Create a new VPC and optionally define new subnets within it. A successful request triggers a vpc_create event, and subnet_create events for any created VPC subnets.

If you define subnets during the creation of a VPC, you can optionally configure each subnet with an existing, compatible NAT Gateway by providing an id.

• The NAT Gateway must reside in the same region as the new VPC, and it can't already be used by another subnet.
• Active Linode interfaces added to a NAT-configured subnet automatically route outbound public internet traffic through the gateway, bypassing any legacy setup.

By default, a VPC initializes with a standard set of private IPv4 ranges if the ipv4 field is omitted or null. Use the List VPC default and forbidden IPv4 ranges operation to view default_ipv4_ranges.

You can optionally specify up to 30 custom IPv4 ranges (CIDRs) at the VPC level. These ranges serve as the global address pool for the entire VPC, unlike subnet ranges, which apply only to individual subnets. All subnets within the VPC must be contained within these defined ranges. Custom ranges must be provided in canonical, aggregated form and cannot overlap with forbidden infrastructure ranges. Run the List VPC default and forbidden IPv4 ranges operation to view forbidden_ipv4_ranges. If you're specifying the VPC's IPv4 range, consider the following:

• The array must contain at least one range. This array represents the desired final state of the VPC's IPv4 space.
• All ranges must be provided in canonical format with no host bits set. For example, 10.0.0.0/8 is valid, but 10.1.0.0/8 is rejected.
• Ranges must be fully aggregated. Overlapping ranges or sub-ranges already contained within a larger prefix are not allowed. For example, you can't provide both 10.0.0.0/8 and 10.1.0.0/24.
• The system automatically sorts the IPv4 ranges using standard Python network sorting logic, the primary sort is by network address, and then by prefix length.

📘

Forbidden ranges

Some specific IP ranges are reserved for internal VPC infrastructure and services such as DNS and route management. These ranges are blocked from being assigned as top-level VPC CIDRs to prevent routing conflicts. You can view these forbidden ranges by checking the forbidden_ipv4_ranges field.

After you create a VPC, you can attach it to a Linode by assigning a VPC subnet to one of the Linode's network interfaces.

You can also attach managed databases and NodeBalancers to a subnet belonging to a regular VPC type.

Permissions and scopes

To call this operation, you need the following:

• Identity and access permissions. Your user needs a role with these permissions assigned. Learn more.

  • Permissions: create_vpc

• OAuth scopes. Your user needs these scopes assigned. Learn more.

  • Scopes: vpc:read_write

CLI

linode-cli vpcs create \
  --description "A description of my VPC." \
  --label vpc-temp \
  --region us-east \
  --subnets.label vpc-subnet-temp \
  --subnets.ipv4 10.0.1.0/24 \
  --subnets.natgateway.id 41
  --ipv4 '[{"range": "10.0.0.0/8"}, {"range": "172.16.0.0/12"}, {"range": "192.168.0.0/17"}]'

Learn more