenant.
The address does NOT change and nothing is interrupted. No traffic moves, no
connection drops, no infrastructure call is made — this is bookkeeping.
Two consequences, which are why this is your choice rather than something the
platform does for you:
- the address becomes QUOTA-COUNTED against your Public IP quota and BILLABLE
as a public IP, like any other address you hold
- the address becomes PINNED to this VPC, which is the point: it survives a
gateway, router or VPC rebuild instead of being redrawn, so it is finally
safe to publish or to give a partner to allow-list
Only a gateway in public-ip mode has an address of its own to adopt; a VPC still
in the withdrawn nat mode has none. Running this again on a gateway that has
already been adopted changes nothing.
Usage:
fm network gateway adopt-public-ip [flags]
Examples:
fm network gateway adopt-public-ip --vpc-id vpc-abc123
Flags:
-h, --help help for adopt-public-ip
--vpc-id string VPC ID (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network gateway create
text
Give a VPC outbound internet access.
--mode is required and is never defaulted, so a VPC never acquires an outbound
path because a flag was omitted. "public-ip" is the only mode: the VPC leaves
through its own router gateway. ("nat" is withdrawn — see below.)
--public-ip-id decides WHICH address that gateway uses, and the two answers are
not the same address with a different price. They differ in what you may do with
the address afterwards:
omitted the platform picks the address and keeps it HIDDEN. It has
no id, is in none of your public IP lists, draws nothing
from your Public IP quota and never reaches an invoice.
NOTHING PINS IT: it is redrawn if the router or the VPC is
rebuilt. Do NOT publish it, put it in DNS, or give it to a
partner to allow-list — the day it is redrawn, whatever
relied on it breaks with no warning.
--public-ip-id a Public IP of yours becomes the source address. It is
pinned to the VPC and survives a gateway, router or VPC
rebuild; it is listed in "fm network public-ip list",
counted against your Public IP quota, and billed as a
Public IP. THIS is the address that is safe to publish or
to give a partner to allow-list.
Started without one and need a stable address later? "fm network gateway
adopt-public-ip" turns the hidden address into a Public IP of yours in place —
same address, no interruption.
If the VPC already has a gateway, change it with
"fm network gateway set-mode" rather than creating a second one.
The "nat" mode is WITHDRAWN and is refused here: the shared platform address it
used no longer exists, and it is not coming back. A VPC already on nat keeps
working until you move it with
"fm network gateway set-mode --vpc-id <vpc-id> --mode public-ip --yes".
Usage:
fm network gateway create [flags]
Examples:
fm network gateway create --vpc-id vpc-abc123 --mode public-ip
fm network gateway create --vpc-id vpc-abc123 --mode public-ip --public-ip-id pip-abc123
Flags:
-h, --help help for create
--mode string gateway mode (required): "public-ip" - internet access through the VPC's own router gateway. Without --public-ip-id the platform picks that source address and keeps it HIDDEN: no id, in none of your public IP lists, 0 public IPs drawn from your quota, never on an invoice - but nothing pins it, so it is redrawn if the router or VPC is rebuilt and must NOT be published or allow-listed. --public-ip-id instead names a Public IP of yours: pinned, listed, counted against your Public IP quota and billed as a Public IP - that is the address that is safe to publish
--public-ip-id string the Public IP of yours to use as this VPC's outbound source address (only with --mode public-ip): it is pinned to the VPC, listed in "fm network public-ip list", counted against your Public IP quota and billed as a Public IP - the address that is safe to publish or give a partner to allow-list. Omit it and the VPC sends its outbound traffic from a platform-allocated HIDDEN address instead: no id, in none of your public IP lists, no quota drawn, never on an invoice - and unpinned, so it is redrawn if the router or VPC is rebuilt. Do NOT publish or allow-list that one
--vpc-id string VPC ID (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network gateway delete
text
Remove a VPC's gateway.
This costs more than internet access. The VPC also loses DNS resolution and
managed-service connectivity, because both are reached over the same path.
--yes is required to confirm.
Usage:
fm network gateway delete [flags]
Examples:
fm network gateway delete --vpc-id vpc-abc123 --yes
Flags:
-h, --help help for delete
--vpc-id string VPC ID (required)
--yes confirm loss of internet, DNS and managed-service connectivity
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network gateway get
text
Show a VPC's gateway.
