Networking and security groups

Every app and machine you run gets a network card on your own private network. The network spans the whole realm: a container on one server and a virtual machine on another reach each other by address and by name, as if they shared a switch. Nobody else’s workloads are on it.

Open Networks to see it.

Your network

You have one network per owner: one for you, and one for each organisation you work in. A workload keeps its address and its MAC address for as long as it exists, also when Velrix moves it to another server.

On the Networks tab, the network shows its subnet, its gateway and every network card on it, with the server each runs on. The network appears when your first workload runs.

Workloads find each other by name: each network has its own DNS, which answers for every workload on it and for nothing on anyone else’s.

Security groups

With no security groups, every workload on your network can reach every other. A security group narrows that.

• Workloads in the same group reach each other.
• Workloads in no group form the network’s default group.
• Between groups, nothing opens unless a rule of the receiving group lets it in.
• Outward, a group’s members may open anything, until the group has an outbound rule. Then only what its outbound rules allow, its own members and DNS.
• Replies to an allowed connection always pass.

Make a group

1. In Networks › Security groups, choose New group. Give it a short name, such as web or db.
2. Choose Add rule. Pick the Direction, the Protocol, the Ports (one port, a range such as 8000-8100, or empty for all), and the Other side: another group of yours, an address range, or anyone.
3. Choose Add workload to put apps and machines in it, or pick the group when you make one: the create form has a Security groups tab.

For example, a db group with the rule “In: TCP 5432 from web” lets the web group’s workloads reach the database and nothing else.

An app’s or machine’s Settings shows which groups it is in, with Add to group and Open in Networks. Copies of a scaled app are in their app’s groups.

Changes reach the servers within seconds. Removing a rule also cuts the connections it let through, not only new ones. A group that another group’s rule names can’t be deleted.

How groups are enforced

Each server judges every frame once, where it enters the network: at the workload’s network card, in the kernel. A workload can only send from its own address, so a rule naming a group can’t be fooled by a forged one. A network card that the server doesn’t know yet gets nothing in.

At launch, groups are enforced by the eBPF dataplane: programs in each server’s kernel judge traffic at the network card, and replies are recognised from a short-lived cache kept per network, with no shared connection table between customers. One customer’s traffic can’t push out another’s.

Internet access

New networks have no internet access: a workload can answer what reaches it through a hostname, a floating IP or a load balancer, but it can’t open connections to the internet. An app shows “No internet access” at the top of its page while that holds.

Turn it on in Networks (Internet access, Turn on), or on the app’s Settings, if you may. It is the Network egress policy, so your operator or your organisation may set it for you. The tab shows the address your traffic leaves as.

A workload with a floating IP or a public IPv6 address reaches the internet through it either way.

Network policy

Your provider, your organisation or a project can apply a network policy template: a short list of outbound rules, such as Block outbound SMTP (port 25). A connection it refuses fails at once.

Networks › Network policy lists every template that applies to you and where it comes from. One that your platform or provider applied you can’t remove yourself: choose Ask to lift and say why. One that your organisation or project applied, you take off again under Apply templates here.

Logs

Your operator may turn on Network flow logs and DNS query logs for a scope. You then find them in Logs, with the source, destination, port and verdict of each flow, or the names asked and their answers.

Next

• Floating IPs and load balancers: public addresses for your workloads.
• Networking concepts: how the pieces fit together.