Private networks
Your devices and labs connect to each other on a private network. Most people use only the shared network and never need this page. It matters when you want to keep an address, or when an organization wants its own network that only its members' devices and labs join.
Go to Connectivity → My Network. It has two tabs.
IP Addresses
Every address you have reserved, with the network it belongs to and the device it is linked to — or Unallocated if no device holds it right now.
| Action | Effect |
|---|---|
| Reserve an address | Select Reserve IP in the device's menu on My Devices, or select Reserve IP when Allocated when you add a device |
| Reuse a reserved address | Choose it under Reallocate IP when you add a device, or in a lab's Preferences |
| Delete | Release the reservation. The address goes back to the pool, and you may not get it again. |
Each address card shows a chip with the network it belongs to. A green badge with a device name means that device holds the address now — hover it to see when the device was registered. A red Unallocated badge means the address is reserved for you but no device or lab is using it, so it is offered under Reallocate IP the next time you add a device.
Delete works only on your own reservations. If a device is still using the address, the device keeps working, but the address is no longer reserved. It can change if the device is added again.
If anything points at a fixed address — an SSH config, a firewall rule, a script — reserve that address first. Unreserved addresses can change.
WG Interfaces
This tab lists the private networks you can use.
| Card badge | Meaning |
|---|---|
| Public network — everyone | The shared network every account uses by default |
| Owned | A network you, or the organization you are acting as, created |
| Shared with you | Someone shared their network with you |
Each card shows the network's address range, its name inside your labs, its status, and how many peers (devices and labs) are on it.
| On the card | Meaning |
|---|---|
| CIDR | The address range the network hands out |
| In machines | The name the network has inside your labs, if one was set |
| Port | The port the network listens on |
| Status | Provisioned (green) — the network is live. Not provisioned (red) — it exists in the dashboard but is not running yet. |
| Peers | How many devices and labs are on it right now |
Create a network
Creating a network is an organization feature. On a personal account the Create interface button explains this: create or join an organization, or ask an administrator to enable it for your account.
In an organization or department:
-
On WG Interfaces, select Create interface.
-
Fill in the dialog:
Field What to enter Display name How the network appears in lists, e.g. Engineering VPN CIDR The private range it hands out, e.g. <private-range>/24. It must not overlap networks your labs also join.Listen port Optional — picked automatically if left empty Name inside machines Optional, up to 15 characters — what the network is called inside your labs -
Select Create.
Each organization or department can create a small number of networks. When you reach that limit, you see Interface limit reached.
Rules the dialog checks
| Field | Rule |
|---|---|
| Display name | Up to 60 characters. Left empty, the network is named after its technical name. |
| CIDR | An IPv4 range written as address/prefix. The exact range must not already be used by another network on the platform — you see CIDR … already used by … if it is. |
| Listen port | Between 1024 and 65535, and not already used by another network. Leave it empty and the platform picks a free one. |
| Name inside machines | 1 to 15 characters: letters, digits and _ = + . -. It cannot start with . or -, and cannot look like a platform network name such as wg3. Left empty, the default numbering is used. |
Limits
| Account | Networks it can own |
|---|---|
| An organization or department | 2 by default |
| A personal account an administrator enabled | 1 by default |
An administrator can change either number. The header of WG Interfaces shows how many you have used, for example 1 / 2.
After you create it
The network is started straight away and its card shows Provisioned. A network created by an organization or department is automatically available to all of its members — you do not need to share it with them.
If starting it fails, you see the reason followed by the record is saved and can be retried by an admin. The card then shows Not provisioned. Do not create it again — that uses up another of your networks. Ask your administrator to retry it.
Share a network
On a network you own, select Share and choose a person, workgroup, organization or department. They can then attach their devices and labs to it. Revoke removes that access.
Delete is disabled while any device or lab is still on the network — remove them first.
In the Share dialog, type in the Share with box and select Share:
| To share with | Type |
|---|---|
| A person | Their name or email address, and pick them from the suggestions |
| A workgroup | @ and the workgroup's handle |
| An organization or department you belong to | @ and its handle — yours are suggested as soon as the dialog opens |
Current access lists everyone who has access, each with Revoke. Only the network's owner can share or revoke — for a network owned by an organization or department, that means one of its admins.
Deleting a network also releases every address reserved on it, and cannot be undone.
Put a device on a network
When you add a device, the Network field appears once you have more than the public network. Pick the network the device should join.
Put a lab on networks
A lab's Preferences has WG Networks tiles: the Default network plus every network you can use. Select from one to four. The lab joins every selected network on its next redeploy.
Selected networks must not overlap in address range.
Default networks for an organization
Organization and department admins can choose default networks. These are shown at the top of WG Interfaces, and also in Account Settings while you act as the organization. Labs owned by the organization that do not pick their own networks join all of the selected defaults (up to 4). If you clear every box, labs fall back to the public network.
To set them, switch to the organization or department, check the networks under Default networks for …, and select Save defaults. The selected networks must not overlap in address range. A network that is still being started cannot be chosen yet — you see Network '…' is not ready yet.
Who can reach what
| Network | Who is on it | What they can reach |
|---|---|---|
| Public network | Every account's devices and labs, unless a lab chose other networks | Anything listening on your lab's private address. It is private from the internet, not from other users. |
| A network you own or were given | Only devices and labs that were put on it by people with access | Everything on that network |
| No network at all (a lab whose template makes it internal-only) | Nothing — the lab has no private address | Only what you publish on a domain |
A lab on several networks can be reached from each of them. Your own devices can reach a lab only if they are on one of the networks the lab joined.
Put a password on every service you run in a lab, or bind it to localhost.
See Secure tunnels and networking.
Do it with an AI assistant
You can also do this by asking an AI assistant connected to your account — see Connect an AI assistant to set one up.
| Ask | What the assistant does |
|---|---|
| “Can I create a private network?” | list_networks, which says whether you can make one |
| “Create a private network called Engineering VPN” | list_networks, then create_network |
| “Share it with priya@example.com” | share_network |
| “Put my lab on that network” | configure_lab_runtime, then deploy_lab |
If the assistant reports that a network was created but not provisioned, stop and tell an administrator. Trying again uses up another of your networks. When you share, give an email address instead of a username: a mistyped name is saved as a grant instead of being refused.
Next
- Devices — reserving and managing device addresses
- Organizations — the feature that unlocks private networks