# Network interfaces

A network interface holds an instance's private IPv4 and IPv6 addresses in a subnet and carries its security groups. Learn how interfaces are created and removed.

A network interface holds an instance’s private IPv4 and IPv6 addresses in one subnet. It also carries the security groups that filter the instance’s traffic, and it’s what a Floating IP is associated with.

## Interfaces created by a launch [#interfaces-created-by-a-launch]

Launching an instance creates its network interface in the subnet you name, or in the default VPC’s subnet. You choose its security groups at launch with `--security-group-urn`; without it, the interface gets the VPC’s default security group. You can’t change an interface’s security groups afterwards, but you can [change the rules of the groups it carries](/docs/network/traffic-control/security-groups#change-a-security-groups-rules).

When you terminate the instance, its interface is deleted with it. It doesn’t remain as an unattached interface.

## Standalone interfaces [#standalone-interfaces]

You can also create an interface on its own with `create-network-interface`. It takes an address from the subnet like any other interface. There is no operation to attach a standalone interface to an instance, so it stays unattached until you delete it with [`delete-network-interface`](/docs/network/reference/cli#delete-network-interface). Deleting a subnet or VPC also removes standalone interfaces in it.

## Interface status [#interface-status]

An interface’s `status` shows whether it’s in use:

| Status | Meaning |
| --- | --- |
| `AVAILABLE` | Not attached to anything. |
| `ATTACHED` | In use. The `attachedToUrn` field names what it’s attached to. |

`delete-network-interface` is refused while the interface is `ATTACHED`, and while a Floating IP is still associated with it. Disassociate the Floating IP first.

## Related [#related]

- [Security groups](/docs/network/traffic-control/security-groups)
- [Floating IPs](/docs/network/internet-access/floating-ips)
- [VPC and subnet addressing](/docs/network/vpcs/addressing)
- [`create-network-interface` reference](/docs/network/reference/cli#create-network-interface)