# What is Origin Cloud Network?

Network gives your instances private VPCs, subnets and network interfaces, controlled internet access, traffic filtering and DNS. Learn how the parts fit.

Network is where your instances live. A VPC is an isolated network with its own private address space, subnets divide that space, and every instance connects to a subnet through a network interface. A VPC you create is private: nothing in it is reachable from the internet until you attach an Internet Gateway and give instances a way out. Your project's [default VPC](/docs/network/vpcs/default-vpc) is different: it comes with an Internet Gateway, and an instance launched into it gets a public address automatically. Security groups and network ACLs decide which traffic is allowed, and a DNS policy decides how the VPC resolves names it doesn't know.

An instance's network interface holds its private IPv4 and IPv6 addresses in one subnet. A Floating IP gives one interface a public IPv4 address. A NAT gateway gives a whole subnet outbound-only internet access through one shared address.

## Features [#features]

- **VPCs and subnets**: Isolated networks with a private IPv4 range you choose or the platform picks, an IPv6 range assigned for you, and subnets carved from both. Every project also gets a default VPC the first time it needs one. See [VPCs and subnets](/docs/network/vpcs).
- **Internet access**: Internet Gateways, route tables, NAT gateways and Floating IPs decide whether and how traffic reaches the internet. See [Internet access](/docs/network/internet-access).
- **Traffic control**: Stateful security groups on each network interface and stateless network ACLs on each subnet. See [Traffic control](/docs/network/traffic-control).
- **DNS**: Every instance gets an internal hostname that other instances in its VPC can resolve. DNS policies decide where other queries are relayed. See [DNS](/docs/network/dns).

## Ways to access Network [#ways-to-access-network]

- **CLI**: The `origin network` command group. See [CLI access](/docs/platform/access/cli) to install and sign in, and [origin network commands](/docs/network/reference/cli) for every command.
- **GraphQL API**: VPCs, subnets, network interfaces, gateways, route tables, Floating IPs, ACLs, security groups and DNS policies live under the `network` namespace of the API, for both queries and mutations. See [API access](/docs/platform/access/api) and the [Network reference](/docs/network/reference).

## When to use Network [#when-to-use-network]

Every instance needs a subnet, so you use Network whenever you run Compute. Create your own VPCs when you want to choose the address range, keep workloads apart, or decide yourself which subnets reach the internet. If you launch without naming a subnet, the platform uses your project's [default VPC](/docs/network/vpcs/default-vpc).

Network doesn't connect two VPCs to each other, and it doesn't give instances IPv6 internet access. Traffic between the internet and your instances is IPv4 only, through a Floating IP or a NAT gateway.

## Related services [#related-services]

- [Compute](/docs/compute): instances that connect to subnets through network interfaces
- [Platform](/docs/platform): organizations, projects, billing and access

## Pricing [#pricing]

VPCs, subnets, route tables, ACLs, security groups and DNS policies cost nothing by themselves. Floating IPs and NAT gateways are billed while you hold them, and traffic from your VPC to the internet is billed. Allocating a Floating IP and creating a NAT gateway require a payment method; see [Add a payment method](/docs/platform/billing/payment-method). For prices, see [Pricing](/docs/pricing).

## Next steps [#next-steps]

- [Get started with Origin Cloud](/docs/platform/getting-started)
- [Create a VPC and subnets](/docs/network/vpcs/create)
- [Give a private subnet internet access with a NAT gateway](/docs/network/internet-access/nat-gateways)
- [Troubleshoot Network](/docs/network/troubleshooting)