Networking & VPN

Networking & VPN
Private VPCs, WireGuard tunnels, and load balancing

Networking on MarQi Cloud is private by default. Your instances sit in an isolated VPC, you reach them through a WireGuard tunnel rather than an exposed public port, and traffic between our zones never touches the public internet. There are no egress fees on any of it.

Isolated VPCs

Every account gets its own virtual private cloud. Instances inside a VPC talk to each other over private addressing; nothing is reachable from outside unless you publish it deliberately. That means databases, internal APIs and management interfaces can stay entirely off the public internet while still being fully accessible to your team and your applications.

WireGuard VPN access

We use WireGuard for operator and site-to-site access. It is modern, fast, and small enough to audit — which fits how we build the rest of the platform. We generate the peer configuration for you; you import it, bring the interface up, and your workstation or office network joins the VPC. From there you can SSH, run migrations, and reach private services exactly as if you were on the same LAN.

Load balancers

A load balancer is included with every plan on our pricing page — it is not a metered add-on. Put one in front of a pool of instances to distribute traffic, drain a node for maintenance without downtime, and terminate TLS in one place. Layer 4 and Layer 7 behaviour differ meaningfully under load, and choosing correctly matters more than most teams expect.

Connecting your own hardware

If you run servers of your own, they can join the same VPC as your MarQi Cloud instances rather than sitting behind a translation layer. That single-VPC model is the core of our hybrid cloud offering, and it is what makes a gradual migration possible instead of a big-bang cutover. Hardware you want physically close to our cloud can be racked with us through colocation and BYO hardware.

Dedicated circuits and BGP peering

When a tunnel over the internet is not enough — regulated workloads, latency-sensitive replication, or predictable throughput commitments — we design dedicated connectivity instead. That covers private circuits between your Atlanta-area sites and our zones, and BGP peering for organisations that bring their own address space. Details are on private circuits and peering.

The fabric underneath

Hosts have multiple NIC paths into redundant switching fabrics, and upstream capacity comes from tier-1 providers, so there is no single link whose failure takes your instances offline. Inter-zone traffic rides those backbones rather than the open internet and is encrypted in transit. The full design is documented under network fabric, and the geography is on our zones.

Getting set up

New to the platform? Start with getting started, which covers account creation through first VM and first tunnel. If you would rather have our engineers design and run the network for you, that is what managed services is for — or just talk to an engineer.