FugokuFugoku Docs
Mask

Networking

Private networks, VLANs, elastic IPs, firewalls, and interconnection

Networking

Fugoku Networking provides a complete suite of network primitives — private networks, VLANs, elastic IPs, firewalls, and interconnection — all with zero egress fees.

Access network management at: console.fugoku.com/network

Network Components

ComponentPurposeConsoleCLI
Private NetworksIsolated L2/L3 networks with custom CIDRs✓fugoku networks
VLANsLayer 2 segmentation, private VLANs, QinQ✓fugoku vlans
Elastic IPsStatic public IPs with BGP anycast✓fugoku elastic-ips
FirewallsDistributed stateful L3/L4/L7 firewall✓fugoku firewalls
InterconnectionPeering, VPN, Direct Connect✓fugoku interconnection

All network traffic — private, public, interconnection — has zero egress fees.

Private Networks

Isolated L2/L3 networks with full CIDR control, VLANs, and integrated firewall.

Features

  • Full L2/L3 isolation — Your own network segment, no shared broadcast domains
  • Custom CIDR ranges — Bring your own IP space or use RFC1918 allocations (/16 to /28)
  • Firewall integration — Native stateful firewall at network edge
  • Inter-project connectivity — Controlled peering between projects
  • VPN/Direct Connect — Extend to on-prem via IPsec or cross-connect
  • Zero egress — All private traffic included

Create Private Network

Console: Network → Private Networks → Create Network

CLI:

fugoku networks create \
  --name backend-net \
  --cidr 10.10.0.0/16 \
  --region ashburn-1 \
  --dhcp true

Network Topologies

TopologyUse CaseDescription
Hub-and-SpokeCentralized egress, shared servicesCentral hub peered to workload spokes
Full MeshLow-latency east-westDistributed services, service mesh
HybridOn-prem extensionVPN/Direct Connect to on-prem

Subnet Management

# Create subnet
fugoku networks subnet create \
  --network backend-net \
  --cidr 10.10.1.0/24 \
  --region ashburn-1 \
  --gateway 10.10.1.1

# List subnets
fugoku networks subnet list --network backend-net

Attach Resources

# Attach instance
fugoku networks attach backend-net --instance vm-1

# Attach load balancer
fugoku networks attach backend-net --load-balancer lb-1

# Attach Kubernetes cluster
fugoku networks attach backend-net --cluster k8s-prod

VLANs

Layer 2 VLANs for fine-grained segmentation with private VLANs, trunk ports, and QinQ.

VLAN Types

TypeUse CaseFeatures
Standard 802.1QGeneral segmentationVLAN IDs 1-4094, trunk/access ports
Private VLANsMulti-tenant hostingCommunity, isolated, promiscuous ports
QinQ (802.1ad)Service providerDouble tagging, customer VLAN transparency

Create VLAN

Console: Network → VLANs → Create VLAN

CLI:

# Standard VLAN
fugoku vlans create \
  --name app-tier \
  --type standard \
  --vlan-id 100 \
  --region ashburn-1

# Private VLAN
fugoku vlans create \
  --name tenant-isolation \
  --type private \
  --primary-vlan 200 \
  --region ashburn-1

# QinQ
fugoku vlans create \
  --name customer-a \
  --type qinq \
  --outer-vlan 100 \
  --inner-vlan 200 \
  --region ashburn-1

Advanced VLAN Features

FeatureDescription
VLAN TranslationTranslate customer VLAN IDs to internal IDs at edge
L2VPN / EVPN-VXLANExtend VLANs across sites via EVPN control plane
MAC SecurityMAC limiting, sticky MAC, port security, storm control
VLAN TranslationTranslate IDs at edge for seamless migration

Elastic IPs

Static public IPv4/IPv6 addresses with BGP anycast routing, DDoS protection, and instant provisioning.

Features

  • BGP Anycast — IPs announced from multiple PoPs globally
  • Instant provisioning — Reserve via API/console in seconds
  • DDoS protection — Always-on scrubbing at 2 Tbps+ capacity
  • Full API/Terraform — Reserve, release, move IPs programmatically
  • Reverse DNS — Full PTR control
  • Zero egress — All traffic included

Reserve Elastic IP

Console: Network → Elastic IPs → Reserve IP

CLI:

# Reserve IPv4
fugoku elastic-ips reserve --region ashburn-1 --ipv4

# Reserve IPv6 /64 block
fugoku elastic-ips reserve --region ashburn-1 --ipv6

Assign to Resources

# Assign to instance
fugoku elastic-ips assign 203.0.113.50 --instance vm-1

# Assign to load balancer
fugoku elastic-ips assign 203.0.113.50 --load-balancer lb-1

# Move IP (instant, no downtime)
fugoku elastic-ips move 203.0.113.50 --target vm-2

Use Cases

Use CaseDescription
Global Load BalancingAnycast IPs route to nearest healthy endpoint
DDoS ResilienceIPs announced from scrubbing centers
Service FailoverMove IPs between instances/regions in seconds
Blue-Green DeploySwap IPs between old/new versions

Firewalls

Distributed stateful firewall at the network edge — not on your instances. No agent, no performance impact.

