flex.planeflex.plane
Virtual Datacenters

VDC Networking

How networking is scoped and isolated within a Virtual Datacenter.

Networks in flex.plane are scoped to Virtual Datacenters. When you create a network inside a VDC, it is only visible and usable within that VDC. This isolation is fundamental to multi-tenancy. Tenants cannot see or interact with each other's networks, even if they share the same underlying physical infrastructure.

Understand VDC network isolation

Every network belongs to exactly one VDC. This scoping is enforced at every layer:

  • Creation: When you create a network, it is automatically associated with the VDC specified in the FlexPlane-VDC-ID header.
  • Listing: Querying networks only returns networks belonging to the current VDC.
  • VM attachment: VMs can only connect to networks within their own VDC.
  • Naming: Network IDs are prefixed with the VDC ID internally, so two VDCs can both have a network called web without conflict.

This means tenants can design their network topology independently. Tenant A can use 10.100.0.0/24 for their web tier while Tenant B uses the exact same CIDR range for something completely different. The networks are isolated at Layer 2.

VDC network isolation applies to the virtual networks managed by flex.plane. The underlying physical network and the Tailscale mesh are shared infrastructure, but virtual networks are fully isolated per VDC.

Use the edge gateway

Each VDC gets an edge gateway that connects its virtual networks to the outside world. The edge gateway:

  • Routes between VDC networks. VMs on different networks within the same VDC can communicate through the gateway. This is automatic. If two networks exist in the VDC, the gateway routes between them.
  • Provides external access. VMs reach the internet and external services through the gateway.
  • Runs a firewall. Inbound and outbound traffic at the VDC boundary passes through the gateway firewall.

The gateway assigns itself an IP on every network in the VDC. This IP serves as the default gateway for VMs on that network.

The edge gateway detail page shows all connected networks with their gateway IP addresses.

When a new network is added to the VDC, the edge gateway automatically connects to it. No manual configuration needed.

Connect VMs to VDC networks

When creating or configuring a VM, you attach network interfaces that reference networks within the VDC. Each interface gets an IP address from the network's range automatically.

A VM can have up to 4 network interfaces, and they can be on different networks within the same VDC. This is useful for multi-homed configurations:

  • Interface 0: Management network (10.0.0.0/24)
  • Interface 1: Application network (10.1.0.0/24)
  • Interface 2: Database network (10.2.0.0/24)

Traffic between these networks flows through the edge gateway, where firewall rules can control access.

Keep network design simple. For most workloads, a single network per VDC is sufficient. Use multiple networks when you have a genuine need for Layer 2 isolation between workload tiers (e.g., separating database traffic from web traffic).

A few things to keep in mind:

  • Cross-VDC networking is not supported. VMs in different VDCs cannot communicate over virtual networks. If you need cross-tenant communication, use external endpoints.
  • IP ranges should not overlap with the Tailscale mesh. The mesh uses 100.64.0.0/10 by default. Avoid this range for your virtual networks.
  • Gateway IP is reserved. The first usable IP in each network's CIDR is assigned to the edge gateway and is not available for VMs.

Manage VDC Members

Add, update, and remove users within a Virtual Datacenter.

Create a Network

Deploy an isolated virtual network with a defined IP range.