--- title: "VPC networks, subnets and routers" slug: "vpc-networks-subnets" source: "https://app.cloudpe.com/help/vpc-networks-subnets" updated: "2026-08-27T05:22:14.356Z" --- # VPC networks, subnets and routers ## Overview A VPC network on CloudPE is a private Layer 2 domain scoped to one project in one region. You divide it with subnets (an IP block in CIDR notation), and you connect it to the outside world with a router: the router takes an external gateway on one side and an interface on each private subnet on the other. That combination is what gives instances outbound connectivity and what floating IPs are mapped through. Networks and routers live under **VPC & Networks** and **Routers** in the NETWORK group of the dashboard. Both are project- and region-scoped: a network created in one region cannot be attached to a router or instance in another. ## Before you start - Your project must exist and be provisioned in the target region before networks or routers can be created in it. - You need `networks:read` to view networks and `networks:create` to create them; adding or removing subnets requires `networks:update` and `networks:delete` respectively. - You need `routers:read` to view routers, `routers:create` to create them, and `routers:update` to attach or detach interfaces and to set the gateway. - Network and router creation is subject to your project quota. - Plan your CIDR ranges up front. A subnet you attach to a router must not overlap any other subnet already attached to that same router. - Networks registered as dedicated (customer-owned) networks are read-only in the dashboard: you cannot add or delete their subnets, or attach their subnets to a router. ## Steps ### 1. Create a network 1. Open **VPC & Networks** from the NETWORK group in the sidebar. ![](/kb/networking/vpc-networks-subnets-01-networks.png) 2. Select the region and project you want the network to live in. 3. Click **Create network**. 4. In the **Create Network** dialog, give the network a name and, optionally, a description. ![](/kb/networking/vpc-networks-subnets-02-create-network.png) 5. Confirm. The network record is created first and then provisioned in the underlying cloud; it becomes usable once provisioning completes. ### 2. Add a subnet Open the network you created and add a subnet to it. A subnet needs: - a name; - a CIDR block in CIDR notation, for example `10.0.0.0/24`; - optionally a gateway IP, DNS nameservers, and whether DHCP is enabled (DHCP is on by default). A network with no subnet has no addressable IP space, so instances cannot be attached to it usefully. ### 3. Create a router and set its gateway 1. Open **Routers** from the NETWORK group. ![](/kb/networking/vpc-networks-subnets-03-routers.png) 2. Click **Create Router**, then name the router and pick the region and project. 3. Set the external gateway network. This is what gives the attached subnets outbound NAT and is the network floating IPs are drawn from. You can select the gateway at create time or set it later on an existing router. ### 4. Attach subnets to the router Add a router interface for each private subnet that needs to reach the internet or reach other subnets through the router. The subnet must belong to the same project as the router, and its CIDR must not overlap a subnet already attached. To detach, remove the interface for that subnet. A router cannot be deleted while it still has interfaces or VPN services attached. ## API All calls use a bearer token. Replace the angle-bracket placeholders with your own values. | Method | Path | |---|---| | GET | `/api/v1/networks` | | POST | `/api/v1/networks` | | GET | `/api/v1/networks/external` | | GET | `/api/v1/networks/{network_id}` | | DELETE | `/api/v1/networks/{network_id}` | | POST | `/api/v1/networks/{network_id}/subnets` | | DELETE | `/api/v1/networks/{network_id}/subnets/{subnet_id}` | | GET | `/api/v1/routers` | | POST | `/api/v1/routers` | | GET | `/api/v1/routers/{router_id}` | | DELETE | `/api/v1/routers/{router_id}` | | GET | `/api/v1/routers/{router_id}/interfaces` | | POST | `/api/v1/routers/{router_id}/add-interface` | | POST | `/api/v1/routers/{router_id}/remove-interface` | | PUT | `/api/v1/routers/{router_id}/gateway` | | GET | `/api/v1/k8s/networks` | | GET | `/api/v1/vdi/networks` | Create a network: ```bash curl -X POST https://app.cloudpe.com/api/v1/networks \ -H 'Authorization: Bearer ' \ -H 'Content-Type: application/json' \ -d '{ "name": "app-net", "region_id": "", "project_id": "", "description": "application tier" }' ``` Add a subnet to that network: ```bash curl -X POST https://app.cloudpe.com/api/v1/networks//subnets \ -H 'Authorization: Bearer ' \ -H 'Content-Type: application/json' \ -d '{ "name": "app-subnet", "cidr": "10.0.0.0/24", "gateway_ip": "10.0.0.1", "enable_dhcp": true, "dns_nameservers": ["10.0.0.2"] }' ``` Create a router with an external gateway: ```bash curl -X POST