A VPC with no gateway is reported as such rather than as an error. Note that an
unknown VPC id, or one belonging to another tenant, looks exactly the same — an
empty result is not proof that a VPC you own has no gateway. Pair it with
"fm network vpc get <vpc-id>", which does report a missing VPC.
Usage:
fm network gateway get [flags]
Examples:
fm network gateway get --vpc-id vpc-abc123
Flags:
-h, --help help for get
--vpc-id string VPC ID (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network gateway list
text
List every gateway in the tenant.
A VPC with no gateway is absent from this list rather than listed with an empty
address — "no gateway" is the absence of the resource, and such a VPC is
isolated.
To ask about one VPC, use "fm network gateway get --vpc-id <id>".
Usage:
fm network gateway list [flags]
Examples:
fm network gateway list
Flags:
-h, --help help for list
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network gateway set-mode
text
Change a VPC's gateway mode in place.
The gateway itself is not recreated, so it keeps its ID. Switching changes this VPC's outbound source address and drops existing connections, which must re-establish; internet access itself continues — the VPC is not taken off the internet, and
this is not the same as removing the gateway. Anything that allow-lists the
VPC's current source address has to be updated afterwards, and DNS and
managed-service traffic use the new address too, since they travel the same
path.
"public-ip" is the only mode: the VPC leaves through its own router gateway.
--public-ip-id decides which address that gateway uses.
--public-ip-id a Public IP of yours becomes the source address: pinned to
the VPC, listed in "fm network public-ip list", counted
against your Public IP quota and billed as a Public IP.
This is the address that is safe to publish or give a
partner to allow-list.
omitted the gateway keeps the address it already has. Entering
public-ip mode without one, the platform picks a HIDDEN
address: no id, in none of your public IP lists, no quota
drawn, never on an invoice — and pinned by nothing, so it
is redrawn if the router or the VPC is rebuilt. Do NOT
publish that one or give it to a partner to allow-list.
Switching a VPC OFF a Public IP of yours leaves that address in your tenant as an
unattached public IP: it stays quota-counted and billed as a Public IP until you
release it with "fm network public-ip release".
Passing a --public-ip-id that differs from the address the gateway already uses
is a real change even when the mode is unchanged: the VPC's outbound source
address moves to the new one, so it needs --yes like any other re-mode.
The "nat" mode is WITHDRAWN and is refused here. This command is how a VPC still
on nat moves off it: --mode public-ip gives it a router gateway of its own.
--yes is required to confirm.
Usage:
fm network gateway set-mode [flags]
Examples:
fm network gateway set-mode --vpc-id vpc-abc123 --mode public-ip --yes
fm network gateway set-mode --vpc-id vpc-abc123 --mode public-ip --public-ip-id pip-abc123 --yes
Flags:
-h, --help help for set-mode
--mode string gateway mode (required): "public-ip" - internet access through the VPC's own router gateway. Without --public-ip-id the platform picks that source address and keeps it HIDDEN: no id, in none of your public IP lists, 0 public IPs drawn from your quota, never on an invoice - but nothing pins it, so it is redrawn if the router or VPC is rebuilt and must NOT be published or allow-listed. --public-ip-id instead names a Public IP of yours: pinned, listed, counted against your Public IP quota and billed as a Public IP - that is the address that is safe to publish
--public-ip-id string the Public IP of yours to use as this VPC's outbound source address (only with --mode public-ip): it is pinned to the VPC, listed in "fm network public-ip list", counted against your Public IP quota and billed as a Public IP - the address that is safe to publish or give a partner to allow-list. Omit it and the VPC sends its outbound traffic from a platform-allocated HIDDEN address instead: no id, in none of your public IP lists, no quota drawn, never on an invoice - and unpinned, so it is redrawn if the router or VPC is rebuilt. Do NOT publish or allow-list that one
--vpc-id string VPC ID (required)
--yes confirm the source-address change and the loss of internet, DNS and managed-service connectivity during the switch
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network public-ip
text
Manage public (elastic) IP addresses.
Usage:
fm network public-ip [command]
Aliases:
public-ip, fip, elastic-ip
Available Commands:
allocate Allocate a public IP
associate Associate a public IP with an instance
disassociate Disassociate a public IP from an instance
get Get public IP details
list List public IPs
release Release a public IP
tags Read and replace a public IP's tags
Flags:
-h, --help help for public-ip
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm network public-ip [command] --help" for more information about a command.fm network public-ip allocate
text
Allocate a new public IP address.
