The range must be private (inside 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16), from /16 to /29. A /24 gives 254 addresses. You can have up to 5 networks.
The server gets a second network card. A server can be on one private network at a time, and only on a network at its own location. If the console says the card is added at the next restart, restart the server from the console.
Nothing changes inside the server until you give the new card its address. On the Private network tab, select Set it up for me. It takes a few seconds and only touches the new card.
To do it yourself, open Or do it yourself on the same tab and paste the steps into the server as root. They find the card by its MAC address, so the card's name doesn't matter, and the address stays after a restart:
Then check it from another server on the network:
# ping -c 3 10.20.0.1
Traffic on a private network doesn't go through the servers' firewall rules in the console: every server on the network can reach every other one on any port. If you need to limit it, use the firewall inside the server, for example ufw or firewalld.
Only your own servers can join your networks. No other customer can see or reach them.
A network with no servers on it can be deleted on the Private networks page. Reinstalling a server keeps it on its network. A server on a private network can't be moved to another location until it's taken off.
Everything here works from the API too: GET and POST /private-networks, and GET and POST /services/{id}/private-network, with /leave and /configure. AI assistants connected to your account have the same tools, such as create_private_network and join_private_network.