Features & limits

Documentation Index

Fetch the complete documentation index at: https://docs.rafftechnologies.com/llms.txt

Use this file to discover all available pages before exploring further.

_{Updated May 8, 2026}

​

Features

​

Network technology

• VXLAN-backed — every VPC is its own VXLAN segment with a unique 24-bit VNI (RFC 7348)
• Multicast mode — VXLAN frames travel over the underlay’s multicast group; no central router bottleneck
• L2 inside the VPC — VM-to-VM traffic in the same VPC goes directly between hypervisors, not via a router hop
• Encrypted at rest, isolated by VNI — two VPCs in the same account can use the same CIDR and never see each other

​

CIDR

• Prefix range: /16 to /28 (chosen at create time, fixed for the life of the VPC)
• Allowed ranges: RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 6598 (100.64.0.0/10)
• Reserved per VPC: .0 (network), .1 (gateway), .255 (broadcast for /24 and larger)
• Overlap allowed — two VPCs can share a CIDR; isolation is by VNI, not address space
• No resize — to grow, create a new VPC and migrate

​

MTU

• VPC interface MTU: 8950 (jumbo frames, 9000 minus 50 bytes of VXLAN overhead)
• Most workloads benefit transparently via Path MTU Discovery
• Tunnels and overlays on top of the VPC must subtract their own headers from 8950

​

DNS

• Primary DNS: required, defaults to 8.8.8.8 (Google Public DNS)
• Secondary DNS: optional fallback — leave blank if you don’t need one
• Editable per VPC at any time — point at Cloudflare (1.1.1.1), Quad9 (9.9.9.9), an internal resolver inside the VPC, etc.
• Applied via DHCP — new VMs pick it up at boot, existing VMs on lease renewal (or via dhclient / ipconfig /renew inside the guest)

​

Internet Gateway (optional, per VPC)

Two mutually exclusive options to give VMs in the VPC outbound internet access without each VM holding a Public IP: VPCs without a gateway have no outbound internet — VMs reach the internet only via their own Public IP attachments. The gateway choice is mutually exclusive (one or none, not both) and switchable later, with a brief outbound-traffic outage during the switch.

​

Port forwarding (with Platform Router)

• Up to 10 rules per VPC
• Map public_port on the router’s IP → private_ip:private_port inside the VPC
• TCP and UDP supported
• Rules apply within seconds of save

​

VM membership

• A single VM can belong to multiple VPCs simultaneously — each VPC gives it a separate NIC
• A VM can also have one or more public IPs alongside its VPC interfaces
• Detach is blocked if it would leave the VM with zero network interfaces
• VPCs are region-scoped — only VMs in the same region can attach

​

Pricing

There is no per-VPC fee, no per-CIDR fee, no per-VNI fee, and no per-DHCP-lease fee. You can hold dozens of VPCs at zero cost — pricing only kicks in when a VPC has a Firewall Appliance gateway or when its members generate public-internet egress.

​

Limits

​

Region

​

What’s not available today

• VPC peering — placeholder under the Peering tab; ships in a future release
• Load Balancer as a service — placeholder under the Services tab
• VPN Gateway as a service — placeholder under the Services tab; the Firewall Appliance covers this case in the meantime via OPNsense’s built-in WireGuard / IPsec / OpenVPN
• Cross-region VPCs — VPCs are regional only
• Custom route tables / transit gateway / VPC endpoints — not on the near-term roadmap

​

See also