How to Create a VM on a Private Network

How-to · Updated Jun 2026

Coming from another cloud?

▸AWS·EC2 Instances

EC2 Instanceshigh

Uses EC2 RunInstances API instead of Nova servers.create.
Requires predefined instance type selection.
Supports per-second On-Demand billing and Spot/Reserved options.
Includes hibernation state not standard in OpenStack.

AWS docs ↗

▸Azure·Virtual Machines

Virtual Machineshigh

Uses Azure Resource Manager (ARM) REST API at /providers/Microsoft.Compute/virtualMachines instead of OpenStack Nova API at /v2.1/servers.
Tightly integrated with Azure services like Azure Active Directory for authentication, unlike OpenStack's Keystone.
VM creation requires specifying size from predefined series with hardware-specific features (e.g., AMD/Intel/ARM), not custom flavor configs.
Billed per second with complex pricing tiers based on series/reservation options, vs OpenStack's typically hourly or usage-based.

Azure docs ↗

▸DigitalOcean·Droplets

Dropletshigh

API surface is DigitalOcean’s proprietary REST/CLI/Terraform tooling rather than OpenStack Nova/Neutron/Glance APIs (Droplets are managed via DigitalOcean UI/CLI/API/Terraform).
Billing is usage-based with per-second billing (60-second minimum and monthly cap) rather than the typical per-hour, quota-based charge model users often see in OpenStack-based clouds.
Droplets include a bundled outbound transfer allowance with each plan (starting at 500 GiB/month) rather than a separate bandwidth quota/metering model users often encounter in OpenStack deployments.
Droplets are described as Linux-based VMs on virtualized hardware with local SSD storage, whereas OpenStack deployments commonly expose distinct block storage (Cinder) and image services (Glance) and may not bundle bandwidth/monitoring/firewalls into the instance offering.

DigitalOcean docs ↗

▸Google Cloud·VM instances

VM instanceshigh

Uses REST API 'instances.insert' instead of Nova 'servers.create' with different auth via service accounts vs Keystone.
Supports bare metal instances (no hypervisor), not in standard OpenStack Nova.
Network interfaces tied to VPC subnets; differs from Neutron ports/floating IPs.

Google Cloud docs ↗

▸Hetzner·Cloud Servers

Cloud Servershigh

Servers provisioned individually via Hetzner API (hcloud), not OpenStack Nova flavors; fixed instance types like CX11 (1 vCPU, 2GB RAM, 20GB NVMe).
No flavor customization; choose from predefined shared/dedicated vCPU series.
Billing hourly with monthly cap per server (e.g., €3.29/mo cap for CX11), charged even when powered off until deleted, unlike typical OpenStack stop-to-pause billing.
Custom REST API at api.hetzner.cloud/v1/servers instead of OpenStack Nova /v2.1/servers (different auth, payloads, response formats).

Hetzner docs ↗

How to create a VM on a private network

Create a virtual machine on an isolated private network with internet access via a router and floating IP. This is the recommended approach for production workloads.

In this guide you will:

Create a network and subnet
Create a router connected to the public network
Create a security group with SSH access
Launch an instance on the private network
Allocate and associate a floating IP
SSH into the instance

Prerequisites

ConsoleLogged in to the Quake AI console
CLIOpenStack CLI installed and authenticated (clouds.yaml or openrc sourced)
APIAPI token generated with $OS_TOKEN and service endpoint variables set

Windows: CLI examples use bash. Set up a Linux CLI environment on Windows before proceeding.

An SSH key pair uploaded to your account

Step 1. Create a network and subnet#

Go to Network > Networks > Create Network.
Name the network (e.g., my-private-net).
Create a subnet named my-private-subnet with IPv4 CIDR 192.168.200.0/24 and DNS 1.1.1.1.
Select OK.

Step 2. Create a router#

The Routers list adds a third per-row icon to the affordances above: a Networking icon (chain glyph, tooltip Networking) that hosts Connect Private Network, Disconnect Private Network, and Detach Public Network. The Settings gear holds Edit only.

