Create a VPC

_{Updated May 8, 2026} A VPC is a private network you can attach multiple VMs to so they can talk to each other directly. Every VM created without a VPC selection gets its own private VPC; you create a shared VPC here when you want two or more VMs on the same private subnet. This page walks the dashboard create flow. The full concept of why CIDRs can overlap, what VXLAN does, and how isolation is enforced is on VXLAN, CIDR, and isolation.

​

Before you start

• A Raff account
• A clear idea of how many VMs this VPC will hold (the size you pick today is fixed — no resize)

​

1. Open the VPCs tab

In the left sidebar, click Networking → switch to the VPCs tab. The list shows every VPC in your account with its CIDR, IP usage, gateway state, DNS, and attached VM count. Click + Create VPC in the top-right. The Create VPC dialog opens.

​

2. Name the VPC

Pick a label that’s descriptive — prod-services, staging, analytics — so the VPC is easy to spot in the diagram and the list. Names must be unique across your account.

​

3. Pick a network size

Four choices, each pre-fills a CIDR you can keep or override: The dialog updates the summary line live as you change the choice — Network, Gateway (always .1), and IPs (usable count, after subtracting .0 / .1 / .255). A few rules the validator enforces if you pick Custom CIDR:

• Prefix between /16 and /28
• Must fall inside a private range — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 100.64.0.0/10
• Must be CIDR-aligned — 192.168.1.50/20 is rejected; the correct form is 192.168.0.0/20

You don’t need to avoid CIDRs already used by your other VPCs. Two VPCs in the same account can use the same range — they’re isolated by their VXLAN VNI, not by IP. See VXLAN, CIDR, and isolation.

​

4. Click Create VPC

The VPC is created in seconds and appears in the list. The new row shows:

​

5. Attach VMs

A VPC with zero VMs doesn’t do anything yet. Two ways to add members:

• From the row’s ⋮ menu → Add VM — opens the VM-attach flow scoped to this VPC
• From the VPC detail page → VMs tab → + Attach VM — same flow, different entry point
• From the create-VM flow — when launching a new VM, pick this VPC under the network section

See Attach a VM for the full flow.

​

What you cannot change after creation

​

Pricing

The VPC itself is free. You pay only for VMs and any optional Firewall Appliance gateway (a paid OPNsense VM). The default Platform Router gateway, the Public IPs you attach to VMs, and any same-region private traffic between VMs in the VPC are all free. See Features & limits for the full pricing table.

​

Next steps