Private by default. Reachable when you say so.
Put your applications, databases and services on a private network of their own - then reach it from a laptop, an office, or a cloud account you already run.
A network your workloads share, and nothing else can see.
One network per region
Your apps, databases and services join a private network of their own. An app on one resource can reach a database on another, and nothing outside can reach either.
Ready on creation
A new network comes up with a subnet already carved out and a DNS resolver of its own. Create it, attach the database, attach the application, done.
Names, not addresses
A workload answers to a name from the network's own resolver. That name is what belongs in a connection string - the address behind it moves whenever the workload rolls.
Your own address range
The default is 10.224.0.0/16. Anything RFC1918 and /22 or larger works, and a range that would clash with the platform is refused as you type it rather than failing later.
Attaching restarts the workload
A network interface cannot be added to a running container, so attaching a database restarts it. An application created with a network chosen up front skips the restart entirely.
Scoped to a region
A network cannot span regions. A workspace working in two gets one network in each, and a workload can only join a network in its own region.
Four terminators, and you can run more than one.
WireGuard
Per person or per machine. Add a device, download its configuration, import it. The private key is never stored, so the file downloads exactly once - if it is lost, delete the device and add another.
Tailscale
Join a tailnet you already run with an auth key, then tell the network which ranges live behind it.
Cloudflare WARP
Join a Cloudflare organization with a service token, with the same route configuration as Tailscale.
IPsec site-to-site
Join a whole remote network: an AWS VPC, a data centre, an office. Each tunnel gets a public address of its own to configure on the far side.
Tailscale and Cloudflare WARP need routes telling the network which ranges live behind them, because those ranges live in your configuration rather than ours. Routes are staged and applied together, because applying restarts every attached workload - so you add every range you need and pay that cost once.
The network is free. The way in is not.
The network itself
Private networks, subnets, the resolver and workload attachments are on every plan. Creating one does not change your bill.
Per VPN gateway, per month
Charged per gateway rather than per network, so a network running both WireGuard and Tailscale is charged twice. Included on Enterprise.
Per site-to-site tunnel, per month
Each tunnel permanently holds one of the region's public addresses, which is why it is priced separately and limited to the workspace owner. Included on Enterprise.
Give your database an address only your apps can reach.
Networking lives in your workspace sidebar. Create a network, attach a workload, and add a VPN when you need to reach it from outside.
Open the dashboard