[Yandex Cloud documentation](../../index.md) > [Tutorials](../index.md) > [Architecture and networking](index.md) > BareMetal > Configuring network connectivity in the BareMetal subnet # Establishing network connectivity in a Yandex BareMetal private subnet If you set up routing for a [private subnet](../../baremetal/concepts/private-network.md#private-subnet) and assigned it a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing), the network interfaces of [BareMetal servers](../../baremetal/concepts/servers.md) connected to this subnet will get IP addresses from the range specified in the subnet’s CIDR settings via [DHCP](https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol). However, if you did not set up routing for a private subnet, this subnet functions as an [OSI](https://en.wikipedia.org/wiki/OSI_model) L2 network, where DHCP does not work, and you need to assign IP addresses manually in the server network interface settings to establish network connectivity. This is because the DHCP server becomes part of a private subnet only once the subnet is routable and connected to a [virtual network segment](../../baremetal/concepts/private-network.md#vrf-segment) (VRF). {% note info %} If the server OS is installed from [Yandex Cloud Marketplace](https://yandex.cloud/en/marketplace) images, all physical interfaces on this server are configured to use DHCP for IP address assignment by default. {% endnote %} To learn more about networks in Yandex BareMetal, see [Network](../../baremetal/concepts/network.md). In this tutorial, you will learn how to manually disable DHCP on a network interface from a BareMetal server private subnet and assign it a static IP address. You will also learn to re-enable DHCP on the server's network interface after routing is enabled in this subnet. In this example, you will use BareMetal servers running Linux Ubuntu 24.04 LTS. If using another OS, you will follow the same steps, but the way you configure network interfaces may differ. For network interface configuration steps in other operating systems, refer to the relevant OS tutorials To configure network connectivity in a Yandex BareMetal subnet: 1. [Get your cloud ready](#before-you-begin). 1. [Create a private subnet](#create-subnet). 1. [Rent BareMetal servers](#rent-servers). 1. [Manually configure the network interfaces](#setup-interfaces). 1. [Create a VRF segment and enable routing in the private subnet](#setup-vrf). 1. [Enable DHCP on the network interfaces](#re-enable-dhcp). See also [How to cancel server lease](#clear-out). ## Getting started {#before-you-begin} Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md): 1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account. 1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it. If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud). [Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md). ### Required paid resources {#paid-resources} The cost of the proposed solution includes the BareMetal server lease fee (see [Yandex BareMetal pricing](../../baremetal/pricing.md)). ## Create a private subnet {#create-subnet} Create a private subnet in the `ru-central1-m3` [server pool](../../baremetal/concepts/servers.md#server-pools): {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you are going to create your infrastructure. 1. Navigate to **BareMetal**. 1. In the left-hand panel, select ![icon](../../_assets/console-icons/nodes-right.svg) **Private subnets** and click **Create subnet**. 1. In the **Pool** field, select the `ru-central1-m3` server pool. 1. In the **Name** field, enter the subnet name: `subnet-m3`. 1. Without enabling the **IP addressing and routing** option, click **Create subnet**. {% endlist %} ## Renting BareMetal servers {#rent-servers} {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure. 1. Navigate to **BareMetal**. 1. Click **Lease server** and, in the window that opens, select `Stock configurations` and a suitable BareMetal server [configuration](../../baremetal/concepts/server-configurations.md) in the `ru-central1-m3` server pool. Do it by selecting the `ru-central1-m3` server pool in the filter on the right side of the window, under **Pool**. To select the suitable server configuration, click the section with its name in the central part of the screen. {% note tip %} You can reduce the cost of renting a server in some configurations by ordering server [assembly](../../baremetal/concepts/server-custom-configurations.md#assembly). To use the discount, hover over **Cheaper with assembly** ![circle-info.svg](../../_assets/console-icons/circle-info.svg) under the configuration at hand and click ![person-nut-hex.svg](../../_assets/console-icons/person-nut-hex.svg) **Go to assembly** in the pop-up window. When ordering a server with assembly, follow the steps below to configure the server properties. In this case, the server will not be available immediately, but only after the assembly is completed (within four calendar days), and at a lower price. {% endnote %} 1. In the server configuration window that opens: 1. In the **Lease duration** field, select the [lease period](../../baremetal/concepts/servers.md#server-lease): `1 day`, `1 month`, `3 months`, `6 months`, or `1 year`. When this period expires, server lease will automatically be renewed for the same period. You cannot terminate the lease during the specified lease period, but you can [refuse](../../baremetal/operations/servers/server-lease-cancel.md) to extend the server lease further. 