Go to Network > Routers > Create Router.
Name it (e.g., my-router). In the Options section, enable Attach to Public Network and select PublicStatic from the dropdown.
After creation, on the router's row open the Networking icon menu, select Connect Private Network, and pick the my-private-subnet row.

Step 3. Create a security group#

Go to Network > Security Groups > Create Security Group.
Name it (e.g., ssh-access). On the new group's row, open the Settings gear icon dropdown and select Create Rule.
Select SSH (TCP port 22, all traffic).

Step 4. Create the instance#

the Console flavor picker on the Create Instance wizard groups flavors into four category tabs:

Tab	Family	Sample flavors
General Purpose	`m2a`	`m2a.large`, `m2a.xlarge`, `m2a.2xlarge`, `m2a.4xlarge`
Compute Optimized	`c2a`	`c2a.large`, `c2a.xlarge`, `c2a.2xlarge`, `c2a.4xlarge`
Memory Optimized	`r2a`	`r2a.large`, `r2a.xlarge`, `r2a.2xlarge`, `r2a.4xlarge`
Shared Resources	`s1a`	`s1a.micro`, `s1a.small`, `s1a.medium`, `s1a.large`, `s1a.xlarge`

The picker opens on the General Purpose tab; switch tabs to find the family you want.

Go to Compute > Instances > Create Instance.
Name the instance, select us-east-1a, and choose a flavor. The example below uses c2a.large, which lives under the Compute Optimized tab.
Select Ubuntu-22.04 as the image (under the Ubuntu tab in the OS picker), set disk to 10 GiB, check Deleted with the instance.
Select Next: Network Config and choose my-private-net from Current Project Networks.
For subnets, select Automatically Assigned Address.
Select the default and ssh-access security groups.
Select Next: System Config, choose Keypair, and select your key.
Select Next: Confirm Config and confirm.

Step 5. Add a floating IP#

The Instances list exposes five per-row icons: Console, Instance Status, Volumes, Networking (chain glyph), and Settings (gear glyph). Floating-IP actions live behind the Networking icon. There is no More button and no Related Resources submenu.

On the Instances list, find your instance row, open its Networking icon menu, and select Associate Floating IP.
Select the private IP address from the instance.
Allocate a new floating IP (or select an existing one) from PublicStatic.
Select OK.

Step 6. Connect to the instance#

bash

ssh ubuntu@FLOATING_IP_ADDRESS

Type yes to accept the host key. Your prompt changes to ubuntu@my-private-vm.

Type logout to end the session.

Tear down#

To remove all resources, reverse the creation order:

Delete the instance. Because Step 4 checked Deleted with the instance, deleting the instance also removes the boot volume.
If you cleared Deleted with the instance at create time, the boot volume remains. Delete it under Storage > Volumes.
Release the floating IP (Network > Floating IPs > Release).
On the Network > Routers list, open the router row's Networking icon menu and select Disconnect Private Network.
From the same row's Networking icon menu, select Detach Public Network.
Delete the router.
Delete the network.

Usage Guidelines

The sample code, software libraries, command line tools, proofs of concept, templates, and other related technology on this page (including any of the foregoing that is provided by Quake AI personnel) is provided to you as Quake AI Content under the Quake AI Customer Agreement, or the relevant written agreement between you and Quake AI (whichever applies). Do not use this Quake AI Content in your production accounts, or on production or other critical data. You are responsible for testing, securing, and optimizing the Quake AI Content (such as sample code) as appropriate for production grade use based on your specific quality control practices and standards. Deploying Quake AI Content may incur Quake AI charges for creating or using Quake AI chargeable resources, such as running Compute instances or storing data in Object Storage. Your use is also subject to the Acceptable Use Policy.

For the full policy, see Usage Guidelines.

Last validated: 04.06.2026

Was this page helpful?