# Create Isolated Public Facing Services in Incus + Netbird + PhoenixNAP **URL:** \ **Category:** General\ **Tags:** incus, phoenixnap, netbird\ **Created:** [April 8, 2025, 10:03pm UTC](https://team.chuck-stack.org/t/create-isolated-public-facing-services-in-incus-netbird-phoenixnap/83 "2025-04-08T22:03:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![chuck.boecking](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@chuck.boecking](https://team.chuck-stack.org/u/chuck.boecking)\ **Post date:** [April 8, 2025, 10:03pm UTC](https://team.chuck-stack.org/t/create-isolated-public-facing-services-in-incus-netbird-phoenixnap/83/1 "2025-04-08T22:03:31Z")
The purpose of this post is to support discussion for the ‘Create Isolated Public Facing Services in Incus + Netbird + PhoenixNAP’ blog post. > **[Create Isolated Public Facing Services](https://www.chuck-stack.org/ls/blog-incus-netbird-phoenixnap-isolated.html)** Let me know if you have comments, questions or concerns. For chuck-stack priority support and training [Join Now](https://buy.stripe.com/fZebLI7Qw2kPfnifYZ). To learn more about the stack-academy, view the [stack-academy](https://www.chuck-stack.org/ls/stack-academy.html) page. ---
**Author:** ![matt41](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@matt41](https://team.chuck-stack.org/u/matt41)\ **Post date:** [July 24, 2025, 6:59pm UTC](https://team.chuck-stack.org/t/create-isolated-public-facing-services-in-incus-netbird-phoenixnap/83/3 "2025-07-24T18:59:00Z")
so Chuck, why doesn’t Incus come as default with a ‘no traffic’ policy? While your prescription of blocking RFC1918 address space sorta addresses the issue, wouldn’t we want to start with a deny all by default policy and then only allow what we strictly need? ---
**Author:** ![chuck.boecking](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@chuck.boecking](https://team.chuck-stack.org/u/chuck.boecking)\ **Post date:** [July 24, 2025, 7:52pm UTC](https://team.chuck-stack.org/t/create-isolated-public-facing-services-in-incus-netbird-phoenixnap/83/4 "2025-07-24T19:52:37Z")
That is a great question! I am not close enough to the project to speak on their behalf. Here are my thoughts: - There is some inherent convenience with the current all access default - It could be that most organizations erect instances in a semi-protected environment (instead of the open web like I did) In my experience, the [incus discussion forum](https://discuss.linuxcontainers.org/) is welcoming of such questions. I hope this helps! Chuck ---
**Author:** ![matt41](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@matt41](https://team.chuck-stack.org/u/matt41)\ **Post date:** [July 25, 2025, 6:08pm UTC](https://team.chuck-stack.org/t/create-isolated-public-facing-services-in-incus-netbird-phoenixnap/83/5 "2025-07-25T18:08:32Z")
@bmullan and I were having a side-bar on how to use Incus in a true (legally distinct entity sharing same hardware) sense and I posit that it’s really not set up for that. When I offer `multitenant` to clients I intend to dedicate the hardware and switch ports (and VLans) to each legal entitity so I don’t have to worry about Incus limitations. Though if I really wanted to ‘risk’ it I guess what I would do is slave the INcus bridges to specific VLAN interfaces since as a MSP I control the vlan assignment. Would just need to hamstring the client from being able to make network-layer changes. I’ll check out the user forum. ---
**Author:** ![chuck.boecking](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@chuck.boecking](https://team.chuck-stack.org/u/chuck.boecking)\ **Post date:** [July 25, 2025, 9:02pm UTC](https://team.chuck-stack.org/t/create-isolated-public-facing-services-in-incus-netbird-phoenixnap/83/6 "2025-07-25T21:02:56Z")
What about the incus =\> project architecture prevents it from being ‘legally’ isolated? ---
**Author:** ![matt41](https://avatars.discourse-cdn.com/v4/letter/m/e5b9ba/32.png) [@matt41](https://team.chuck-stack.org/u/matt41)\ **Post date:** [July 25, 2025, 9:16pm UTC](https://team.chuck-stack.org/t/create-isolated-public-facing-services-in-incus-netbird-phoenixnap/83/7 "2025-07-25T21:16:32Z")
separation has to be provable. If you’re trying to do that via subnets, what do you do when N clients want to use the same IP ranges? I haven’t dug into how fine-grained Incus permission sets are. In VMware this is trivial to do. But most Linux tools assume everyone plays nice or has full control. ---
**Author:** ![chuck.boecking](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@chuck.boecking](https://team.chuck-stack.org/u/chuck.boecking)\ **Post date:** [July 26, 2025, 3:50pm UTC](https://team.chuck-stack.org/t/create-isolated-public-facing-services-in-incus-netbird-phoenixnap/83/10 "2025-07-26T15:50:07Z")
Guys, For about a year, I rented an incus ‘project’ space from Stéphane on the same cluster that he uses to host the incus images. The situation worked quite well. Here are the notable details: - I added the remote server to my local cli client - I interacted with the instance just like any other incus server - He had keycloak configured to authenticate me (which was a nice touch) - The only restriction he placed on me (other than the hard limits like memory, cpu and storage) was that I could only create VMs (not containers). He did this because he needed the ability to move my project from node to node on the cluster without my downtime. This was because he has a practice of applying patches and restarting every node every week. Does this help? Regards, ---
**Author:** ![chuck.boecking](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@chuck.boecking](https://team.chuck-stack.org/u/chuck.boecking)\ **Post date:** [July 27, 2025, 6:17pm UTC](https://team.chuck-stack.org/t/create-isolated-public-facing-services-in-incus-netbird-phoenixnap/83/12 "2025-07-27T18:17:21Z")
I cannot speak to your details. What I can speak to is how I work with Stéphane. I have a couple of customers that use Incus. They do nothing heavy with it, and all networks are private. I prepay for his support hours, and I ask questions publicly when possible (for the benefit of everyone in the community). His support has been nothing short of amazing. He did not ask for this arrangement. I volunteered because this is how I believe we can best support an open source project like incus. It ensures the right people are properly incentivized. If you are considering building a business around incus, I feel like a couple of hours of paid support will be beneficial. In my experience he is happy to jump on a video call and discuss all matters related to incus (small and large). I hope this helps! Chuck