> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers-2/concepts/networks.md).
# Server networks
The network connects your servers to each other, to your customer's offices, and to the internet. We give you four types of network, and you choose according to how much control and isolation you need: from a network that handles the plumbing for you to a pure Layer 2 where you control everything.
### The four networks
| Network | What it gives you | When it fits |
| ------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| **Standard** | A managed Virtual Router: DNS, DHCP, gateway, NAT, and firewall | The usual case. Fast deployment without setting up the network by hand |
| **VPC** | Up to 3 tiers on a shared Virtual Router, with Super CIDR. The only one with Site-to-Site IPSec VPN | Multitier architectures (web · application · data) and connection to the customer's office |
| **Layer 2** | Layer 2 only over VXLAN, without a Virtual Router. You manage DNS, DHCP, routes, and firewall with your VNF | Full control of the network stack |
| **Direct IP** | A public IP without NAT, delivered directly to the server | Expose services or serve as WAN for your firewall |
> #### 📘 The Standard network comes fully set up
>
> In Standard and VPC, a Virtual Router handles DNS, DHCP, gateway, NAT, and firewall. In Layer 2 and Direct IP there is no Virtual Router: you provide that part yourself with a VNF.
### Firewall and Geo-IP
Each network includes firewall control: you define rules for **incoming** and **outgoing**, and you restrict traffic by country with **Geo-IP**, allowing or blocking entire regions. In Standard and VPC the firewall lives in the Virtual Router; in Layer 2 it is applied by your VNF.
### Your own firewall: VNFs
A **VNF** is a network appliance that you deploy and operate yourself. In the Marketplace you have **FortiGate VM** (Fortinet) and **FireboxV** (WatchGuard).
The self-managed perimeter pattern combines three pieces: **Direct IP** as WAN, your **VNF** as a firewall and a network **Layer 2** as LAN behind it. That way you control end to end the ingress and egress of your customer's traffic.
> #### 🚧 The firewall is your responsibility
>
> With Layer 2 and Direct IP, you define and maintain the network controls and firewall rules. We operate the infrastructure; the network security design is up to you.
### VPN
On a network **VPC** you set up encrypted tunnels: **Site-to-Site IPSec**, to connect the cloud with the customer's office, and **remote access**, for users. Each gateway supports up to 10 VPNs.
You negotiate the tunnel with **IKEv1**, **IKEv2** or **Auto** (in Auto, if we initiate the connection it uses IKEv2; if it responds, it adapts to the other end). The **split tunneling** —sending only traffic from certain networks through the tunnel— requires IKEv2 and creates a security association for each remote network.
You have the VPN logs in the panel for troubleshooting. We cover the step-by-step configuration in How-to.
### Load balancer
When a single machine falls short, you distribute traffic among several servers with a **load balancer**, which you set up on a Standard network. In addition to improving performance, it gives you a way to keep the service running while one machine is under maintenance.
### Next steps
* [Set up an IPSec VPN or split tunneling in How-to.](/docs-en/productos/servers/how-to/how-to-configure-a-remote-access-vpn.md)
* [Deploy a VNF (FortiGate VM or FireboxV) in How-to](/docs-en/productos/servers/how-to/how-to-deploy-a-fortigate-vnf.md)
* Review where the network fits in [What is a Server?](/docs-en/productos/servers/concepts/what-it-is.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.plenit.com/docs-en/productos/servers-2/concepts/networks.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.