Raff VPC is a free, isolated private network that connects everything you run on Raff: VMs, Kubernetes clusters, managed databases, apps and functions. Traffic between resources is unmetered on a 25 Gbps internal network, and the gateway, DNS and DHCP are included.
A virtual private cloud (VPC) is an isolated network inside a public cloud. Your servers talk to each other on private IPs that nobody else can reach, and only the things you choose to expose ever touch the internet. Without one, every service you run is a public address you have to defend.
Your app talks to Postgres on a private IP. There is no public port to attack, scan or misconfigure.
Web, app and data layers in one private network, with security groups deciding exactly who talks to whom.
Dev, staging and production in their own VPCs. On Raff they can reuse the same IP ranges, so configs stay identical.
Every provider agrees you need this. Where they differ is what they charge you for it. Read the full guide
The VPC itself is free everywhere. What the big clouds charge for is everything attached to it. Raff charges for none of it.
AWS figures are published us-east-1 list prices, gathered Jul 2026. How public vs private traffic is billed →
Create a VPC, attach your resources, set your rules. Sane defaults do the rest, and you can still bring your own CIDR, DNS and firewall appliance.
No feature tiers and no add-on SKUs. Every VPC gets the full networking stack from the first click.
Each VPC is its own layer-2 network. No other tenant can see or reach your private traffic.
Stateful firewall rules per VM, with ready-made templates for web, database and SSH access.
Subnets from /16 to /28 using any RFC 1918 range. Auto-suggested /24 if you don’t care.
VPCs are isolated, so 10.0.0.0/24 can exist in every environment at once. Configs stay identical.
NAT, DNS, DHCP and port forwarding run for you. Or deploy your own firewall appliance instead.
Point the VPC at any resolver. Change it in the dashboard, applied to the whole network.
Traffic between resources rides a 25 Gbps internal network. No per-GB meter, ever.
Every network change is recorded and visible in your dashboard, from CIDR edits to rule changes.
VPCs and security groups are first-class in the REST API, the raff CLI and the Terraform provider.
All of it is live in your dashboard the moment you sign up. Create a VPC
VMs and Kubernetes clusters attach directly into your VPC. Managed databases, Raff Apps and Raff Functions plug in over PrivateLink private endpoints, so nothing crosses the public internet end to end.
Connect two VPCs privately when you want shared services with separated teams or environments.
Private endpoints for managed services inside your VPC. Databases, apps and functions connect without touching the public internet.
WireGuard or IPsec tunnels from your VPC gateway to the office router or another cloud.
Where each provider lands on the parts of a virtual private cloud that usually cost extra. The hyperscalers win on regions; nobody should win on your NAT bill.
| Raff VPCBest | AWS VPC | Google Cloud | DigitalOcean | |
|---|---|---|---|---|
| VPC price | Free, no cap | Free (components billed) | Free (components billed) | Free |
| NAT / internet gateway | Included, $0 | $32.85/mo + $0.045/GB | Up to $32.12/mo + $0.045/GB | None managed, roll your own |
| Private traffic | Unmetered · 25 Gbps | Free same-AZ, $0.01/GB cross-AZ | Free same-zone, $0.01/GB cross-zone | Free within region |
| Public IPv4 | Included with VM | $3.65/mo each | $3.65/mo each | Included with droplet |
| Site-to-site VPN | Included · WireGuard + IPsec | $36.50/mo per connection | $36.50/mo per tunnel | None managed, roll your own |
| Private endpoints to managed services | PrivateLink included | $0.01/h + per-GB per endpoint | $0.01/h + per-GB per endpoint | VPC-scoped access |
| Regions | 1 (Vint Hill, US) | 30+ | 40+ | 15 |
Competitor rows reflect each provider's published pricing, docs and default plan limits, gathered Jul 2026. Re-verify before relying on them.
We don't sell fear and we don't invent certifications. Here is exactly what stands between your network and everyone else's.
Raff runs on ISO 27001 certified infrastructure in Vint Hill, Virginia, with 99.9% uptime. Firewall basics in cloud firewall rules explained.
Isolation is separation, not encryption. If your compliance program needs encrypted transport, run TLS between services as usual; a VPC keeps the network private either way.
No route tables to draw and nothing to size. The network is ready before your first VM finishes booting.
Name it and accept the suggested CIDR, or bring your own range from /16 to /28. The gateway comes up with it.
Add VMs and Kubernetes clusters to the network. Databases, apps and functions connect over PrivateLink.
Apply a security group template or write your own rules, then expose only what should be public.
A VPC is the fabric the rest of Raff plugs into. Everything below connects to it privately, at no charge.
A virtual private cloud (VPC) is an isolated network inside a public cloud. Your servers communicate on private IPs no other tenant can reach, and only services you choose to expose get a public address. On Raff, every VPC is a free, fully isolated network.
Nothing. VPCs are free on Raff: the network, the managed gateway with NAT, DNS and DHCP, and all private traffic. There is no hourly charge and no per-GB meter; private traffic runs unmetered on a 25 Gbps internal network.
AWS bills the parts around the VPC: a NAT gateway is $32.85/month plus $0.045 per GB processed, and public IPv4 is $3.65/month. On Raff the VPC, gateway, NAT and private traffic cost $0. AWS offers more regions; Raff runs from Vint Hill, Virginia.
Yes. Each VPC is fully isolated, so overlapping CIDR ranges across VPCs are allowed. You can run dev, staging and production with identical addressing, for example 10.0.0.0/24 in each, and your configs stay identical across environments.
Use a site-to-site VPN: Raff supports WireGuard and IPsec tunnels from your VPC gateway to your office router or another cloud. You set it up from the VPC's VPN tab in the dashboard. See Hybrid Cloud Connect for the full feature.
PrivateLink creates private endpoints in your VPC for Raff managed services such as databases. Your apps, functions and VMs reach those services over the internal network, without any traffic crossing the public internet. It is included free with every VPC.
Yes. Each VPC is an isolated network: your IP space and traffic are separated per tenant, and no other customer can see or reach your private network. Security groups add stateful, per-VM firewall rules inside the VPC.
Isolated private networks with the gateway, DNS and unmetered traffic included. 15,000+ builders run on Raff from Vint Hill, Virginia, backed by a 99.9% uptime SLA in writing.