Examples:
fm network public-ip allocate
fm network public-ip allocate --region sweden
Usage:
fm network public-ip allocate [flags]
Flags:
-h, --help help for allocate
--region string region to allocate in
--tag strings tags in key=value format
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network public-ip associate
text
Associate a public IP address with a compute instance.
The public IP is bound to the instance's network port, resolved from the
instance automatically. For an instance with multiple network ports, pass
--port-id to choose which one (or to bind a port directly without an instance).
Usage:
fm network public-ip associate <public-ip-id> [instance-id] [flags]
Flags:
-h, --help help for associate
--port-id string bind a specific Neutron port directly (overrides instance lookup; required for multi-NIC instances)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network public-ip disassociate
text
Disassociate a public IP address from a compute instance.
Usage:
fm network public-ip disassociate <public-ip-id> [flags]
Flags:
-h, --help help for disassociate
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network public-ip get
text
Get detailed information about a specific public IP.
Usage:
fm network public-ip get <public-ip-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network public-ip list
text
List all public IP addresses.
Usage:
fm network public-ip list [flags]
Flags:
-h, --help help for list
--status string filter by status: available, in_use, pending, error
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network public-ip release
text
Release (delete) a public IP address.
This is IRREVERSIBLE and it is the only irreversible action on this resource.
The address returns to the platform pool: you cannot get that address back, and
anything that allow-lists it or resolves to it stops working. To free an address
temporarily, detach it with "fm network public-ip disassociate <id>" instead.
You are asked to confirm unless --force is given, and the prompt names the
address and what currently holds it.
An address that is a VPC's outbound source address cannot be released while it
is: the API refuses it, because releasing it would change what that VPC's
traffic comes from and take its internet, DNS and managed-service path with it.
Point that VPC at another address first —
"fm network public-ip get <id>" says which VPC holds it.
Usage:
fm network public-ip release <public-ip-id> [flags]
Flags:
--force skip the confirmation prompt (required in scripts; the release is irreversible)
-h, --help help for release
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network public-ip tags
text
Read and replace a public IP's tags
Usage:
fm network public-ip tags [command]
Aliases:
tags, tag
Available Commands:
get Show a public IP's tags
set Replace a public IP's tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm network public-ip tags [command] --help" for more information about a command.fm network public-ip tags get
text
Show a public IP's tags
Usage:
fm network public-ip tags get <public-ip-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network public-ip tags set
text
Replace a public IP's tags in place with exactly the given set
(replace semantics — any tag not listed is removed).
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm network public-ip tags get' and
pass them all back.
Use --clear to remove every tag.
An address that is a VPC's outbound source address carries no floating IP to
hold tags, so the API refuses the update and names the VPC — nothing is changed.
Examples:
fm network public-ip tags set pip-123 --tag env=prod --tag owner=team-a
fm network public-ip tags set pip-123 --clear
Usage:
fm network public-ip tags set <public-ip-id> --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network security-group
text
Manage security groups (firewalls).
Usage:
fm network security-group [command]
Aliases:
security-group, security-groups, sg, firewall
Available Commands:
add-rule Add a rule to a security group
create Create a security group
delete Delete a security group
delete-rule Delete a rule from a security group
get Get security group details
list List security groups
Flags:
-h, --help help for security-group
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm network security-group [command] --help" for more information about a command.fm network security-group add-rule
text
Add a firewall rule to a security group.
Examples:
fm network security-group add-rule sg-123 --direction ingress --protocol tcp --port 22 --cidr 0.0.0.0/0
fm network security-group add-rule sg-123 --direction ingress --protocol tcp --port-min 80 --port-max 443 --cidr 10.0.0.0/8
fm network security-group add-rule sg-123 --direction egress --protocol any --cidr 0.0.0.0/0
Usage:
fm network security-group add-rule <security-group-id> [flags]
Flags:
--cidr string source/destination CIDR
--direction string rule direction: ingress or egress (required)
-h, --help help for add-rule
--port int single port number
--port-max int maximum port number
--port-min int minimum port number
--protocol string protocol: tcp, udp, icmp, any (required)
--rule-description string rule description
--source-group string source security group ID
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network security-group create
text
Create a new security group.