1. Under **Image**, select the `Ubuntu 24.04` image. 1. Optionally, under **Disk**, configure [disk](../../baremetal/concepts/disks/disk-types.md) partitioning: 1. Click **Configure disk layout**. 1. Specify partition settings. To create a new partition, click ![icon](../../_assets/console-icons/plus.svg) **Add partition**. To configure [RAID](../../baremetal/concepts/disks/raid.md) arrays and disk partitions by yourself, click **Remove RAID**. 1. Click **Save**. 1. Under **Network interfaces**: 1. In the **Private subnet** field, select the `subnet-m3` subnet you created earlier. 1. In the **Public address** field, select `No address`. 1. Under **Access**: 1. In the **Password** field, select one of the following options to create a root password: * To generate a new root password, select `New password` and click **Generate**. {% note warning %} This option requires you to maintain password security. Save the password you generated in a secure location. Yandex Cloud does not store it, and you will not be able to retrieve it once the server is deployed. {% endnote %} * To use the root password saved in a Yandex Lockbox [secret](../../lockbox/concepts/secret.md), select `Lockbox secret`. In the **Name**, **Version**, and **Key** fields, select the secret containing your password, its version, and its key, respectively. If you do not have a Yandex Lockbox secret, click **Create** to create it. Choose the `Custom` secret type to specify a custom password or `Generated` to generate password automatically. 1. In the **Public SSH key** field, select the SSH key saved in your [organization user](../../organization/concepts/membership.md) profile. If there are no SSH keys in your profile or you want to add a new key: 1. Click **Add key**. 1. Enter a name for the SSH key. 1. Select one of the following: * `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own. * `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own. * `Generate key`: Automatically create an SSH key pair. When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home//.ssh` directory. In Windows, unpack the archive to the `C:\Users\/.ssh` directory. You do not need additionally enter the public key in the management console. 1. Click **Add**. The system will add the SSH key to your organization user profile. If the organization has [disabled](../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource. 1. Under **Server information**, in the **Name** field, enter the server name: `server-m3-1`. 1. Click **Lease server**. 1. Similarly, lease one more server named `server-m3-2` in the `ru-central1-m3` server pool. {% endlist %} {% note info %} Getting servers ready and installing operating systems on them may take up to 45 minutes. The servers will have the `Provisioning` status during this time. After OS installation is complete, the server status will change to `Ready`. {% endnote %} ## Manually configure the network interfaces {#setup-interfaces}. Since the DHCP server is disabled in the `subnet-m3` private subnet, the BareMetal servers you created have no internal IP addresses assigned or network connectivity established. At this stage, you will connect to the servers and modify the settings of their network interfaces linked to the private subnet by disabling DHCP and assigning them static IP addresses. No public IP addresses were assigned to the servers, so you cannot connect to them [over SSH](../../compute/operations/vm-connect/ssh.md). To connect to the servers, you will use the KVM console. ### Configure the network interfaces to use static IP addresses {#enable-static} {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure. 1. Navigate to **BareMetal**. 1. Next to `server-m3-1`, click ![image](../../_assets/console-icons/ellipsis.svg) and select **KVM console**. The KVM console terminal window will open, showing a login prompt: ``` server-m3-1 login: ``` If you do not see this prompt, try [restarting](../../baremetal/operations/servers/server-stop-and-start.md#restart) the server. Perform all further actions described in this step in the KVM console terminal: 1. Specify `root` for the username and press **ENTER**. 