> ## Documentation Index
> Fetch the complete documentation index at: https://datum.net/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Traffic and connecting

> Learn which traffic a gVPC network carries and how Instances connect to each other.

A network carries private traffic between Instances. This page describes which kinds of traffic are possible and how Instances connect to each other. To learn how Instances get their addresses, see [Addressing](https://datum.net/docs/galactic-vpc/networks/addressing.md).

> [!NOTE]
>
> [gVPC](https://datum.net/docs/galactic-vpc/overview.md) is in preview, and the `networking.datumapis.com/v1alpha` API can change.

## What traffic a network carries

The following table describes which kinds of traffic are possible:

| Traffic | Available | Details |
| - | - | - |
| Between Instances on the same network in the same location | Yes | Instances use their private IPv6 addresses. Any Instance can connect to any port on another Instance in the same network and location. |
| Between Instances on the same network in different locations | Yes | A network spans locations, and Instances can connect to each other privately across locations using their private IPv6 addresses. |
| Between different networks | No | Networks are isolated from each other. |
| To or from other addresses through an Instance | No | A network only delivers a packet addressed to an Instance's own address, and only accepts a packet from an Instance's own address. An Instance can't route traffic for other addresses, so a router or VPN appliance needs an overlay, such as VXLAN or a UDP tunnel, between Instances. |
| Inbound from the internet | Through Datum's ALB | Instance addresses aren't reachable from the internet directly. Public HTTP and HTTPS traffic reaches Instances through Datum's [Application Load Balancer](https://datum.net/docs/alb/overview.md). Raw TCP and UDP exposure is a preview limitation. |
| Outbound to the internet | Yes | Instances can reach internet destinations, including services that have only IPv4 addresses. |
| Lookups by name | Not in the preview | Private DNS names for Instances are on the [roadmap](https://datum.net/docs/galactic-vpc/limitations-and-roadmap.md#planned-capabilities). Use IPv6 addresses in the preview. |
| Firewall filtering | Not in the preview | Firewall rules to filter traffic between Instances on a network are on the [roadmap](https://datum.net/docs/galactic-vpc/limitations-and-roadmap.md#planned-capabilities). |

The workload API accepts a `networkPolicy` field on each network interface, but the field has no effect. Don't rely on it to restrict traffic. To limit who can reach a service, check credentials in your app, or put services that must stay apart on different networks. Firewall rules for networks are on the [roadmap](https://datum.net/docs/galactic-vpc/limitations-and-roadmap.md#planned-capabilities).

## Connect to other Instances

To connect from one Instance to another on the same network, use the peer's private IPv6 address. Keep the following points in mind:

* Make your app listen on IPv6 (`::`). An app that listens only on `0.0.0.0` accepts IPv4 connections only, and Instances don't have IPv4 addresses.
* In a URL, put an IPv6 address in square brackets, such as `http://[fd20:4a3b:91c2:1::1:0:2]:8080/`.
* Private DNS names aren't available in the preview. To tell an app about its peers, pass their addresses in environment variables or a ConfigMap.

## What's next

* To serve a workload publicly through Datum's ALB, see [Compute and ALB](https://datum.net/docs/compute/compute-and-alb.md).
* To review what networks can't do, see [Limitations and roadmap](https://datum.net/docs/galactic-vpc/limitations-and-roadmap.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.