Examples:
fm network security-group create --name web-servers
fm network security-group create --name db-servers --vpc vpc-123 --description "Database servers"
Usage:
fm network security-group create [flags]
Flags:
--description string security group description
-h, --help help for create
--name string security group name (required)
--tag strings tags in key=value format
--vpc string VPC ID
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network security-group delete
text
Delete a security group.
Usage:
fm network security-group delete <security-group-id> [flags]
Flags:
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network security-group delete-rule
text
Delete a firewall rule from a security group.
Usage:
fm network security-group delete-rule <security-group-id> <rule-id> [flags]
Flags:
-h, --help help for delete-rule
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network security-group get
text
Get detailed information about a specific security group.
Usage:
fm network security-group get <security-group-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network security-group list
text
List all security groups.
Usage:
fm network security-group list [flags]
Flags:
-h, --help help for list
--vpc string filter by VPC ID
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network subnet
text
Manage subnets within VPCs.
Usage:
fm network subnet [command]
Aliases:
subnet, subnets
Available Commands:
create Create a subnet
delete Delete a subnet
get Get subnet details
list List subnets
Flags:
-h, --help help for subnet
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm network subnet [command] --help" for more information about a command.fm network subnet create
text
Create a new subnet within a VPC.
Examples:
fm network subnet create --name public --cidr 10.0.1.0/24 --vpc vpc-123
fm network subnet create --name private --cidr 10.0.2.0/24 --vpc vpc-123 --zone sweden-a
Usage:
fm network subnet create [flags]
Flags:
--cidr string subnet CIDR block (required)
--description string subnet description
--dns strings DNS server addresses
--gateway string gateway IP address
-h, --help help for create
--name string subnet name (required)
--tag strings tags in key=value format
--vpc string VPC ID (required)
--zone string availability zone
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network subnet delete
text
Delete a subnet.
Usage:
fm network subnet delete <subnet-id> [flags]
Flags:
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network subnet get
text
Get detailed information about a specific subnet.
Usage:
fm network subnet get <subnet-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network subnet list
text
List all subnets.
Usage:
fm network subnet list [flags]
Flags:
-h, --help help for list
--vpc string filter by VPC ID
--zone string filter by zone
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network vpc
text
Manage Virtual Private Clouds (VPCs).
Usage:
fm network vpc [command]
Aliases:
vpc, vpcs
Available Commands:
create Create a VPC
delete Delete a VPC
get Get VPC details
list List VPCs
route Manage a VPC's static routes
tags Read and replace a VPC's tags
Flags:
-h, --help help for vpc
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm network vpc [command] --help" for more information about a command.fm network vpc create
text
Create a new VPC.
Examples:
fm network vpc create --name my-vpc --cidr 10.0.0.0/16
fm network vpc create --name production --cidr 172.16.0.0/12 --description "Production VPC"
Usage:
fm network vpc create [flags]
Flags:
--cidr string VPC CIDR block (required)
--description string VPC description
--gateway string outbound connectivity for the VPC: "none" (default when omitted; isolated - no internet, no DNS, no managed-service connectivity, spends 0 public IPs) or "public-ip" (internet access through the VPC's own router gateway; the platform picks that source address and keeps it hidden - it has no id, is in none of your public IP lists, draws 0 public IPs from your quota and never reaches an invoice, but nothing pins it, so it is redrawn if the router or VPC is rebuilt and must NOT be published or given to a partner to allow-list. For an address that is pinned, listed, counted against your Public IP quota and billed as a Public IP, attach one of your own afterwards with "fm network gateway set-mode --public-ip-id")
-h, --help help for create
--name string VPC name (required)
--tag strings tags in key=value format
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network vpc delete
text
Delete a VPC.
By default, the VPC must be empty; deleting a VPC that still has subnets (or
other child resources) fails with a message listing what must be removed first.
--force cascade-deletes the VPC's own NETWORKING: its subnets and security
groups, any network interfaces left in it, the Public IPs attached to those
interfaces (which cannot be reclaimed), and the router attachment. It does not
remove anything running in the VPC, and it refuses while any such resource is
still there — load balancers, instances, and the managed services that run on
them (databases, caches, message brokers, web servers, Kubernetes nodes),
including stopped ones. Delete those first.
