Solutions Network Hub and Firewall
One hub for every VPC, with one firewall that decides what crosses it
A Network Hub joins your projects, your customers’ projects and other regions without peering them two by two. Put a firewall in the hub and every connection between them, and out to the internet, passes rules you control in one place.
Network Hub: many VPCs, any region
- Mesh: every VPC reaches every other. Star: shared services in the center, teams or customers at the edges who can’t reach each other.
- Attach VPCs of your own account in one click, or of another account once its owner accepts.
- Up to 50 VPCs per hub, in every region; the routing table shows each spoke’s routes right now.
- $5.00 a month for each attached VPC, billed to that VPC’s own project; traffic is billed like VPC peering.
A firewall in the hub
- Choose what passes it: traffic between spokes, traffic to the internet, or both.
- Ordered allow and deny rules by source, destination, protocol and port, and DNAT to publish a private server on the firewall’s public IPs.
- Policies kept apart from the firewall, a parent policy for a central team’s baseline, and IP Groups for office and partner ranges.
- Every project goes out to the internet from the same fixed IPs, ready for partners to allowlist.
- Hit counts on every rule show which rules are in use.
Sized to your traffic
- Basic for small systems, Standard with a choice of sizes and up to 4 instances per region that all carry traffic.
- More than one instance per region gives high availability; sizes change with no downtime, one instance at a time.
- Billed per instance-hour by size plus the firewall software ($0.05 Basic, $0.15 Standard per instance-hour), plus data processed, at the rates on the pricing page.
Frequently asked questions
How is a Network Hub different from VPC peering?
Peering joins two VPCs in the same region and isn’t transitive. A hub joins up to 50 VPCs, across regions and accounts, with Mesh or Star roles, and can carry VPN gateways and a firewall.
Do I still need security groups?
Yes. The hub and the firewall decide which networks may talk; each service’s security group still decides which of its ports are open.
Can the firewall replace my NAT Gateway?
Yes. With traffic to the internet, the hub owner’s VPCs go out through the firewall. You can keep the NAT Gateway’s static IP so partners’ allowlists keep working.
Can I connect my customers’ projects without them seeing each other?
Yes. Make your shared services the center of a Star hub and attach each customer as an edge. Edges reach the center but never each other, unless the firewall allows it.
Get started today, free
Sign up with email, no credit card needed. Websites are free with no expiry; other services are paid as used from the project’s wallet.