An Isolated Network in Apache CloudStack is a private guest network dedicated to a single account. It is not part of a VPC. CMP creates and manages isolated networks through network offerings, virtual routers, public IP behaviour, and network packages (billing controlled globally by enablenetworkbilling).
An L2 Network in Apache CloudStack provides Layer 2 connectivity only (switching / VLAN). CloudStack attaches VMs to the VLAN or broadcast domain and does not deploy a virtual router for Layer 3 services.
This page separates what CMP admins configure in CMP from behaviour and limits defined by Apache CloudStack on the virtual router. Customers enable Remote Access VPN in CMP; underlying VPN service, global tuning, and documented limits come from CloudStack.
CloudStack network types available through CMP. Each type has its own guest network model, routing behaviour, and package requirements.
How networking works for Proxmox VE in CMP after the provider is connected.
Network packages define how CMP bills Isolated and L2 guest networks. Each package maps to a CloudStack network offering for a Cloud Provider Setup and zone.
In CMP OpenStack deployments, network provisioning is non-billed. Neither private (tenant) networks nor shared public (external) networks incur a network infrastructure package charge.
After Connecting CMP to Proxmox, configure network categories, import Proxmox networks, and manage IP address pools (IPAM) so CMP can allocate and track IPs for customer VMs.
In OpenStack environments, public internet connectivity is delivered through shared external Neutron networks. Cloud providers configure these public networks in OpenStack and sync them to CMP, making them immediately accessible to all customer projects in that region.
Remote Access VPN (Road Warrior) lets an individual user connect from a laptop or PC over the internet to private VMs on a VPC or Isolated network — without exposing VM private IPs to the public internet.
A Shared Network in CloudStack is a guest network that can be used by multiple accounts within a zone (subject to CloudStack scope and admin configuration). Unlike Isolated Network, it is not dedicated to a single tenant’s private router model in the same way.
This section outlines workflows and details based on Apache CloudStack documentation and general Site-to-Site VPN practice. It has not been practically reviewed end-to-end in CMP — validate steps, field behaviour, and tunnel setup against your CloudStack version and customer firewall before production use.
A VPC (Virtual Private Cloud) in Apache CloudStack is a private, isolated part of the cloud with its own virtual network topology. Customers create VPCs in CMP by selecting a VPC package that maps to CloudStack VPC Offering and VPC Network Offering values.
A static route tells your VPC where to send traffic for a remote network. Customers manage VPC-level static routes from the VPC details page in CMP.
Workflows on this page follow CloudStack documentation and general Site-to-Site VPN practice. Not practically reviewed end-to-end in CMP — see Site-to-Site VPN.
Field details on this page follow CloudStack documentation and general Site-to-Site VPN practice. Not practically reviewed end-to-end in CMP — see Site-to-Site VPN.
Workflows on this page follow CloudStack documentation and general Site-to-Site VPN practice. Not practically reviewed end-to-end in CMP — see Site-to-Site VPN.
VPN Users provide username/password credentials for Remote Access VPN. Users connect with an L2TP/IPsec client to the Source NAT public IP (VPC or Isolated network) where Remote Access VPN is enabled.
End-to-end setup for personal PC → private VM using Remote Access VPN. The same model applies to VPC and Isolated networks — enable VPN on the Source NAT public IP, create a VPN User, configure an L2TP/IPsec client.