https://app.cloudpe.com/api/v1/routers \ -H 'Authorization: Bearer ' \ -H 'Content-Type: application/json' \ -d '{ "name": "app-router", "region_id": "", "project_id": "", "external_gateway_network_id": "" }' ``` Attach a subnet to the router: ```bash curl -X POST https://app.cloudpe.com/api/v1/routers//add-interface \ -H 'Authorization: Bearer ' \ -H 'Content-Type: application/json' \ -d '{"subnet_id": ""}' ``` Change or clear the gateway on an existing router: ```bash curl -X PUT https://app.cloudpe.com/api/v1/routers//gateway \ -H 'Authorization: Bearer ' \ -H 'Content-Type: application/json' \ -d '{"external_network_id": ""}' ``` Use `GET /api/v1/networks/external` to discover the external networks available to your project in a region. ## Limits & billing - Private networks and subnets are quota-limited rather than metered — the quota is enforced per project, and creation fails once it is reached. - Public IP addressing is what carries a charge. Floating IP allocation and its hourly usage record are described in the floating IPs article. - Networks and routers block project deletion: a project that still contains networks or routers cannot be deleted until they are removed. ## Troubleshooting | Error | What it means | What to do | |---|---|---| | `Network not yet provisioned in cloud infrastructure` | The network record exists but provisioning has not completed. | Wait for the network to become active, then retry the subnet or interface operation. | | `Region not found or inactive` | The region in the request is not available to you. | Re-select the region on **VPC & Networks** and retry. | | `Project is not provisioned in cloud infrastructure` | The project has no backing tenant in that region yet. | Wait for project provisioning to finish, or pick a project that is already active in the region. | | `Quota exceeded: {…}` | You have reached the network or router quota for the project. | Delete unused networks or routers, or request a quota increase through support. | | `Subnet CIDR overlaps a subnet already attached to this router — attach a subnet with a non-overlapping CIDR.` | Two subnets on the same router use overlapping IP space. | Create the subnet with a CIDR that does not overlap anything already attached to that router. | | `Subnet does not belong to the same project as the router` | Cross-project attachment attempt. | Attach only subnets from the router's own project. | | `External gateway network '{…}' not found or not accessible to this project` | The chosen external network is not visible to the project. | List external networks for the project and region, then pick one from that list. | | `Router still has {…} interface(s) attached. Please detach all interfaces before deleting the router.` | The router is still wired to subnets. | Remove each router interface, then delete the router. | | `Router still has {…} VPN service(s) attached. Please delete all VPN services before deleting the router.` | VPN services depend on this router. | Delete the VPN services first. | | `Cannot add subnets to a referenced network` | The network is a dedicated, customer-owned network that CloudPE only references. | Subnet layout for these networks is managed by operations; raise a support ticket. | | `Cannot attach a subnet from a referenced network to a router` | Same as above, for router interfaces. | Use a CMP-managed network for router interfaces. | | `Router no longer exists in the cloud provider. It may have been deleted externally.` | The backing router was removed outside CloudPE. | Delete the stale entry and recreate the router. | | `Cannot delete project: it contains {…} networks. Delete all networks first.` | Project deletion blocked by remaining networks. | Delete the networks (and any routers) in the project first. | ## FAQ **Does a network need a router?** Only if its instances must reach the internet or be reachable through a floating IP. An isolated network with a subnet works fine for east-west traffic inside the project. **Can one router serve several subnets?** Yes. Add one interface per subnet, as long as the CIDRs do not overlap. **Can I move a network between projects or regions?** No. Networks and routers are fixed to the project and region they were created in. Create a new network in the target project instead. **How do I remove the internet gateway from a router without deleting the router?** Set the router gateway with a null external network. The private interfaces stay attached. **Why is a network I can see in Kubernetes or VDI missing from the networks list?** Those surfaces use their own region- and project-filtered listings. Check that you are viewing the same region and project on **VPC & Networks**. ## Related - [Security groups and firewall rules](/help/security-groups-firewall) - [Floating IP allocation](/help/floating-ips-allocation) - [Create and manage virtual machines](/help/create-manage-virtual-machines)