1. Paste the password you got when renting the server in the password input line and press **ENTER**. Note that when typing or pasting a password in Linux, the characters you enter will not appear on the screen. {% note tip %} To paste clipboard text to the KVM console, use the **Paste text here** field in the upper right corner. {% endnote %} Result: ```text Welcome to Ubuntu 24.04.2 LTS (GNU/Linux 6.8.0-53-generic x86_64) ... root@server-m3-1:~# _ ``` If you did not save the server administrator password, you can create a new password following [this guide](../../baremetal/operations/servers/reset-password.md) or [reinstall](../../baremetal/operations/servers/reinstall-os-from-marketplace.md) the server OS. 1. View a list of the server’s network interfaces and find the interface connected to the private subnet: ```bash ip a ``` Result: ```text ... 5: etx2: mtu 1500 qdisc ma state UP group default qlen 1000 link/ether 00:02:09:35:fd:31 brd ff:ff:ff:ff:ff:ff altname enp6s0d1 inet6 fe80::202:c9ff:fe35:fd31/64 scope link valid_lft forever preferred_lft forever ... ``` Since the server has no public IP address, its only active network interface (with the `state UP` status) is the one connected to the private subnet. In the example above, this interface has the `etx2` ID. In the next step, you will assign a static IP address to this interface. {% note tip %} To make sure the correct network interface is selected, use its MAC address. You can [view](../../baremetal/operations/servers/get-info.md) the MAC address of your BareMetal server’s network interface on the server information page under **Network interfaces**. {% endnote %} 1. Open the server network interface configuration file: ```bash nano /etc/netplan/50-cloud-init.yaml ``` 1. In the file, edit the network interface settings: ```yaml network: version: 2 ethernets: ... # This example shows only the configuration of the interface you need to set up. etx2: match: macaddress: "00:02:09:35:fd:31" dhcp4: false # Here, opt out of using DHCP. addresses: # Set the interface static IP address in this section. - 192.168.1.101/24 set-name: "etx2" ``` For the `etx2` interface, configure the following settings: * Change the `dhcp4` value to `false` to opt out of using DHCP and set the interface IP address statically. * Add the `addresses` section with the internal static IP address assigned to the server. Each server's address must be unique within the subnet. {% note info %} For subnet addressing purposes, you can use any CIDR in the ranges reserved for private networks: `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16`. The subnet must include at least 8 host addresses, requiring a CIDR prefix length is `/29`. {% endnote %} To save the changes and exit the text editor, press **Ctrl + X** and confirm saving changes to the `50-cloud-init.yaml` file. 1. Apply your changes: ```bash netplan apply ``` 1. Make sure the network interface was assigned an IP address. To do this, run the following command and filter the output by the interface ID: ```bash ip a | grep etx2 ``` Result: ```text 5: etx2: mtu 1500 qdisc ma state UP group default qlen 1000 inet 192.168.1.101/24 brd 192.168.1.255 scope global etx2 ``` The network interface is configured to use the `192.168.1.101` static IP address in `subnet-m3`. 1. Similarly, configure the `server-m3-2` network interface by assigning it the `192.168.1.102/24` static IP address in the netplan settings. {% endlist %} ### Test network connectivity between the servers {#validate-connectivity} By reconfiguring the network interfaces of the servers in the private subnet, you established network connectivity between them. Here is how you can test it: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure. 1. Navigate to **BareMetal**. 1. Next to `server-m3-1`, click ![image](../../_assets/console-icons/ellipsis.svg) and select **KVM console**. 1. Authenticate as the `root` user in the KVM console terminal with the password you saved when renting the server. 1. In the KVM console terminal, run the `ping` command to make sure you can access `server-m3-2` by its IP address, `192.168.1.102`: ```bash ping 192.168.1.102 -c 5 ``` Result: ```text PING 192.168.1.102 (192.168.1.102) 56(84) bytes of data. 64 bytes from 192.168.1.102: icmp_seq=1 ttl=64 time=3.90 ms 64 bytes from 192.168.1.102: icmp_seq=2 ttl=64 time=0.235 ms 64 bytes from 192.168.1.102: icmp_seq=3 ttl=64 time=0.222 ms 64 bytes from 192.168.1.102: icmp_seq=4 ttl=64 time=0.231 ms 64 bytes from 192.168.1.102: icmp_seq=5 ttl=64 time=0.235 ms --- 192.168.1.102 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4086ms rtt min/avg/max/mdev = 0.222/0.964/3.899/1.467 ms ``` Network connectivity between the servers has been established with zero packet loss. {% endlist %} ## Create a VRF segment and enable routing in the private subnet {#setup-vrf} To enable the DHCP server in the private subnet, create a virtual network segment (VRF) and enable routing in the subnet by linking it to that VRF. ### Create a virtual network segment (VRF) {#create-vrf} {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure. 1. Navigate to **BareMetal**. 1. In the left-hand panel, select ![icon](../../_assets/console-icons/vector-square.svg) **VRF** and click **Create VRF**. 1. In the **Name** field, name your VRF segment: `my-vrf`. 1. Click **Create VRF**. {% endlist %} ### Connect the private subnet to the VRF segment {#connect-subnet-to-vrf} {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure. 1. Navigate to **BareMetal**. 