Creating a private subnet

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To configure DNS, use CLI version 1.37.0 or higher.

1. View the description of the command for creating a private subnet:

   yc baremetal private-subnet create --help
   

2. Create a subnet:

   yc baremetal private-subnet create \
     --hardware-pool-id <pool> \
     --name <private_subnet_name> \
     --description "<private_subnet_description>" \
     --labels <key>=<value> \
     --vrf-options-spec '{
       vrf-id=<VRF_ID>,
       cidr=<CIDR>,
       gateway-ip=<gateway_IP_address>,
       dhcp-options={
         start-ip=<IP_address_range_start>,
         end-ip=<IP_address_range_end>,
         dns-options={
           servers=[
             {server={dns-inbound-endpoint-id=<DNS_connection_ID>}}
           ],
           domain-name=example.internal
         }
       }
     }'
   

   Where:

   • --hardware-pool-id: Pool to lease a server from. This is a required setting.

   • --name: Subnet name. The naming requirements are as follows:

     • Length: between 3 and 63 characters.
     • It can only contain lowercase Latin letters, numbers, and hyphens.
     • It must start with a letter and cannot end with a hyphen.

   • --description: Subnet description. This is an optional setting.

   • --labels: Subnet labels. This is an optional setting.

   • --vrf-options-spec: Routing settings for communication with servers from other pools. This is an optional setting. Possible settings:

     • vrf-id: ID of the virtual network segment (VRF).

     • cidr: Subnet CIDR.

     • gateway-ip: Gateway IP address for routing traffic from this subnet to other VRF-connected subnets. This is an optional setting.

       By default, the gateway IP address is the first available address in the specified subnet CIDR range.

     • dhcp-options: DHCP settings. If the section is not provided, DHCP in the subnet is disabled. In start-ip and end-ip, specify the start and end of your IP address range for assigning addresses to server network interfaces.

       By default, the assigned range matches the subnet’s CIDR block.

       Under dns-options, you can customize DNS settings:

       • servers: List of DNS servers. For each server item, specify either dns-inbound-endpoint-id, i.e., the incoming DNS connection ID, or ip-address, i.e., the IPv4 address of a custom DNS server, e.g., {server={ip-address=192.168.10.2}}. You can specify up to three items, comma-separated. For an inbound DNS connection, configure network connectivity first. You can get the connection ID by running this command: yc dns inbound-endpoint list.
       • domain-name: Search domain. This is an optional parameter. Replace example.internal with a custom domain, or delete the parameter if you do not need a search domain.

       If you do not need DNS settings, delete the dns-options section.

To create a private subnet, use the create REST API method for the PrivateSubnet resource or the PrivateSubnetService/Create gRPC API call.

curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <IAM_token>" \
  -d '{
    "folderId": "b1g07hj5r6i4********",
    "hardwarePoolId": "ru-central1-m3",
    "name": "demo-private-subnet",
    "description": "My first private subnet",
    "labels": {
      "env": "test"
    },
    "vrfOptionsSpec": {
      "vrfId": "ly5uyq2gbxu2********",
      "cidr": "10.0.*.*/8",
      "dhcpOptions": {
        "startIp": "10.0.*.*",
        "endIp": "10.0.*.*"
      },
      "gatewayIp": "10.0.*.*"
    }
  }' \
  "https://baremetal.api.cloud.yandex.net/baremetal/v1alpha/privateSubnets"

Where:

• <IAM_token>: IAM token used for authentication.

• folderId: Folder ID.

• hardwarePoolId: ID of the pool to lease a server from.

• name: Subnet name. The naming requirements are as follows:

  • Length: between 3 and 63 characters.
  • It can only contain lowercase Latin letters, numbers, and hyphens.
  • It must start with a letter and cannot end with a hyphen.

• description: Subnet description. This is an optional parameter.

• labels: Subnet labels. This is an optional parameter.

• vrfId: ID of the virtual network segment (VRF).

• cidr: Subnet CIDR.

• gatewayIp: Gateway IP address. This is an optional parameter.

• startIp, endIp: Address range for DHCP. This is an optional parameter.

Result:

{
  "done": true,
  "metadata": {
    "@type": "type.googleapis.com/yandex.cloud.baremetal.v1alpha.CreatePrivateSubnetMetadata",
    "privateSubnetId": "ly52xefxa2hi********"
  },
  "response": {
    "@type": "type.googleapis.com/yandex.cloud.baremetal.v1alpha.PrivateSubnet",
    "vrfOptions": {
      "dhcpOptions":
      {
        "startIp": "10.0.*.*",
        "endIp": "10.0.*.*"
      },
      "vrfId": "ly5licxve4z3********",
      "cidr": "10.0.*.*/8",
      "gatewayIp": "10.0.*.*"
    },
    "labels": {
      "env": "test"
    },
    "id": "ly52xefxa2hi********",
    "cloudId": "b1gia87mbaom********",
    "folderId": "b1g07hj5r6i4********",
    "name": "demo-private-subnet",
    "description": "My first private subnet",
    "status": "READY",
    "zoneId": "ru-central1-m",
    "hardwarePoolId": "ru-central1-m3",
    "createdAt": "2025-12-14T14:42:58.372557Z"
  },
  "id": "ly5hcnsbx3l4********",
  "description": "Private subnet create",
  "createdAt": "2025-12-14T14:42:58.375290Z",
  "createdBy": "ajeb9l33h6mu********",
  "modifiedAt": "2025-12-14T14:42:58.375290Z"
}

Follow the status of the operation by the done field.