April 8, 2026
Networking got a complete overhaul. Marketplace is live. And you can finally see what's happening inside your account.
🌐 VPC Networking — Rebuilt from the Ground Up NEW
This is the biggest networking update we've shipped. VPCs now have real gateway infrastructure, port forwarding, DNS management, security groups, and a visual network diagram — all from the dashboard.
Platform Router
Every VPC can now enable an on-demand platform router. When you enable it, a gateway VM is created at .1 on your VPC subnet with NAT, DNS forwarding, and DHCP. This means VMs inside your VPC can reach the internet through the router without needing their own public IP. You can enable or disable the router per VPC from the VPC detail page.
Port forwarding is built into the platform router. You can map a public port on the router's IP to any private IP and port inside your VPC — for example, forward port 8080 on the router to 10.0.0.5:80 on an internal VM. Up to 10 rules per VPC, applied instantly without a reboot. All managed from the Port Forwarding tab on the VPC detail page.
The platform router is free. No additional billing — it's part of the VPC.
Firewall Appliance Gateway
If you need full control over your gateway — custom firewall rules, VPN, traffic shaping, IDS/IPS — you can deploy OPNsense as your VPC gateway instead of the platform router. The appliance gets two NICs: a WAN interface with a public IP and a LAN interface on your VPC subnet.
Two sizes are available: 2 vCPU / 4 GB and 4 vCPU / 8 GB. OPNsense boots with a pre-generated config — admin credentials, interfaces, NAT, and SSH are configured automatically from a FAT32 context disk. After deployment, you manage it through the OPNsense WebGUI.
The firewall appliance is billed like any other VM — subscription or pay-as-you-go. When you disable the gateway, any remaining subscription value is converted to account balance credit.
DNS Management
You can now set custom primary and secondary DNS servers per VPC. Editing DNS from the VPC detail page or the VPC list pushes the change to the router's DHCP configuration and refreshes all VM NICs in the background — each NIC is detached, waits for the hotplug cycle to complete, and reattached with the updated settings. You don't need to reboot anything.
Security Groups
Security groups are firewall rule sets that you attach to public NICs. Create a group, define up to 40 inbound and 40 outbound rules, and attach it to any public NIC from the Public IPs tab, the Firewall tab, or directly from the VM's Network tab. CIDR input is simplified — type 192.168.1.0/24 or a bare IP and it handles the rest. You can change or detach groups at any time.
Security groups apply to public NICs only, not VPC NICs.
Network Diagram
A new visual topology map shows your VMs, VPC zones, public IP badges, and gateway nodes. You can assign a public IP to a VM directly from the diagram by clicking on the VM node. The diagram updates as you add or remove resources.
Networking Tab
All networking now lives under one dedicated section in the dashboard with four tabs: Diagram, VPCs, Public IPs, and Firewall. Public IPs are grouped by VPC with summary cards showing your IPv4, IPv6, reserved, and available counts. VPC detail pages have their own tabbed layout — VMs, Port Forwarding, Peering, and Services. VPC rows in the table are clickable and the table has been simplified from nine columns to six.
🏪 Marketplace NEW
One-click app deployment is live. You can browse and deploy pre-configured applications directly from the dashboard.
What's Available
Five apps are available at launch: WordPress, n8n, Docker, OpenClaw, and OPNsense. Each one has been rebuilt with a guided configuration flow. You pick a template, set your credentials and preferences — firewall, fail2ban, timezone, swap, auto-updates — choose a VM size, and deploy. The app boots ready to use. No SSH required to get started.
App Management
Marketplace VMs show a "Manage App" button on the VM detail page that opens your app's web UI directly. Each template also comes with guide cards — help articles specific to that app, stored in the database so we can keep adding content without shipping code changes.
Reinstall Support
If you reinstall a VM to a marketplace template, the full app configuration flow appears again. Your app context is passed through the entire reinstall chain, so the new image boots with the settings you chose.
🔒 Security & Audit Log NEW
There's a new Security page in the dashboard that gives you full visibility into your account activity.
Every API call to your account is logged. You can filter by actor (users or API keys), resource type, action, and result. The table shows timestamps, methods, and status codes at a glance. Expand any row and you get the full picture — request ID, endpoint, duration, IP address, headers, query parameters, and request/response bodies.
Deep linking works out of the box. A URL like /home/security?resource_type=vm&resource_id=123 opens the security page with those filters pre-filled. The VM detail page now has an Activity tab that shows audit events filtered to that specific VM, with success/failure filtering and pagination. There's a "Full Logs" button that takes you to the security page with the VM pre-selected.
System noise is filtered by default — OPTIONS requests, CORS preflights, and system-level actor events don't show up in the customer view.
