Frostmoln Docs

English

Svenska
Suomi
Norsk

English

Svenska
Suomi
Norsk

Appearance

VPCs ​

A Virtual Private Cloud (VPC) is an isolated private network for your tenant. Instances on the same VPC talk over private addresses; nothing crosses into another tenant's network.

Create a VPC ​

Under Network → VPCs → Create, give it a name, a region, and a CIDR block (a private IPv4 range — 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16; prefix between /16 and /28). A description and tags are optional.

Choose the VPC's internet connectivity here too — none (isolated) or public_ip (a Gateway). Nothing is pre-selected, and omitting the choice creates no gateway at all. See Internet connectivity below.

bash
fm network vpc create --name my-vpc --cidr 10.0.0.0/16 --gateway public-ip
hcl
resource "frostmoln_vpc" "main" {
  name = "my-vpc"
  cidr = "10.0.0.0/16"
}

Subnets ​

A VPC holds one or more subnets — CIDR blocks within the VPC range, each in an availability zone. Instances attach to a subnet and get a private IP from it; the subnet's own gateway address is assigned and DHCP enabled automatically — that is the route between subnets inside the VPC, not internet access. Both IPv4 and IPv6 are supported.

bash
fm network subnet create --name app --vpc my-vpc --cidr 10.0.1.0/24 --zone sweden-a
hcl
resource "frostmoln_subnet" "app" {
  name   = "app"
  vpc_id = frostmoln_vpc.main.id
  cidr   = "10.0.1.0/24"
  zone   = "sweden-a"
}

Plan ranges that don't overlap with networks you intend to connect to.

Internet connectivity ​

A VPC has no internet connectivity of its own, and it never acquires any without being asked. Outbound and inbound are separate things:

  • Outbound — the VPC needs a Gateway. Without one the VPC cannot reach the internet, resolve names (DNS), or talk to managed services. Choose one when you create the VPC, or add a gateway to an existing VPC — that is also the only way to change it later. In Terraform the VPC resource has no connectivity argument; use the frostmoln_gateway resource.
  • The gateway's source address — by default it is an address the platform picks. That address costs nothing: it uses none of your public IP quota, it appears in no list of yours, and it never reaches an invoice. It is also not stable — it is redrawn if the gateway or the VPC is rebuilt, so it must never be handed to a partner for an allow-list or published in DNS.
  • A stable outbound address — name a public IP of your own on the gateway. It is then listed among your public IPs, counts against your quota and is billed as a public IP, and it survives the gateway and the VPC: delete and recreate either one, point the new gateway at the same public IP, and the VPC goes out through the same address as before. That is the only address safe to give to a partner or publish in DNS. See Choose the address the gateway uses.
  • Inbound — attach a public IP to the instance or load balancer and allow the traffic in its security group. Both directions travel the same path, so associating a public IP in a VPC that has no Gateway gives the VPC one.

Outbound connections work without a public IP of your own: instances in a VPC that has a Gateway reach the internet through the gateway's address.

The shared-address mode (nat) has been withdrawn permanently. A VPC still on it keeps working, but it should be moved onto an ordinary Gateway — see The shared-address mode has been withdrawn. While a VPC is still on it, only TCP and UDP are carried, so ping and traceroute from an instance time out there even when the instance has working internet access; test with something TCP-based instead, such as curl https://example.com.

Delete ​

A VPC can only be deleted once its child resources are gone — remove instances, subnets, security groups, and public IPs first. Its Gateway goes with it.

A public IP of yours that the Gateway was going out through is not given up with the VPC: it stays allocated to your tenant with the same address, ready to be attached to the next VPC's gateway. A gateway on the platform's default address has nothing of yours to keep — that address goes with it.