Set up a private network between VPS servers

When your app spans several servers, the database and cache should not be reachable from the internet. A private network between VPS servers carries that internal traffic separately, often without bandwidth charges.

Before you start

• Two or more VPSs at the same provider and location (private networks are usually per data centre).
• Console access in case network changes cut SSH.
• If the provider has no private network, use a VPN instead; see Tailscale or WireGuard.

Enable the private network

1. In the provider panel, create a private network or VLAN and attach each server.
2. Note the private IP assigned to each (e.g. 10.0.0.2, 10.0.0.3), or choose your own if the provider leaves it to you.
3. A second network interface appears in the VPS, e.g. eth1 or ens4; check with ip a.

Configure the interface (Netplan)

If the provider does not configure it automatically, add to /etc/netplan/60-private.yaml:

network:
  version: 2
  ethernets:
    ens4:
      addresses: [10.0.0.2/24]
      mtu: 1450

No gateway is needed for a flat private subnet. Use the MTU your provider recommends. Apply with sudo netplan try. For AlmaLinux/Rocky use nmcli; see add IP addresses.

Bind services to private IPs

• MySQL/MariaDB: bind-address = 10.0.0.3 and create users limited to the app server's private IP: 'app'@'10.0.0.2'.
• Redis: bind 10.0.0.3 with a password or ACL; see secure Redis.
• Internal APIs: listen only on the private interface.

Firewall

Private does not mean trusted; other customers' servers are not on your network, but limit access anyway:

sudo ufw allow in on ens4 from 10.0.0.2 to any port 3306 proto tcp

Deny database ports on the public interface.

Test

1. ping 10.0.0.3 from the app server.
2. nc -vz 10.0.0.3 3306 succeeds privately, and the public IP refuses.

Troubleshooting

• Interface has no IP: configure it manually or check the provider's DHCP setting.
• Ping works, large transfers hang: MTU mismatch; lower the MTU.
• Database refuses connection: wrong bind address or user host.

Frequently asked questions

Is private network traffic encrypted?

Usually not; it is isolated but not encrypted. Use TLS or a VPN for sensitive data.

Can private networks span locations?

Typically not; connect locations with a VPN.

Does private traffic count toward bandwidth?

Often not, but check your provider's terms.

Next steps

• Tailscale private network
• MySQL replication
• Virtual networking