cloudscaleKnowledge Base

Capabilities

Internet gateway: A router can act as an internet gateway with source network address translation (SNAT) for a private IPv4 network. SNAT enables servers on the private network to initiate connections to hosts in the internet, whereas connections from the internet into the private network are not possible.

Since the internet gateway only supports outbound connections, other measures are required for accessing the servers, for example a jump host for SSH access or a Load Balancer for exposing services.

Routing between private networks: A router can be connected to multiple private networks, which automatically enables connectivity between the networks.

Tooling

Our Terraform provider, Ansible collection, and Go SDK support routers, so you can manage them as code alongside your other resources. You can also configure routers directly via our API, for more information see the API documentation or the example below.

Limitations

Routers cannot be managed in the control panel yet: Routers are listed on the "Interfaces" tab of a network and in the billing section, but they cannot be managed via the cloud control panel yet.

Routers cannot be updated yet: If you need to change a router's configuration, you will need to create a new one rather than updating the existing one in place.

A subnet's gateway address cannot be in the DHCP range: You can create a router interface using an address inside the DHCP range, but that address cannot be used as the subnet's gateway address and therefore will not be advertised to servers as the default route. For this reason, we recommend placing router interfaces on addresses outside the DHCP range (for example, 10.10.10.1 in a 10.10.10.0/24 subnet) when you intend to use them as an internet gateway.

Set up an internet gateway

Prerequisites:

• A cloudscale account with sufficient credits
• A project with a read/write API token

# Replace <token> with your project's read/write API token
AUTH_HEADER="Authorization: Bearer <token>"

1. Create a private network with an MTU of 1500 (recommended for networks that route to the internet)

curl -i -H "$AUTH_HEADER" \
  -F name="my-network-name" \
  -F zone=lpg1 \
  -F mtu=1500 \
  -F auto_create_ipv4_subnet=false \
  https://api.cloudscale.ch/v1/networks

# Replace <network-uuid> with the UUID returned by the network create request:
network_uuid="<network-uuid>"

curl -i -H "$AUTH_HEADER" \
  -H "Content-Type: application/json" \
  --data '{
    "cidr": "10.10.10.0/24",
    "gateway_address": "10.10.10.1",
    "network": "'"$network_uuid"'"
  }' \
  https://api.cloudscale.ch/v1/subnets

# Replace <subnet-uuid> with the UUID returned by the subnet create request:
subnet_uuid="<subnet-uuid>"

2. Create a router in the same zone as the network with internet_gateway set to true

curl -i -H "$AUTH_HEADER" \
  -F name="my-internet-gateway" \
  -F internet_gateway=true \
  -F zone=lpg1 \
  https://api.cloudscale.ch/v1/routers

# Replace <router-uuid> with the UUID returned by the router create request:
router_uuid="<router-uuid>"

3. Create and attach a router interface with the IP address set as gateway_address in the subnet create request

curl -i -H "$AUTH_HEADER" \
  -H "Content-Type: application/json" \
  --data '{
    "network": "'"$network_uuid"'",
    "addresses": [{
      "subnet": "'"$subnet_uuid"'",
      "address": "10.10.10.1"
    }]
  }' \
  https://api.cloudscale.ch/v1/routers/$router_uuid/interfaces

4. Create a server connected to the private network

Note: This server will not be accessible via SSH unless a jump host or a similar mechanism is set up. However, a password can be set to connect via VNC in the control panel. The default username for the Debian 13 image used in this setup is "debian".

# Replace <secret> with a password (Debian 13 and similar images will force a password update upon first login):
secret="<secret>"

curl -i -H "$AUTH_HEADER" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "my-server-name",
    "zone": "lpg1",
    "flavor": "flex-4-2",
    "image": "debian-13",
    "volume_size_gb": 50,
    "interfaces": [
      {"network": "'"$network_uuid"'"}
    ],
    "password": "'"$secret"'"
  }' \
  https://api.cloudscale.ch/v1/servers

5. Connect to the server via VNC (you can find the link on the server detail view in the control panel) and verify the connectivity over the internet gateway

# The server should be able to access cloudscale.ch via the internet gateway
ping cloudscale.ch
# If installed, you can use traceroute to verify that the packets are routed through the internet gateway
traceroute cloudscale.ch

The server can access the internet e.g. to get its package updates, but the server is not reachable from outside. This isolation gives an additional layer of security against attacks from outside, since there is no direct path for an attacker to exploit.