Instance network

Every instance, whether a managed service, a virtual machine or a game server, has a Network tab. It decides whether the instance has a public address, which ports on that address reach it, and who may connect to them.

Public and private

You choose when you create the instance, and can change it later:

• Public: reachable from the internet, at its hostname and a public port of its own on your workspace's shared IP.
• Private: no public address, hostname or port. Reachable only from your workspace's network.

Either way the tab shows its Private address, its private IP with the port it listens on. Anything on your workspace network reaches the instance there directly, without passing through its public address, so the rules below do not apply to it.

Make it public or private

• Make public asks how the instance gets its public address. Choose Shared workspace IP and Apply.
• Make private, after you confirm, stops its public address answering within a few seconds.

The tab shows Changing access… until the change is done. The instance keeps running, and its private address does not change. Its inbound rules are kept while it is private, and when it is public again it gets back the same hostname and ports. Access can change while the instance is running or stopped.

The shared IP

Your workspace has one public IPv4 address, shared by its public instances, load balancers and Kubernetes clusters. Each public port on it is allocated by the platform from 40000–49999: you cannot choose it, and the port inside the instance stays as it is.

Connect with the hostname rather than the IP address: the shared IP can change, for example after every public instance and load balancer of the workspace has gone private or been deleted.

A Dedicated IP, an address of the instance's own with its ports unchanged, appears in the dialog but is not offered yet.

Inbound rules

The Inbound rules table lists what the public address forwards to the instance:

Anything not listed is closed.

The built-in rule

The first rule, marked Built-in, is the port the instance was created with: the engine's port for a managed service, SSH for a virtual machine, the game's port for a game server. You can restrict who reaches it, but not remove it.

Forward a port

To reach another service running inside the instance, such as a web server you started on a virtual machine, choose Forward a port:

• Protocol: TCP or UDP.
• Port inside the machine: the port your service listens on, from 1 to 65535.
• Allowed sources: who may connect. See below.

Choose Add rule. The rule gets its own public port from the shared range, shown under Public endpoint, and shows Applying… until it is Live, usually within seconds.

• An instance takes up to 10 rules besides the built-in one.
• Each protocol and port can have one rule. The instance's own ports already have theirs, so they are refused.
• A rule's protocol and port cannot change: remove the rule and add another. Remove rule is in the rule's menu, and the built-in rule has none.

Allowed sources

Choose Edit allowed sources in a rule's menu to limit who reaches its port:

• List up to 20 IPv4 addresses or CIDR ranges, one per line, such as 203.0.113.7 or 198.51.100.0/24. An empty list means anyone.
• A bare address counts as a /32, a range is saved by its first address, so 198.51.100.9/24 becomes 198.51.100.0/24, and 0.0.0.0/0 anywhere in the list means anyone.
• IPv6 addresses are not accepted: the public address is IPv4 only.

Sources are checked on the workspace router in front of the instance, against the client's real address. A source that is not listed gets no answer, and its connection times out. Inside the instance, every public connection appears to come from the router's address rather than the client's.

Restrict the built-in rule whenever you can, above all the SSH port of a virtual machine and the port of a database.

Who can do what

From the API and MCP

Inbound rules are under /v1/servers/{id}/inbound-rules, and access is changed with POST /v1/servers/{id}/access. Over MCP, use list_inbound_rules, add_inbound_rule, set_inbound_rule_sources, remove_inbound_rule and set_instance_access.