About networking
The Akasha network model — private networks, NAT egress, default-deny inbound, and the options for exposing services.
Akasha uses the same network model as the major public clouds: your instances live on private networks, reach the internet through NAT, and are unreachable from the internet until you explicitly expose them.
Private networks
Every project has its own networks. When you attach an instance to a managed network, it receives a private IP address over DHCP. An instance never sees a public IP address on its own interface — public reachability is always provided by address translation at the network edge, never by putting a public address inside the instance.
You create and manage networks under Networking → Networks. See Manage networks for the available network types and configuration options.
Outbound traffic
Outbound internet access works through NAT. Traffic from your instances leaves the platform with its source address translated to a platform address, and return traffic for established connections flows back automatically. You do not need to configure anything for instances on a standard project network to reach the internet.
Inbound traffic is closed by default
Nothing in your project is reachable from the internet by default. To expose a service, use one of the following:
- Network forwards — map ports on a listen address to an instance address. Available on bridge and OVN networks.
- Network load balancers — distribute traffic across multiple backends. Available on OVN networks.
- Kubernetes External IPs and TCP routes — for services running on a managed Kubernetes cluster. See Ingress and external traffic.
Public IP addresses
Public IPs are one-to-one NAT mappings configured at the network edge by your administrator; there is no self-service public IP allocation. To make a forward or load balancer reachable from the internet, ask your administrator to map a public IP to its listen address. Which public addresses are available, and how they are mapped, is specific to your deployment.
Isolation between projects
Traffic between projects is isolated. Each project's networks are separate segments with no routing between them, so instances in one project cannot reach instances in another. The one deliberate exception is OVN network peering, which connects an OVN network in your project to an OVN network in another project — see Manage networks.
Within a network, you can filter traffic with ingress and egress rules using network ACLs, and you can audit which addresses are in use on the IPAM page.