[Yandex Cloud documentation](../../index.md) > [Yandex BareMetal](../index.md) > [Step-by-step guides](index.md) > Network > Creating a private subnet # Creating a private subnet {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a [private subnet](../concepts/private-network.md#private-subnet). 1. Navigate to **BareMetal**. 1. In the left-hand panel, select ![icon](../../_assets/console-icons/nodes-right.svg) **Private subnets**. 1. At the top right, click **Create subnet**. 1. In the **Availability zone** field, select the [availability zone](../../overview/concepts/geo-scope.md) where your server will be located. 1. In the **Pool** field, select the [pool](../concepts/servers.md#server-pools) containing available servers for leasing. 1. In the **Name** field, specify your subnet name. The naming requirements are as follows: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. 1. Optionally, you can add a subnet **Description**. 1. Optionally, you can add labels. 1. Optionally, configure routing to allow communication with servers from other [pools](../concepts/servers.md#server-pools): 1. Enable **IP addressing and routing**. 1. In the **Virtual network segment (VRF)** field, select an existing [VRF](../concepts/private-network.md#vrf-segment) or create a new one. 1. In the **CIDR** field, specify the subnet [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing). 1. In the **Default gateway** field, specify the gateway IP address for routing traffic from this subnet to other VRF-connected subnets. By default, the gateway IP address is the first available address in the specified subnet CIDR range. 1. Optionally, enable **Assigning IP addresses via DHCP** to allow network interfaces on the private subnet to obtain IP addresses automatically. 1. If you have enabled **Assigning IP addresses via DHCP**, specify an IP address range for assigning addresses to server network interfaces. By default, the assigned range matches the subnet’s CIDR block. 1. Click **Create subnet**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. View the description of the command for creating a [private subnet](../concepts/private-network.md#private-subnet): ```bash yc baremetal private-subnet create --help ``` 1. Create a subnet: ```bash yc baremetal private-subnet create \ --hardware-pool-id \ --name \ --description "" \ --labels = \ --vrf-options "vrf-id=,vrf-name=,cidr=,gateway-ip=,dhcp=[start-ip=,end-ip=]" ``` Where: * `--hardware-pool-id`: [Pool](../concepts/servers.md#server-pools) to lease a server from. * `--name`: Subnet name. The naming requirements are as follows: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. * `--description`: Subnet description. This is an optional setting. * `--labels`: Subnet labels. This is an optional setting. * `--vrf-options`: Routing settings for communication with servers from other pools. This is an optional setting. Possible settings: * `vrf-id`: ID of the [virtual network segment (VRF)](../concepts/private-network.md#vrf-segment). * `vrf-name`: VRF name. * `cidr`: Subnet [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing). * `gateway-ip`: Gateway IP address for routing traffic from this subnet to other VRF-connected subnets. This is an optional setting. By default, the gateway IP address is the first available address in the specified subnet CIDR range. * `dhcp`: IP address range for assigning addresses using DHCP to server network interfaces. This is an optional setting. By default, the assigned range matches the subnet’s CIDR block. - API {#api} To create a private subnet, use the [create](../api-ref/PrivateSubnet/create.md) REST API method for the [PrivateSubnet](../api-ref/PrivateSubnet/index.md) resource or the [PrivateSubnetService/Create](../api-ref/grpc/PrivateSubnet/create.md) gRPC API call. {% endlist %} ## Example {#examples} Create a private subnet with a VRF, CIDR, default gateway, and IP address range: {% list tabs group=instructions %} - CLI {#cli} ```bash yc baremetal private-subnet create \ --hardware-pool-id ru-central1-m3 \ --name demo-private-subnet \ --description "My first private subnet" \ --labels env=test \ --hardware-pool-id ru-central1-m3 \ --vrf-options "vrf-id=ly5j5qluq32z********,cidr=10.0.0.0/8,gateway-ip=10.0.0.1,dhcp=[start-ip=10.0.1.2,end-ip=10.0.1.10]" ``` Result: ```text id: ly5p3zynykcg******** cloud_id: b1gia87mbaom******** folder_id: b1gcqo0asnc1******** name: demo-private-subnet description: My first private subnet status: READY zone_id: ru-central1-m hardware_pool_id: ru-central1-m3 vrf_options: vrf_id: ly5j5qluq32z******** cidr: 10.0.0.0/8 dhcp_options: start_ip: 10.0.1.2 end_ip: 10.0.1.10 gateway_ip: 10.0.0.1 created_at: "2025-06-26T13:28:29.348159Z" labels: env: test ``` - API {#api} ```bash curl -X POST \ -H "Content-Type: application/json" \ -H "Authorization: Bearer " \ -d '{ "folderId": "b1g07hj5r6i4********", "hardwarePoolId": "ru-central1-m3", "name": "demo-private-subnet", "description": "My first private subnet", "labels": { "env": "test" }, "vrfOptionsSpec": { "vrfId": "ly5uyq2gbxu2********", "cidr": "10.0.*.*/8", "dhcpOptions": { "startIp": "10.0.*.*", "endIp": "10.0.*.*" }, "gatewayIp": "10.0.*.*" } }' \ "https://baremetal.api.cloud.yandex.net/baremetal/v1alpha/privateSubnets" ``` Where: * ``: IAM token used for authentication. * `folderId`: [Folder ID](../../resource-manager/operations/folder/get-id.md). * `hardwarePoolId`: ID of the [pool](../concepts/servers.md#server-pools) to lease a server from. * `name`: Subnet name. The naming requirements are as follows: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. * `description`: Subnet description. This is an optional parameter. * `labels`: Subnet labels. This is an optional parameter. * `vrfId`: ID of the [virtual network segment (VRF)](../concepts/private-network.md#vrf-segment). * `cidr`: Subnet [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing). * `gatewayIp`: Gateway IP address. This is an optional parameter. * `startIp`, `endIp`: Address range for DHCP. This is an optional parameter. Result: ```bash { "done": true, "metadata": { "@type": "type.googleapis.com/yandex.cloud.baremetal.v1alpha.CreatePrivateSubnetMetadata", "privateSubnetId": "ly52xefxa2hi********" }, "response": { "@type": "type.googleapis.com/yandex.cloud.baremetal.v1alpha.PrivateSubnet", "vrfOptions": { "dhcpOptions": { "startIp": "10.0.*.*", "endIp": "10.0.*.*" }, "vrfId": "ly5licxve4z3********", "cidr": "10.0.*.*/8", "gatewayIp": "10.0.*.*" }, "labels": { "env": "test" }, "id": "ly52xefxa2hi********", "cloudId": "b1gia87mbaom********", "folderId": "b1g07hj5r6i4********", "name": "demo-private-subnet", "description": "My first private subnet", "status": "READY", "zoneId": "ru-central1-m", "hardwarePoolId": "ru-central1-m3", "createdAt": "2025-12-14T14:42:58.372557Z" }, "id": "ly5hcnsbx3l4********", "description": "Private subnet create", "createdAt": "2025-12-14T14:42:58.375290Z", "createdBy": "ajeb9l33h6mu********", "modifiedAt": "2025-12-14T14:42:58.375290Z" } ``` Follow the status of the operation by the `done` field. {% endlist %}