> ## Documentation Index > Fetch the complete documentation index at: https://datum-4926dda5-docs-compute-and-vpc-guides.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Network addressing and traffic > Learn how Instances on a Galactic VPC network get private IPv6 addresses, which traffic a network carries, and how Instances connect to each other. Every Instance gets a private IPv6 address on the network that its workload attaches to. This page describes the address plan, the traffic that a network carries, and how Instances connect to each other. Galactic VPC is in preview, and the `networking.datumapis.com/v1alpha` API can change. ## How Instances get addresses Datum assigns all addresses. You don't choose address ranges or plan subnets. The following table describes each level of the address plan: | Level | Address space | Details | | -------- | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Network | A `/48` IPv6 prefix | Datum assigns the prefix from the unique local range `fd00::/8` when you create the network. Prefixes don't overlap between networks or projects. The `IPV6PREFIX` column of `datumctl get networks` shows the prefix. | | Location | A `/64` from the network's prefix | Datum assigns one to each location where Instances on the network run. | | Instance | A `/96` block from the location's `/64` | Each Instance's network interface owns the whole block. The block's primary address is the Instance's private IPv6 address. | Inside the Instance, the interface is named `eth0`, and it has IPv6 addresses only. Unique local addresses are private: they aren't routable on the internet. To find your Instances' addresses, run the following command: ```bash theme={null} datumctl compute instances --workload=WORKLOAD_NAME ``` Replace `WORKLOAD_NAME` with the name of your workload. The `INTERNAL IP` column shows each Instance's primary private IPv6 address. For all the addresses on an Instance's interface, run `datumctl compute instances describe INSTANCE_NAME`. ## What traffic a network carries A network carries private traffic between Instances. The following table describes which kinds of traffic are possible: | Traffic | Available | Details | | ------------------------------------------------------------ | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Between Instances on the same network in the same location | Yes | Instances use their private IPv6 addresses. Any Instance can connect to any port on another Instance in the same network and location. | | Between Instances on the same network in different locations | Not guaranteed | A network spans locations, but Datum doesn't guarantee private connectivity between locations. Don't depend on it for production traffic. | | Between different networks | No | Networks are isolated from each other. | | Inbound from the internet | Through Datum's ALB | Instance addresses aren't reachable from the internet directly. Public HTTP and HTTPS traffic reaches Instances through Datum's [Application Load Balancer](/alb/overview). Raw TCP and UDP exposure is a preview limitation. | | Outbound to the internet | Not in the preview | Outbound internet access is on the [roadmap](/galactic-vpc/limitations-and-roadmap#planned-capabilities), starting with IPv6 destinations, and IPv4 destinations are also planned. During the preview, don't depend on calling external APIs or package registries from an Instance. Image pulls aren't affected, because Datum pulls images outside the Instance. | | Lookups by name | Not in the preview | Private DNS names for Instances are on the [roadmap](/galactic-vpc/limitations-and-roadmap#planned-capabilities). Use IPv6 addresses in the preview. | | Firewall filtering | Not in the preview | Firewall rules to filter traffic between Instances on a network are on the [roadmap](/galactic-vpc/limitations-and-roadmap#planned-capabilities). | The workload API accepts a `networkPolicy` field on each network interface, but the field has no effect. Don't rely on it to restrict traffic. To limit who can reach a service, check credentials in your app, or put services that must stay apart on different networks. Firewall rules for networks are on the [roadmap](/galactic-vpc/limitations-and-roadmap#planned-capabilities). ## Connect to other Instances To connect from one Instance to another on the same network, use the peer's private IPv6 address. Keep the following points in mind: * Make your app listen on IPv6 (`::`). An app that listens only on `0.0.0.0` accepts IPv4 connections only, and Instances don't have IPv4 addresses. * In a URL, put an IPv6 address in square brackets, such as `http://[fd20:4a3b:91c2:1::1:0:2]:8080/`. * Private DNS names aren't available in the preview. To tell an app about its peers, pass their addresses in environment variables or a ConfigMap. ## What's next * To create a network and attach a workload to it, see [Create and manage networks](/galactic-vpc/networks). * To serve a workload publicly through Datum's ALB, see [Publish a workload](/compute/publish-workloads). * To review what networks can't do, see [Networking limitations and roadmap](/galactic-vpc/limitations-and-roadmap).