Network Migration Guides
Coming from another cloud?
▸AWS·Amazon Virtual Private Cloud
Amazon Virtual Private Cloud
- AWS VPC is regional with CIDR /16-/28.
- OpenStack Networks project-scoped L2 with flexible CIDR.
- AWS requires IGW for public.
- OpenStack provider nets or floating IPs.
▸Azure·Virtual Network (VNet)
Virtual Network (VNet)
- Azure VNets are strictly regional Layer 3 overlays scoped to one subscription with no L2 VLAN support ().
- VNets and subnets creation free, but subnets min /29 with Azure reserving 5 IPs per subnet ().
- Managed via ARM REST APIs/PowerShell/CLI vs Neutron REST API.
- Isolated per subscription; peering for cross-VNet connectivity vs OpenStack project networks connected via routers.
▸DigitalOcean·VPC (VPC Network)
VPC (VPC Network)
- Region-scoped: a VPC network is created in a specific datacenter region and resources must be in that same region to be attached, whereas OpenStack Neutron networks/subnets are generally available across all AZs in a region and attachments are controlled by network reachability rather than an explicit region slug ().
- Resource migration is limited: Droplets require snapshot/recreate to move between VPCs and some resources (Kubernetes clusters, load balancers, NAT gateways) cannot be migrated between VPCs, whereas in OpenStack you typically can attach/detach ports or move router interfaces without recreating servers (behavior depends on deployment, but Neutron’s object model supports it) ().
- NAT is a managed NAT Gateway with tiered capacity (1–16 increments; each increment gives 25 Mbps symmetrical bandwidth and 100 GiB outbound transfer/month) and can be set as the default gateway for the VPC, whereas OpenStack commonly expresses egress via Neutron routers with SNAT and does not use this specific ‘size tier’ model ().
- Security-policy coupling differs: DigitalOcean notes Cloud Firewall rules affect both public and VPC traffic and rules must specify whether they apply to the public or private IP range, whereas in OpenStack security groups are generally applied to ports and are not framed as “public vs private IP range” rule modes ().
▸Google Cloud·VPC
This Quake AI feature maps to Google Cloud’s VPC.
▸Hetzner·Networks
Networks
- Private networks (vSwitch-like but called Networks) created via API, up to 10.0.0.0/8 subnets, attach to servers/LBs.
- CCM supports route controller for pod networking when enabled; no native provider networks like OpenStack.
- Limited to Hetzner regions, IPv4 only for private (IPv6 public).
- Networks are free with no usage charges, unlike potential metering in OpenStack clouds ().
▸Linode·VPC
VPC
- VPCs are region-scoped and isolate Linodes from the public internet and from other customers; OpenStack networks are project-scoped Neutron networks.
- A VPC contains one or more subnets, each with a CIDR block defined at create time; routing between subnets is implicit within the VPC.
- Linodes attach to a VPC by configuration interface rather than via Neutron ports; trunking is not the same model.
- VLANs and VPCs are distinct products; OpenStack collapses these into Neutron network types (vlan, vxlan, geneve).
▸Vultr·VPC 2.0
VPC 2.0
- VPC 2.0 networks are region-scoped Layer-2 segments with customer-defined CIDR; OpenStack Neutron networks are project-scoped with explicit subnets and routers.
- Instances attach to a VPC 2.0 by configuration interface rather than via Neutron ports; trunking is not the same model.
- VPC 2.0 has no integrated router object; routing between VPCs requires an instance acting as a router, while OpenStack uses Neutron routers natively.
- Legacy 'Private Network' and VPC 2.0 are distinct products on Vultr; OpenStack collapses these into Neutron network types (vlan, vxlan, geneve).
Network migration guides
Move your networking configuration to Quake AI from another provider. Quake AI's network layer runs OpenStack Neutron with OVN as the SDN backend, providing software-defined networking with five core objects: networks, subnets, routers, floating IPs, and security groups.
Every provider's networking model maps to this same set of Neutron primitives, but the translation complexity varies. DigitalOcean and Hetzner map almost directly. AWS, GCP, and Azure introduce constructs (NACLs, global VPCs, dual NSG layers) that require rethinking instead of one-to-one porting.
Choose your source provider#
Migrate from AWS VPC
VPC subnets, NACLs, IGW, and NAT Gateway collapse into Neutron's router model. Includes security group translation, ALB replacement, and Route 53 cutover.
Migrate from DigitalOcean VPC
Cloud Firewalls map cleanly to security groups. Reserved IPs to floating IPs. The closest conceptual match after Hetzner.
Migrate from Hetzner Cloud Networks
Closest operational model to Neutron. Cloud Firewalls, Floating IPs, and private Networks all have near-identical equivalents.
Migrate from GCP VPC
Global VPC must become per-region Neutron deployments. Firewall deny rules and hierarchical policies collapse into flat, allow-only security groups.
Migrate from Azure VNet
Dual NSG layers (subnet + NIC) merge into single port-level security groups. Application Gateway WAF has no equivalent.
Migrate from Linode VPC
Linode VPC collapses network and subnet into one object; Neutron exposes them separately. Cloud Firewalls map to per-port security groups. Replace NodeBalancers with a reverse proxy or external edge.
Migrate from Vultr VPC 2.0
Vultr VPC 2.0 keeps network and subnet as one object; Neutron exposes them separately. Firewall Groups map to per-port security groups. Replace Vultr Load Balancers with a reverse proxy or external edge.
Quake AI networking model#
Quake AI offers two network models depending on your use case.