The Security page is permission-gated. You'll find it under the MANAGE section in the sidebar with a Shield icon. The account.audit.view permission controls access, and it's available in the roles grid under Account Settings.
🖥️ Compute UX Improvements IMPROVED
The VM experience got a round of updates across list, detail, and mobile views.
-
Quick actions in VM list — Copy a VM's IP or open the terminal directly from the dropdown menu, no need to navigate into the detail page first.
-
Bulk power actions — Select multiple VMs and start or stop them in parallel.
-
VM detail header redesign — IP address in the subtitle with one-click copy. Action buttons in a uniform grid. Console is the primary button. "Upgrade" renamed to "Resize."
-
Inline resize guidance — If your VM is running, the resize page now shows an inline "Stop VM" button right next to the warning instead of just telling you to stop it.
-
NIC-based IP display — VM list now shows public IP, private/VPC IP, and IPv6 from the actual NIC data instead of the old product columns.
-
VM type filtering — VMs are visually tagged by type — compute, app, or gateway — with colored left borders in the list. Filter tabs appear at the top when you have more than one type.
-
Pagination — VM list now shows 10 items per page instead of 5.
-
Mobile card redesign — Fixed-width label grid with resources split into CPU, Memory, and Storage rows. Quick action buttons for active VMs.
-
Mobile tab bar — Two rows of five with icon and label, taller tap targets.
-
VNC terminal quality — Improved display quality for the browser-based VNC terminal on both Linux and Windows VMs.
📝 VM Notes NEW
You can now add notes to any VM. There are two types: personal notes that only you can see, and team notes that are visible to everyone on the account. Both live under the Actions tab on the VM detail page and auto-save as you type. Use them to document installation steps, track configuration changes, leave instructions for teammates, or just keep reminders for yourself.
🌍 Flexible Networking Options NEW
Previously, every VM was automatically assigned both a public IP and a private (VPC) IP during creation. There was no way to choose.
Now you select each one separately. For public IP, you can choose auto-assign, pick a reserved IP, or select "None" to skip it entirely. For private networking, you can auto-create a new VPC, attach to an existing one, or select "None" to skip it. At least one is required — the UI won't let you skip both.
If you skip the public IP, the VM is only reachable inside the VPC. You can still access it through the VNC terminal on the dashboard.
Windows VMs — The default for Windows has changed. Previously, Windows VMs were assigned both a public and private IP automatically. Now, only a public IP is assigned by default because of a known issue with dual-NIC routing on Windows through a gateway. You can still add a VPC during creation if you need it.
💳 Billing Improvements IMPROVED
Subscriptions now show the actual product name and specs — for example, "4 vCPU / 8 GB / 120 GB SSD" — along with the project name. Both the billing overview and the subscriptions detail page group everything by project with collapsible headers and per-project cost totals.
Usage logs got the same treatment. Current usage and usage history now show project grouping with item counts, cost totals, and percentages. Everything pulls from joined product tables on the backend, so the data is accurate and consistent.
Gateway billing is fully integrated. The firewall appliance creates a subscription or bills pay-as-you-go like any other VM. When you disable a gateway, unused subscription value converts to account balance credit automatically.
🐛 Bug Fixes
VPC available IP count — The available IP count on VPCs could show incorrect numbers after deleting VMs. This is now accurate and updates reliably.
VPC deletion — Deleting a VPC with an active gateway could fail silently. This now completes cleanly every time.
VM creation retries — In rare cases, a failed VM creation that retried could end up in a permanent failure state even though the retry succeeded. Fixed — you'll see the correct status now.
VM reboot status — Rebooting a VM would briefly show it as "provisioning" in the dashboard. It now stays "active" throughout, which is the correct state.
Audit log — The Security & Audit Log feature was not recording events since January 2026. Fully reconnected and logging all activity.
Duplicate VPC attachment — Connecting a VM to a VPC it was already attached to could cause conflicts. The dashboard now prevents this.
VPC network diagram — The network diagram wasn't displaying VMs in some cases. Fixed.
VM list IP display — Some VMs were showing stale or missing IP addresses in the list view. IPs now always reflect the current state.
Coming Soon
-
🌐 VPC Next Phase — VPN gateway, high-availability NAT, advanced NAT management, and VPC peering for enterprise networking.
-
☸️ Managed Kubernetes — Kubernetes on Raff infrastructure.
-
🔑 API Enhancements — Continued expansion. Still in active development.
-
📖 Marketplace Documentation Hub — Dedicated docs for every marketplace app.
-
🏪 New Marketplace Templates — More apps coming. Tell us what you need.
-
🌐 Own IP Space — New IP onboarding process. Our own IP blocks will be available in the coming days.
-
🚀 Raff Serverless Apps — Coming with v1.5.
This is the biggest release we've shipped. Networking, marketplace, security, and dozens of fixes across the board. More coming fast.