1. In the left-hand panel, select ![icon](../../_assets/console-icons/nodes-right.svg) **Private subnets**. 1. Next to `subnet-m3`, click ![image](../../_assets/console-icons/ellipsis.svg) and select ![pencil](../../_assets/console-icons/pencil.svg) **Edit**. In the window that opens: 1. Enable **IP addressing and routing**. 1. In the **Virtual network segment (VRF)** field, select `my-vrf`. 1. In the **CIDR** field, specify `192.168.1.0/24`. 1. In the **Default gateway** field, keep the default value, `192.168.1.1`. 1. Enable the **Assigning IP addresses via DHCP** option and in the **IP address range** field that appears, leave the default values, `192.168.1.1` — `192.168.1.254`. 1. Click **Save changes**. {% endlist %} ## Enable DHCP on the network interfaces {#re-enable-dhcp} After you enabled routing in the private subnet and connected it to the VRF segment, a DHCP server starts automatically in this subnet. To allow network interfaces of your BareMetal servers to obtain IP addresses via DHCP, you need to enable DHCP in their configuration. {% note info %} The DHCP server that serves VRF-enabled private subnets can only assign IP addresses to physical interfaces of trusted BareMetal servers. Therefore, you cannot assign IP addresses from a private subnet to containers or VMs running on your server. {% endnote %} ### Enable DHCP {#enable-dhcp} {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure. 1. Navigate to **BareMetal**. 1. Next to `server-m3-1`, click ![image](../../_assets/console-icons/ellipsis.svg) and select **KVM console**. 1. Authenticate as the `root` user in the KVM console terminal with the password you saved when renting the server. Perform all further actions described in this step in the KVM console terminal: 1. Open the server network interface configuration file: ```bash nano /etc/netplan/50-cloud-init.yaml ``` 1. In the file, edit the settings of the network interface connected to the private subnet: ```yaml network: version: 2 ethernets: ... # This example shows only the configuration of the interface connected to the private subnet. etx2: match: macaddress: "00:02:09:35:fd:31" dhcp4: true # Here, enable DHCP. # Comment out or delete the addresses section. # addresses: # - 192.168.1.101/24 set-name: "etx2" ``` Configure the following settings for the interface: * Change the `dhcp4` value to `true` to enable DHCP for automatic IP address assignment on this interface. * Comment out or delete the `addresses` section with the internal static IP address assigned to the server. To save the changes and exit the text editor, press **Ctrl + X** and confirm saving changes to the `50-cloud-init.yaml` file. 1. Apply your changes: ```bash netplan apply ``` 1. Make sure the network interface was assigned an IP address. To do this, run the following command and filter the output by the interface ID: ```bash ip a | grep etx2 ``` Result: ```text 5: etx2: mtu 1500 qdisc ma state UP group default qlen 1000 inet 192.168.1.2/24 metric 100 brd 192.168.1.255 scope global dynamic etx2 ``` The `server-m3-1` network interface is assigned the `192.168.1.2` IP address in the private subnet named `subnet-m3`. 1. Similarly, configure the `server-m3-2` network interface and save the IP address assigned to it in the private subnet. In our example, this is `192.168.1.3`. {% endlist %} ### Test network connectivity between the servers {#revalidate-connectivity} Make sure the servers retained network connectivity after obtaining IP addresses in the private subnet via DHCP. {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure. 1. Navigate to **BareMetal**. 1. Next to `server-m3-1`, click ![image](../../_assets/console-icons/ellipsis.svg) and select **KVM console**. 1. Authenticate as the `root` user in the KVM console terminal with the password you saved when renting the server. 1. In the KVM console terminal, run the `ping` command to make sure you can access `server-m3-2` by the IP address you saved in the previous step (`192.168.1.3` in our example): ```bash ping 192.168.1.3 -c 5 ``` Result: ```text PING 192.168.1.3 (192.168.1.3) 56(84) bytes of data. 64 bytes from 192.168.1.3: icmp_seq=1 ttl=64 time=0.271 ms 64 bytes from 192.168.1.3: icmp_seq=2 ttl=64 time=0.215 ms 64 bytes from 192.168.1.3: icmp_seq=3 ttl=64 time=0.262 ms 64 bytes from 192.168.1.3: icmp_seq=4 ttl=64 time=0.223 ms 64 bytes from 192.168.1.3: icmp_seq=5 ttl=64 time=0.208 ms --- 192.168.1.3 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4106ms rtt min/avg/max/mdev = 0.208/0.235/0.271/0.025 ms ``` Network connectivity between the servers has been established with zero packet loss. {% endlist %} ## How to cancel server lease {#clear-out} You cannot delete BareMetal servers. Instead, you can choose not to renew their lease. To stop paying for the resources you created, [cancel](../../baremetal/operations/servers/server-lease-cancel.md) the lease of the BareMetal servers you created earlier.