PublicEphemeral (dev/testing)#
Your instance receives a DHCP-assigned public IP directly on a provider network. This model uses no router or NAT. The address changes when the instance restarts, not only on rebuild. Use this model for throwaway dev environments; for any workload that needs a stable public address, use PublicStatic with floating IPs.
PublicStatic (production)#
A private network (RFC 1918 CIDR) with a Neutron router connected to the external network. The router provides SNAT for outbound traffic. Floating IPs provide stable inbound access via DNAT. This is the model you use in production and the target for all migration guides.
| Neutron object | Role | Equivalent across providers |
|---|---|---|
| Network | L2 broadcast domain (VXLAN overlay via OVN) | VPC, VNet, hcloud Network |
| Subnet | IP range with DHCP and gateway | Subnet (all providers) |
| Router | L3 gateway, SNAT outbound, floating IP DNAT inbound | IGW + NAT GW (AWS), Cloud NAT (GCP), NAT Gateway (Azure), implicit public NIC or NAT Gateway (DO), implicit (Hetzner) |
| Floating IP | Static public IPv4, maps 1:1 to a port | Elastic IP (AWS), Reserved IP (DO), Floating IP (Hetzner), Static External IP (GCP), Public IP (Azure) |
| Security Group | Stateful, allow-only, per-port ACL (OVN ACLs) | Security Group (AWS), Cloud Firewall (DO/Hetzner), Firewall Rule (GCP), NSG (Azure) |
| Reverse proxy instance | HAProxy, Nginx, Caddy, Traefik, or Envoy | ALB/NLB (AWS), LB (DO/Hetzner), Cloud LB (GCP), Azure LB/App Gateway |
What maps cleanly across all providers#
These networking primitives have direct, configuration-only equivalents on Quake AI:
- Static/reserved public IPs → Neutron floating IPs
- Stateful, allow-only instance firewall rules → Neutron security groups
- Private network segmentation → Neutron networks and subnets
What requires rethinking#
- Managed DNS: Quake AI has no managed DNS service. Route 53, Cloud DNS, Azure DNS, Hetzner DNS, and DigitalOcean DNS must be migrated to an external provider (Cloudflare, NS1, self-hosted BIND)
- Managed load balancing: Deploy a reverse proxy such as HAProxy, Nginx, Caddy, Traefik, or Envoy on a Compute instance. Assign it a floating IP and route to private application instances
- WAF / web application firewall: Use an application-layer proxy with a WAF module or a CDN/WAF edge service
- VPN-as-a-Service: Not available. Site-to-site VPN must be implemented with WireGuard or OpenVPN on a dedicated instance
- IPv6: Not documented on Quake AI. Providers with native IPv6 require a transition plan
- Network peering: No VPC/VNet peering equivalent. DigitalOcean VPC peering is now generally available, and Hetzner does not offer peering. Cross-project communication on Quake AI must traverse the external network or use a VPN overlay
Egress pricing model comparison#
Quake AI includes bandwidth in the instance flavor pricing with no per-GB egress charge. The five providers below differ in how they model outbound transfer; current rates live on each provider's pricing page.
| Provider | Egress model | Notes |
|---|---|---|
| AWS | Per-GB metered after small allowance | NAT Gateway processing also metered per-GB. See AWS pricing |
| GCP | Per-GiB metered, destination-dependent | Premium and Standard network tiers differ. See GCP network pricing |
| Azure | Per-GB metered after small allowance | Rates vary by region. See Azure bandwidth pricing |
| DigitalOcean | Included allowance per Droplet, per-GiB overage | Pooled across team. See DigitalOcean pricing |
| Hetzner | Included monthly allowance differs EU vs US | Per-GB overage where applicable. See Hetzner pricing |
| Quake AI | Included in flavor pricing | Bandwidth scales with vCPUs |
See also#
- Migrate to Quake AI: cross-service migration hub
- Create a network: provision your first Neutron network
- Create a security group: configure firewall rules
- Allocate floating IPs: assign static public addresses
- Edge reverse proxy template: deploy a self-managed traffic entry point
- Compute migration guides: if you also need to move VMs
- Object storage migration: if you also need to move storage
Usage Guidelines
The sample code, software libraries, command line tools, proofs of concept, templates, and other related technology on this page (including any of the foregoing that is provided by Quake AI personnel) is provided to you as Quake AI Content under the Quake AI Customer Agreement, or the relevant written agreement between you and Quake AI (whichever applies). Do not use this Quake AI Content in your production accounts, or on production or other critical data. You are responsible for testing, securing, and optimizing the Quake AI Content (such as sample code) as appropriate for production grade use based on your specific quality control practices and standards. Deploying Quake AI Content may incur Quake AI charges for creating or using Quake AI chargeable resources, such as running Compute instances or storing data in Object Storage. Your use is also subject to the Acceptable Use Policy.
Comparisons to third-party providers in this material reflect publicly documented behavior as of the validation date below. Pricing, quotas, service limits, and feature availability change frequently on every cloud. Verify provider-specific claims against the provider's own current documentation before relying on them for a procurement, architecture, or migration decision.
For the full policy, see Usage Guidelines.
Last validated: 22.06.2026
See Also
Migrate from AWS VPC to Quake AI
Shares: Nginx, Migration
Migrate from Azure VNet to Quake AI
Shares: Nginx, Migration
Migrate from DigitalOcean VPC to Quake AI
Shares: Nginx, Migration
Migrate from GCP VPC to Quake AI
Shares: Nginx, Migration
Migrate from Hetzner Cloud Networks to Quake AI
Shares: Nginx, Migration