# Network

Source: https://docs.quake.ai/docs/network
Markdown: https://docs.quake.ai/docs/network.md
> Connect Quake AI workloads with isolated project networks, subnets, routers, floating IPs, and security group firewall rules.

---

# Network

Every workload on Quake AI needs a network path to other instances, to the internet, or both. The Network service gives you isolated project networks with subnets and DHCP, routers for inter-network traffic, floating IPs for public access, and security groups for per-port firewall rules.

[OpenStack Neutron](https://docs.openstack.org/neutron/latest/) backs Network. For how Quake AI implements OpenStack, see [How Quake AI uses OpenStack](/docs/platform/migration/openstack).

## Start here

Start with [Create a network](/docs/network/how-to/create-network). It walks you through the private network and subnet that your instances attach to, which is the first piece of any topology you build here.

## Choose a pattern

| Pattern | Use it when |
| --- | --- |
| [Create a network](/docs/network/how-to/create-network) | Instances need an isolated project network with DHCP. |
| [Allocate floating IP addresses](/docs/network/how-to/allocate-floating-ips) | A running instance on a private network must be reachable from the internet. |
| [Create a security group](/docs/network/how-to/create-security-group) | You need to allow or deny ports on an instance. |
| [Private Network + VPN](/build/iac-templates/private-network-vpn) | You need site-to-site connectivity and want to provision it from an OpenTofu template. |

## How it works

<Figure caption="Network topology: PublicEphemeral for quick testing vs. production path with private networks, routers, and floating IPs.">

```d2
direction: down

internet: Internet {shape: cloud}

quick: Quick Testing {
  net: PublicEphemeral
  vm: Instance
  net -> vm: direct attach
}

internet -> quick.net: public IP

production: Production {
  router: Router
  fip: Floating IP
  sg: Security Groups

  private: Private Network {
    web: Web Server
    app: App Server
    db: Database
  }

  fip -> sg -> private
  private.web -> private.app -> private.db
}

internet <-> production.router
production.router -> production.fip
```

</Figure>

A Quake AI project starts with two pre-built networks. **PublicEphemeral** lets you attach an instance directly for quick testing; the instance gets a public IP but is fully exposed. **PublicStatic** is the production path: your instances live on private networks you create, and you route external traffic through routers and floating IPs with security groups filtering every connection.

The typical pattern is: create a **network** and one or more **subnets** that define IP ranges and DHCP settings. Attach a **router** to connect your network to the external gateway. Allocate **floating IPs** and associate them with public instances. Apply **security groups** to control inbound and outbound traffic at the port level.

For applications that need traffic distribution or TLS termination, run a reverse proxy such as Caddy, Nginx, HAProxy, or Traefik on a Compute instance. A CDN or WAF can provide an external edge in front of that origin. For site-to-site connectivity, deploy a self-managed VPN gateway (WireGuard or IPsec) on a Compute instance; see the [Private Network + VPN template](/build/iac-templates/private-network-vpn) for an OpenTofu configuration.

## Concepts

<DocsSectionLinks section="network/concepts" grouping="concepts" />

## How-to

<DocsSectionLinks section="network/how-to" />

## Related builds

<RelatedBuilds service="network" />

## Reference and operations

<ReferenceServiceLinks service="network" />

<ReferenceConsoleLinks service="network" />

[Operations](/docs/operations) covers connectivity runbooks when SSH or floating IPs fail.

Compute instances attach to at least one network. See [Compute](/docs/compute). For object storage over the network, see [Object storage](/docs/object).