A VPC on servers you own.
Closed to the internet until you open it.
Every project gets a private network that spans its sites: subnets in IPv4 and IPv6, a firewall compiled from your organization’s rules and your own, NAT with fixed addresses, and private names. Clusters, databases and load balancers plug into it, and every change is a plan you read before it applies.
Describe it once.
Frazer builds it on your servers.
A network, its subnets, firewall policies, routes, NAT and addresses are API objects. One plan checks the address plan, compiles the firewall and states what will change. Applying it sends signed desired state to your site, where the network runs as an overlay on your servers’ private L2.
One firewall, four tiers.
Compiled into one list per target.
Policies live at the organization, the project and the network. Inside a tier the lowest priority number wins and a tie goes to deny; “go to next tier” hands a decision down. Frazer flattens every tier into one ordered list per target and shows it to you, next to the network policy from your Git that applies inside the cluster.
Every edit is a plan that says what it opens and to whom. A rule that admits the internet is flagged as a risk and waits for an approval.
Both address families.
From the first network.
Every network is dual-stack inside from day one, so nothing has to be rebuilt later. IPv4 stays the primary family, IPv6 is never NATed, and public IPv6 addresses are free.
| Layer | IPv4 | IPv6 |
|---|---|---|
| Network | From your organization’s RFC 1918 plan | A random ULA /48, or your own /48 |
| Subnet | /20 by default | A /64 from the network’s /48 |
| Cluster pods | /14 secondary range, routed per node | A ULA /56 per cluster, a /64 per node |
| Cluster services | /20 secondary range | A ULA /112 |
| Internet egress | The site’s NAT, fixed addresses | Never NATed; a public /64 per subnet |
| Public addresses | From your site’s pool, $3 a month each | From your site’s /56, free |
Overlapping ranges are refused by the database for both families.
Can A reach B?
Ask before you change.
A connectivity test reads Frazer’s own model: routes, the compiled firewall, NAT, load balancers and endpoints. It returns every hop with the rule that allowed or dropped the packet. The Assistant runs the same test through MCP when you ask why something cannot connect.
When the model says yes and the packet still fails, a trace follows the same packet through the data plane and a live probe sends real packets from the source.
# A network for the project, one subnet at your site
$ frazer network networks create main --project acme-production --dry-run
$ frazer network subnets create vint-hill-a --network main --site ovh-vint-hill \
--range 10.10.0.0/20 \
--secondary-range pods=10.64.0.0/14 --secondary-range services=10.96.0.0/20
# Open 443 to tagged targets at the organization tier
$ frazer network firewall-policies rules add base --org acme --allow tcp:443 \
--target-tags web --source 0.0.0.0/0
# A static public address in the region (addresses.md §4)
$ frazer network addresses create web --location us-virginia1$ frazer network connectivity-tests run --from vms/etl-worker-1 \
--to databases/storefront --port 5432
Result Unreachable · TCP 5432 · 4 hops
1 Source VM etl-worker-1 · 10.20.6.14
2 Subnet vint-hill-10-20-0-0-20 · same subnet as the endpoint
3 Firewall org 500 org-delegate-private → go to next tier
4 Firewall project 1900 deny-db-default · dropped
Nearest allow-db (project 1000) wants tag db-client; this VM has etl
Fix bind tag db-client to etl-worker-1 · opens 5432 to 1 VM · PlanEverything a network needs.
Nothing to assemble.
One network, every site
A network belongs to a project and spans its sites; each subnet lives at one site, IPv4 and IPv6 together.
A compiled firewall
Organization and network policies flattened into one ordered rule list per target, shown as effective rules.
NAT with fixed addresses
A default NAT per site on two of your servers with failover, so a partner can allowlist your egress.
Address plans that cannot overlap
Free ranges proposed for you; overlaps refused by a database constraint, for both families.
Private names
Every node, database endpoint and load balancer answers under
.internalfrom the network’s resolver.Can A reach B?
Ask before you change: every hop with the rule that allowed or dropped the packet.
Private endpoints
A managed database or Frazer Registry as an address inside your subnet, no public IP.
Peering, VPN and VLAN attachments
Connect networks, share subnets across projects, bring an office or a data-center VLAN in.
Closed by default.
Every opening is a plan.
Who may do what
- Organization admins
- Write the organization’s firewall policies. A project cannot reopen what they deny.
- Project admins
- Create networks, subnets, routes, NAT and the network’s policy, each as a plan.
- Anyone tagging a resource
- Needs
tags.bind, so nobody widens a rule by adding a tag. - Agents and MCP clients
- Read and run connectivity tests by default. Firewall, route and peering changes always go through plan and approval.
What is logged
- Every change: a plan you read first, then a numbered revision of the network.
- Every plan states its impact. “Opens 22/tcp from 0.0.0.0/0 on 14 VMs” is a risk flag that needs an approval.
- Every connectivity test, with each hop and the rule that decided it.
- Flow logs per subnet, with the verdict and the rule ID of every sampled flow.
At the cap
- No internet ingress by default. Frazer Link and the network’s own subnets may connect.
- Quotas per project and region: 2 public IPv4, 64 public IPv6, 256 internal addresses.
- A subnet warns at 80 % use; secondary ranges can be added later.
- Outbound port 25 is blocked by default on both families.
- A released public address is quarantined for 24 hours.
No per-GB network fees.
One price for public IPv4.
Networks, firewalls, routes and NAT have no fee of their own. A public IPv4 address costs $3.00 a month, whether used or idle; IPv6 addresses are free.
See every priceVPC and firewall, answered.
Do I have to design a network before I create a cluster?
No. Every project gets a network called default with a subnet at each site the project has capacity in, no internet ingress and NAT on. A new cluster takes free ranges Frazer proposes: a /20 for nodes, a /14 for pods and a /20 for services.
Can two projects use the same address range?
Yes. Each project’s network has its own logical router, so two projects can both use 10.10.0.0/20 and never see each other. They meet only when someone connects them, and peering needs ranges that do not overlap.
How do organization rules and my rules combine?
Policies live at the organization, the project and the network, and are evaluated in that order. Inside a tier the lowest priority number wins and a tie goes to deny; “go to next tier” hands a decision down.
Frazer compiles all tiers into one ordered list per target and shows it as the effective rules, next to the network policy from your Git that applies inside the cluster.
How does traffic reach the internet?
Through the default NAT at each site: source NAT on two of your servers with fast failover, leaving from fixed addresses a partner can allowlist. There is no per-GB fee. IPv6 is never NATed; a subnet reaches the IPv6 internet once it has a public /64.
What if my site’s network cannot carry an overlay?
It runs in site mode: one flat private VLAN per organization per site, network policy inside clusters, and L2 announcements or BGP for addresses. The API, the address plan, the firewall objects and the console stay the same.
Can an agent change my firewall?
Not on its own. MCP tools come from the same API: reading and connectivity tests are on by default, and firewall, route and peering changes always go through a plan and an approval.