The delete is asynchronous; by default the command waits until the VPC is gone
and reports the real outcome. Use --no-wait to return as soon as the request is
accepted.
Examples:
fm network vpc delete vpc-123
fm network vpc delete vpc-123 --force
fm network vpc delete vpc-123 --no-wait
Usage:
fm network vpc delete <vpc-id> [flags]
Flags:
--force cascade-delete the VPC's own networking (refuses while anything is still running in it)
-h, --help help for delete
--no-wait return immediately instead of waiting for the deletion to complete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network vpc get
text
Get detailed information about a specific VPC.
Usage:
fm network vpc get <vpc-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network vpc list
text
List all VPCs.
Usage:
fm network vpc list [flags]
Flags:
-h, --help help for list
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network vpc route
text
Manage a VPC's static routes
Usage:
fm network vpc route [command]
Aliases:
route, routes
Available Commands:
add Add a static route to a VPC
list List a VPC's static routes
remove Remove a static route from a VPC
Flags:
-h, --help help for route
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm network vpc route [command] --help" for more information about a command.fm network vpc route add
text
Add one static route to a VPC.
The next hop is an address on a subnet attached to this VPC, or the reserved
token 'internet', which means "out this VPC's own internet gateway". A route is
matched on its DESTINATION only, so it applies to every instance in the VPC.
A DEFAULT ROUTE (0.0.0.0/0) sends all traffic leaving this VPC to your next hop.
While it is in place, Public IPs on instances in this VPC stop serving: the reply
is routed by this same table, and its destination is the internet client. DNS and
managed services keep working - they ride platform routes that out-specify a
default route. A default route also counts as TWO against this VPC's route limit.
Examples:
fm network vpc route add vpc-123 --destination 203.0.113.0/24 --next-hop 10.0.1.10
fm network vpc route add vpc-123 --destination 198.51.100.7/32 --next-hop internet
fm network vpc route add vpc-123 --destination 0.0.0.0/0 --next-hop 10.0.1.10
Usage:
fm network vpc route add <vpc-id> --destination <cidr> --next-hop <address|internet> [flags]
Flags:
--destination string destination CIDR (required)
-h, --help help for add
--next-hop string next hop: an address on an attached subnet, or "internet" (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network vpc route list
text
List the static routes you own on a VPC.
Platform-owned routes are not listed: they are not part of your route set and
cannot be removed, so showing them would offer a route you cannot act on.
Examples:
fm network vpc route list vpc-123
Usage:
fm network vpc route list <vpc-id> [flags]
Flags:
-h, --help help for list
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network vpc route remove
text
Remove the route with that destination from a VPC.
A default route is removed WHOLE: 0.0.0.0/0 takes out both of the rows the
platform stores it as, in one write, or neither. Removing it hands egress back to
this VPC's own gateway and Public IPs on instances here start serving again.
A removal names the next hop it read, so if something else changed the route in
between, nothing is written and the command reports a write conflict rather than
success. Run it again.
Examples:
fm network vpc route remove vpc-123 203.0.113.0/24
fm network vpc route remove vpc-123 0.0.0.0/0
Usage:
fm network vpc route remove <vpc-id> <destination> [flags]
Aliases:
remove, delete
Flags:
-h, --help help for remove
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network vpc tags
text
Read and replace a VPC's tags
Usage:
fm network vpc tags [command]
Aliases:
tags, tag
Available Commands:
get Show a VPC's tags
set Replace a VPC's tags
Flags:
-h, --help help for tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm network vpc tags [command] --help" for more information about a command.fm network vpc tags get
text
Show a VPC's tags
Usage:
fm network vpc tags get <vpc-id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm network vpc tags set
text
Replace a VPC's tags in place with exactly the given set
(replace semantics — any tag not listed is removed).
The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm network vpc tags get' and pass them
all back.
Use --clear to remove every tag.
Examples:
fm network vpc tags set vpc-123 --tag env=prod --tag owner=team-a
fm network vpc tags set vpc-123 --clear
Usage:
fm network vpc tags set <vpc-id> --tag <key=value> [--tag <key=value> ...] [flags]
Flags:
--clear remove ALL tags (mutually exclusive with --tag)
-h, --help help for set
--tag strings tag in key=value format (repeatable; replace semantics)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)