# Networking

## Public addresses

Every machine gets its own public IPv6 address, free. You can also reserve public IPv4 addresses
and attach one to a machine. Addresses stay with the machine when it sleeps. (A sandbox has no
public address and can't be given one: see Sandboxes.)

```sh
ssh ip@shell.639cloud.com list
ssh ip@shell.639cloud.com reserve                  # billed monthly while reserved
ssh ip@shell.639cloud.com attach ADDRESS web-1
ssh ip@shell.639cloud.com detach ADDRESS           # stays reserved
ssh ip@shell.639cloud.com release ADDRESS          # detach first
```

## Opening ports

Inbound traffic is closed until you open ports. The list applies to both the machine's IPv4 and
IPv6.

```sh
ssh ip@shell.639cloud.com inbound web-1                       # show
ssh ip@shell.639cloud.com inbound web-1 443 udp:51820 icmp     # open these
ssh ip@shell.639cloud.com inbound web-1 22 from 203.0.113.0/24  # only from a range
ssh ip@shell.639cloud.com inbound web-1 none                   # close everything
```

Agents (an API key, MCP, an `ssh` command) can't open SSH (22), the Docker API (2375, 2376),
MySQL (3306), PostgreSQL (5432), Redis (6379), Elasticsearch (9200), memcached (11211) or MongoDB
(27017) wider than a /16 (IPv4) or /32 (IPv6) in all: they give a range (`22 from
203.0.113.0/24`), or a person opens it in the app.

A sleeping machine doesn't answer traffic on its public address until something wakes it.

## Private networks (VPCs)

A VPC is a private network between your machines. Members reach each other on `eth1` at stable
addresses, and machines join or leave live.

```sh
ssh vpc@shell.639cloud.com create backend               # picks a free /16
ssh vpc@shell.639cloud.com create backend 10.20.0.0/24  # or choose the range
ssh vpc@shell.639cloud.com attach ubuntu-1 backend
ssh vpc@shell.639cloud.com detach ubuntu-1
ssh vpc@shell.639cloud.com delete backend               # must be empty
ssh vpc@shell.639cloud.com list
```

Ranges are /16 to /28 inside `10.0.0.0/8` or `192.168.0.0/16`.

VPC traffic doesn't wake a machine: while a member is asleep, packets sent to it are dropped. For a
machine others reach over the VPC (a database, an internal API), turn auto-sleep off.

## Outbound rules

Per machine, the internet is either on with a deny list or off with an allow list (machine page →
**Internet**, the API's `network` field, or the MCP tool `set_network`):

```json
{"internet": false, "allow": ["1.1.1.1:53", "151.101.0.0/16:443"]}
{"internet": true,  "deny":  ["203.0.113.0/24"]}
```

Allow a DNS server when the allowed hosts are reached by name. Outbound email (port 25) is always
blocked.

To allow sites by name instead, with the internet off, add presets (`github`, `packages`,
`model-apis`) or names of your own (`api.example.com`, `*.example.com`):

```json
{"internet": false, "presets": ["github", "packages"], "allow_names": ["*.example.com"]}
```

The machine can then reach those sites over HTTPS and HTTP, and look names up (DNS to 1.1.1.1 and
1.0.0.1); other traffic stays blocked. Each connection is checked by the site name the program asks
for (the TLS server name or the HTTP Host); content isn't decrypted or changed. A name check can't
tell apart sites that share an address (a CDN), so it narrows what code can reach rather than
sealing it. A machine has up to 256 such connections open at once, within its usual connection
limits.