Features

  • Edge enforcement — Rules run on programmable fabric, not your instances
  • Stateful L3/L4/L7 — IP, port, protocol + HTTP/TLS SNI/DNS inspection
  • Default-deny — Secure by default
  • DDoS protection — Always-on scrubbing (2 Tbps+ capacity)
  • GeoIP & Threat Intel — Block by country/ASN, real-time threat feeds
  • Flow logs — To your storage bucket or SIEM (JSON/Parquet)
  • Zero egress — All firewall traffic included

Create Firewall

Console: Network → Firewalls → Create Firewall

CLI:

fugoku firewalls create \
  --name web-firewall \
  --network backend-net \
  --default-action deny

Rule Types

LayerRule TypesExamples
L3IP (CIDR), protocol10.10.0.0/16, tcp, icmp
L4Port, protocoltcp/80, udp/53, tcp/80-443
L7HTTP host/path/header, TLS SNI, DNShost: api.example.com, sni: *.example.com
GeoIPCountry, continent, ASNcountry: US, asn: 15169
Threat IntelMalware C2, phishing, botnetsAuto-updated feeds

Create Rules

Console: Firewall detail → Add Rule

CLI:

# L3/L4 rule
fugoku firewalls add-rule web-firewall \
  --direction ingress \
  --protocol tcp \
  --port 80,443 \
  --source 0.0.0.0/0 \
  --action allow

# L7 rule
fugoku firewalls add-rule web-firewall \
  --direction ingress \
  --l7-host api.example.com \
  --l7-path /api/* \
  --action allow

# GeoIP block
fugoku firewalls add-rule web-firewall \
  --direction ingress \
  --geoip-country CN,RU \
  --action deny

# Attach to network
fugoku firewalls attach web-firewall --network backend-net

Rule Priority

Rules evaluated in order (lower number = higher priority):

  1. Default deny (implicit, priority 65535)
  2. Explicit deny (priority 1000-60000)
  3. Explicit allow (priority 1-999)

Flow Logs

# Enable flow logs to object storage
fugoku firewalls enable-logs web-firewall \
  --bucket logs-bucket \
  --format parquet \
  --interval 5m

Log format: JSON or Parquet, includes accepted/dropped/rejected flows with full 5-tuple + verdict.

Interconnection

Private connectivity to your infrastructure — see Interconnection for full details.

TypeLatencyUse Case
VPC Peering< 1 msMulti-project, shared services
IPsec VPN1-5 msHybrid cloud, on-prem
Direct Connect< 0.5 msHigh-throughput, compliance

All interconnection traffic has zero egress fees.

Network Monitoring

Metrics

MetricPrivate NetVLANElastic IPFirewall
Bandwidth (in/out)✓✓✓✓
Latency (p50/p95/p99)✓✓✓✓
Packet loss✓✓✓✓
Connections——✓✓
Dropped packets———✓

CLI Monitoring

# Network metrics
fugoku networks metrics backend-net --period 1h

# VLAN metrics
fugoku vlans metrics vlan-100 --period 1h

# Firewall metrics
fugoku firewalls metrics web-firewall --period 1h

API Reference

Private Networks

# Create
POST /v1/networks { name, cidr, region, dhcp }

# List
GET /v1/networks

# Get
GET /v1/networks/{id}

# Delete
DELETE /v1/networks/{id}

# Attach resource
POST /v1/networks/{id}/attach { resource_type, resource_id }

VLANs

POST /v1/vlans { name, type, vlan_id, region }
GET /v1/vlans
GET /v1/vlans/{id}
DELETE /v1/vlans/{id}

Elastic IPs

POST /v1/elastic-ips { region, ip_version }
GET /v1/elastic-ips
POST /v1/elastic-ips/{ip}/assign { resource_type, resource_id }
POST /v1/elastic-ips/{ip}/move { target_type, target_id }
DELETE /v1/elastic-ips/{ip}

Firewalls

POST /v1/firewalls { name, network_id, default_action }
GET /v1/firewalls
POST /v1/firewalls/{id}/rules { direction, protocol, port, source, action }
POST /v1/firewalls/{id}/attach { network_id }
GET /v1/firewalls/{id}/metrics

Best Practices

  1. Default-deny — Start with deny-all, add explicit allows
  2. Use private networks — Keep internal traffic off public internet
  3. Segment with VLANs — Separate app tiers, tenants, environments
  4. Reserve Elastic IPs — For services needing stable public endpoints
  5. Enable flow logs — Audit trail for compliance
  6. Test firewall rules — Use fugoku firewalls test before applying
  7. Monitor metrics — Set alerts on dropped packets, connection spikes

Getting Help

Next Steps:

Object Storage

S3-compatible object storage for unstructured data, backups, and static assets

Providers

Multi-cloud provider configuration and selection

On this page

NetworkingNetwork ComponentsPrivate NetworksFeaturesCreate Private NetworkNetwork TopologiesSubnet ManagementAttach ResourcesVLANsVLAN TypesCreate VLANAdvanced VLAN FeaturesElastic IPsFeaturesReserve Elastic IPAssign to ResourcesUse CasesFirewallsFeaturesCreate FirewallRule TypesCreate RulesRule PriorityFlow LogsInterconnectionNetwork MonitoringMetricsCLI MonitoringAPI ReferencePrivate NetworksVLANsElastic IPsFirewallsBest PracticesGetting Help