Skip to main content
Updated May 8, 2026

​
Features

​
Network technology

  • VXLAN-backed — every VPC is its own VXLAN segment with a unique 24-bit VNI (RFC 7348)
  • Multicast mode — VXLAN frames travel over the underlay’s multicast group; no central router bottleneck
  • L2 inside the VPC — VM-to-VM traffic in the same VPC goes directly between hypervisors, not via a router hop
  • Encrypted at rest, isolated by VNI — two VPCs in the same account can use the same CIDR and never see each other

​
CIDR

  • Prefix range: /16 to /28 (chosen at create time, fixed for the life of the VPC)
  • Allowed ranges: RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 6598 (100.64.0.0/10)
  • Reserved per VPC: .0 (network), .1 (gateway), .255 (broadcast for /24 and larger)
  • Overlap allowed — two VPCs can share a CIDR; isolation is by VNI, not address space
  • No resize — to grow, create a new VPC and migrate

​
MTU

  • VPC interface MTU: 8950 (jumbo frames, 9000 minus 50 bytes of VXLAN overhead)
  • Most workloads benefit transparently via Path MTU Discovery
  • Tunnels and overlays on top of the VPC must subtract their own headers from 8950

​
DNS

  • Primary DNS: required, defaults to 8.8.8.8 (Google Public DNS)
  • Secondary DNS: optional fallback — leave blank if you don’t need one
  • Editable per VPC at any time — point at Cloudflare (1.1.1.1), Quad9 (9.9.9.9), an internal resolver inside the VPC, etc.
  • Applied via DHCP — new VMs pick it up at boot, existing VMs on lease renewal (or via dhclient / ipconfig /renew inside the guest)

​
Internet Gateway (optional, per VPC)

Two mutually exclusive options to give VMs in the VPC outbound internet access without each VM holding a Public IP: VPCs without a gateway have no outbound internet — VMs reach the internet only via their own Public IP attachments. The gateway choice is mutually exclusive (one or none, not both) and switchable later, with a brief outbound-traffic outage during the switch.

​
Port forwarding (with Platform Router)

  • Up to 10 rules per VPC
  • Map public_port on the router’s IP → private_ip:private_port inside the VPC
  • TCP and UDP supported
  • Rules apply within seconds of save

​
VM membership

  • A single VM can belong to multiple VPCs simultaneously — each VPC gives it a separate NIC
  • A VM can also have one or more public IPs alongside its VPC interfaces
  • Detach is blocked if it would leave the VM with zero network interfaces
  • VPCs are region-scoped — only VMs in the same region can attach

​
Pricing

There is no per-VPC fee, no per-CIDR fee, no per-VNI fee, and no per-DHCP-lease fee. You can hold dozens of VPCs at zero cost — pricing only kicks in when a VPC has a Firewall Appliance gateway or when its members generate public-internet egress.

​
Limits

​
Region

​
What’s not available today

  • VPC peering — placeholder under the Peering tab; ships in a future release
  • Load Balancer as a service — placeholder under the Services tab
  • VPN Gateway as a service — placeholder under the Services tab; the Firewall Appliance covers this case in the meantime via OPNsense’s built-in WireGuard / IPsec / OpenVPN
  • Cross-region VPCs — VPCs are regional only
  • Custom route tables / transit gateway / VPC endpoints — not on the near-term roadmap

​
See also

VXLAN, CIDR, and isolation

The technology behind the limits.

Manage a VPC

Internet gateway, port forwarding, DNS.

Pricing (VM)

For Firewall Appliance VM costs.
Last modified on May 11, 2026