In the WX-ONE console, create a new virtual private cloud and select the availability zones in our German data centers where your resources will run.

Next, define the private address range (CIDR block) from which your instances draw their IP addresses. Both IPv4 and IPv6 are supported, so you can align your addressing with existing naming schemes.

• Reserve enough address space for future growth
• Avoid overlaps with on-premises networks you plan to connect via VPN later

Divide your network into public and private subnets to cleanly separate internet-facing services from internal workloads.

Route tables let you control precisely how traffic flows between subnets, out to the internet, and to connected sites. Assign the appropriate route to each subnet and define a gateway for outbound traffic.

• Public subnets for load balancers and reverse proxies
• Private subnets for databases and application servers

Control access at the resource level with security groups and at the subnet level with network ACLs. This lets you specify exactly which ports and sources are permitted.

Assign a fixed IP address to your internet-facing services. On-demand IPs suit short-lived environments, while a 12-month commitment provides permanently needed addresses at a discounted flat rate.

• Apply the principle of least privilege to every security group
• Built-in DDoS protection safeguards your public endpoints automatically

Securely connect your WX-ONE VPC to your own data centers, branch offices, or other clouds. Encrypted IPSec tunnels or GRE tunnels let you build stable site-to-site connections.

For internal data exchange, use the cross-zone connection with predictable pricing. Then keep an eye on traffic and utilization to continuously optimize bandwidth and cost.

• IPSec for standards-compliant, encrypted site coupling
• GRE for flexible encapsulation of multiple protocols