Skip to main content

Private network between two cloud servers

When your application runs on several servers (for example a web server and a database), the servers should talk over a private network: the database opens no port to the internet, and traffic between servers on an Arianet private network has no traffic cost.

In this tutorial you create a private network, attach two servers (web-1 and db-1) to it, test the connection, and make MariaDB reachable only on the private IP.

Prerequisites​

In the examples the network is 10.0.0.0/16, the subnet 10.0.1.0/24, web-1 is 10.0.1.10 and db-1 is 10.0.1.11.

1. Create the private network​

In the panel: in the cloud menu open Networking → Private networks («شبکه ← شبکه‌های خصوصی») and create a network. When creating a server you can also pick a private network in step 4 "Networking" (Arianet Cloud panel guide).

With the CLI:

arianet cloud datacenters      # datacenter codes, e.g. ovh
arianet cloud networks create --name backend --datacenter ovh \
    --ip-range 10.0.0.0/16 --subnet-ip-range 10.0.1.0/24 --wait

ip-range must be a private range and subnet-ip-range must be inside it. Without a subnet range, one is made from ip-range.

2. Attach the servers​

You can create a new server already attached to the network:

arianet cloud servers create --name db-1 --datacenter ovh --plan 3 --image ubuntu-24.04 \
    --ssh-key "$(cat ~/.ssh/id_ed25519.pub)" --network <network-id> --wait

Or attach an existing server and pick its private IP yourself (without --ip one is picked for you):

arianet cloud servers attach-network <web-1-id> --network <network-id> --ip 10.0.1.10
arianet cloud servers attach-network <db-1-id>  --network <network-id> --ip 10.0.1.11

See each server's private IP, subnet and MAC through the API:

curl -s https://api.ariaservice.net/cloud/v1/servers/<server-id>/networking \
  -H "Authorization: Bearer $ARIANET_TOKEN"

In the answer, the networks array has ip, subnet, mac and ready for each network.

3. Check the interface on the server​

On each server:

ip -br addr

You should see an interface with the private IP (for example 10.0.1.10/24). If the new interface is there but has no address (usually when the network was attached after the server booted), configure it with netplan. Match the interface's MAC (ip -br link) against mac in the API answer and create this file:

sudo tee /etc/netplan/60-private.yaml > /dev/null <<'EOF'
network:
  version: 2
  ethernets:
    private0:
      match:
        macaddress: "fa:16:3e:00:00:00"
      addresses:
        - 10.0.1.10/24
EOF
sudo chmod 600 /etc/netplan/60-private.yaml
sudo netplan try
  • Replace the MAC and IP with your server's values. On db-1 use 10.0.1.11/24.
  • netplan try applies the settings temporarily and rolls back unless you press Enter within 120 seconds; if your SSH session survives, press Enter.
  • No gateway is needed for this subnet; servers in one subnet reach each other directly.

4. Test the connection​

From web-1:

ping -c 3 10.0.1.11

If ping gets no answer, ufw on db-1 may block ICMP or the private network traffic. Allow the whole private network on both servers:

sudo ufw allow from 10.0.0.0/16

5. Example: MariaDB on the private network only​

On db-1:

sudo apt install -y mariadb-server
sudo tee /etc/mysql/mariadb.conf.d/60-private.cnf > /dev/null <<'EOF'
[mysqld]
bind-address = 10.0.1.11
EOF
sudo systemctl restart mariadb
sudo ss -tlnp | grep 3306        # should show 10.0.1.11:3306

sudo mariadb <<'SQL'
CREATE DATABASE app;
CREATE USER 'app'@'10.0.1.%' IDENTIFIED BY 'CHANGE-ME-strong-password';
GRANT ALL PRIVILEGES ON app.* TO 'app'@'10.0.1.%';
SQL

sudo ufw allow from 10.0.1.0/24 to any port 3306 proto tcp

From web-1:

sudo apt install -y mariadb-client
mariadb -h 10.0.1.11 -u app -p app -e 'SELECT 1;'

The database is now reachable only from the private network. From your own computer, nc -zv -w 3 <db-1-public-ip> 3306 should time out.

A server without a public IP​

For more security you can create the database server with the "Private network only" option in the panel (or --no-ipv4 --no-ipv6 in the CLI). Such a server cannot be reached from the internet; SSH to it through another server on the same network (for example ssh -J deploy@WEB1_PUBLIC_IP deploy@10.0.1.11). A server without a public IP needs an outbound path to reach the internet (for example for apt update); Arianet Cloud has routers and NAT gateways for that (Networking → Routers in the menu, and /nat-gateways in the cloud API).

Common errors​

ProblemFix
The network is not listed when creating a serverThe network and the server must be in the same data center.
The second interface has no addressDo step 3 (netplan).
netplan warns Permissions ... are too opensudo chmod 600 /etc/netplan/*.yaml
Host 'x' is not allowed to connect to this MariaDB serverThe user was created for 'app'@'10.0.1.%' but you connect from another IP, or bind-address is wrong.
Can't connect to MySQL server on '10.0.1.11'ufw on db-1 does not allow port 3306 from the private network, or MariaDB listens on 127.0.0.1.

Next steps​

Create your network​

An Arianet Cloud private network carries traffic between your servers off the internet and with no traffic cost. In the Arianet panel, go to Cloud server / Cloud Computing → Networking → Private networks and attach your servers.