Networking
Private networks, load balancers and DNS, one rule model.
Private networks with subnets and routes, firewalls written once and translated to whatever each provider calls them, load balancers that health-check their backends, and DNS with health-checked failover and GeoDNS — all addressed through endpoints that name no upstream.
The advantages
The outcomes this product is built around.
Write the rule once
One firewall rule model — direction, protocol, port range, CIDR — means the same thing everywhere and is translated to whatever each provider calls it.
Refused, not silently ignored
Incoherent configuration is rejected at validation — a certificate on a plain TCP listener is an error you fix now, not a surprise you find in production.
Peering without dangling resources
Networks peer across providers as a link on each side, so there is no orphan third resource to forget when you tear down.
DNS that fails over
Health-checked failover and location-based routing are routing policies on the record itself, on the DNS provider you choose.
- firewall rule model, whichever provider runs the network
- 1
- load balancing, with health checks and TLS termination
- L4 + L7
- on balancers and addresses, or both at once
- IPv4 + IPv6
See it in the console
Real screens from the product, not mock-ups.
Private networks
Each network with the address range you chose for it.
Load balancers at layer 4 and 7
An HTTP balancer on IPv4 and IPv6 beside a TCP balancer for device traffic, each on its own address.
DNS on the provider you choose
A zone for your domain, on the DNS provider you picked for it.
How it fits together
What happens between your request and a running resource.
A name in your DNS zone resolves to a load balancer, which spreads traffic across healthy servers on a private network. Firewall rules written once apply to that network whichever capacity it runs on.
- Your users: by name (The internet)
- DNS zone: health-checked records (The platform)
- Load balancer: L4 or L7, TLS (The platform)
- Firewall rules: one model (The platform)
- Servers: private network (Your network)
- Your users to DNS zone: resolve
- Your users to Load balancer: connect
- Load balancer to Servers: healthy only
- Firewall rules to Servers: allowed
Who it is for
The teams and situations this product was built for.
Multi-tier applications
Web, application and data tiers need isolation without provider lock-in.
Private networks with subnets, routes and firewalls checked before anything is created.
Public services
Traffic spread across backends that might fail.
Layer-4 and layer-7 load balancers that health-check every backend they send traffic to.
Global products
Users routed to a healthy, nearby endpoint.
DNS records with health-checked failover and GeoDNS policies the validator keeps coherent.
What it does
The core capabilities, live in the product today.
Private networks and peering
A network carries its subnets, routes and firewall rules inline, CIDR-checked before any provider call, and peers across networks and providers as a link on each side rather than a dangling third resource.
Subnets, routes and rules live on the network resource itself, validated before anything is created. Peering is a link on each side of the connection, so tearing a network down leaves nothing orphaned behind it.
One firewall rule model
Write one rule — direction, protocol, port range, CIDR — that means the same everywhere and denies what it does not name, backing both the network edge and the reusable security group.
The rule you write means the same thing on every provider and is translated to whatever each one calls its firewall. What the rule does not name is denied, and the same model backs both the network edge and reusable security groups.
Load balancers
L4 and L7 on one resource with a layer field, each listener carrying its backends and a health check, SSL terminated only where it can be — a certificate on a plain TCP listener is refused rather than silently ignored.
Every listener carries its backends and a health check, so traffic goes to instances that answer. Configuration that cannot work — the certificate on the plain TCP listener — is refused at validation, where it is cheap to fix.
DNS with failover and GeoDNS
Zones carrying their records inline, each with a routing policy the validator keeps coherent, on the DNS provider you choose rather than a hidden placement.
Health-checked failover and location-based routing are policies on the record itself, kept coherent by the validator. The zone runs on the DNS provider you choose — there is no hidden placement to discover later.
The ideas behind it
The words this page uses, explained once.
- Private network
- An address range you choose, with subnets and routes, that your servers talk across without touching the internet.
- One rule model
- Firewall rules and security groups are written in one vocabulary and translated for whichever capacity runs the network, so a rule means the same thing everywhere.
- Health-checked DNS
- A record can fail over to a standby when a health check fails, or answer by the visitor’s location, so the name keeps working when a site does not.
In depth
The detail an evaluation asks for.
Connecting places
Networks peer across providers, and site-to-site or client VPN over WireGuard or IPsec brings your office or data centre in, with private interconnect to our modular data centres.
At the edge
Certificates are issued and renewed automatically, a CDN caches in front of your origin, and a managed ingress routes HTTP without you running a proxy.
Refused, not ignored
Configuration that cannot work — a certificate on a plain TCP listener — is rejected when you submit it, so mistakes surface now rather than in production.
How it works
- Console
Draw your networks
Private networks with subnets, routes and firewall rules, checked before anything is created.
- API
Write the rules once
One rule model — direction, protocol, port range, CIDR — translated to whatever each provider calls it.
- Console
Balance the load
Layer-4 and layer-7 load balancers with health-checked backends, on one resource.
- Console
Run your DNS
Zones with health-checked failover and location-based routing, on the DNS provider you choose.
In code
The same task in the CLI and both SDKs. Every call shown exists in the API.
prx CLI
Create a network and an HTTP load balancer
prx cloud network create --body '{"name":"prod-net","cidr":"10.20.0.0/16","region":"eu-central"}'prx cloud load-balancer create --body '{"name":"tracking-api","layer":"l7","region":"eu-central","ip_version":"dual"}'TypeScript SDK
Create a network and an HTTP load balancer
await client.cloud.network.create({ name: 'prod-net', cidr: '10.20.0.0/16', region: 'eu-central' });await client.cloud.loadBalancer.create({ name: 'tracking-api', layer: 'l7', region: 'eu-central', ip_version: 'dual' });Python SDK
Create a network and an HTTP load balancer
client.cloud.network.create({"name": "prod-net", "cidr": "10.20.0.0/16", "region": "eu-central"})client.cloud.load_balancer.create({"name": "tracking-api", "layer": "l7", "region": "eu-central", "ip_version": "dual"})The difference
The way this job usually goes, and the way it goes here.
The usual way
With ProjectX
The same firewall rule written four ways for four providers.
One rule model — direction, protocol, port range, CIDR — translated per provider.
A certificate on a TCP listener passes review and fails at 2 a.m.
Incoherent configuration is refused at validation, where it is cheap to fix.
A peering connection as a third resource everyone forgets to delete.
Peering as a link on each network — tear the network down and nothing dangles.
Works with your tools
Every surface below drives the same product — script it, click it, or hand it to your existing tooling.
- Console
- API
- TypeScript SDK
- prx CLI
Questions, answered
Can I keep servers off the public internet?
Yes — private networks carry their own subnets, routes and firewall rules, and a rule denies everything it does not name.
Do firewall rules work the same on every provider?
You write one rule model — direction, protocol, port range, CIDR — and the platform translates it to whatever the underlying provider calls it.
What load balancing is included?
Layer-4 and layer-7 on one resource. Every listener carries its backends and a health check, and configuration that cannot work is refused at validation.
How is it billed?
Networks and DNS follow the published per-resource rates on the pricing page, on the same monthly invoice as your servers.
Products it works with
Same platform, same console, same invoice.
Start with ProjectX today.
Create a company in minutes and add this product to your invoice at the published rate.