To resolve connectivity issues on a Hetzner private network, you must ensure the default gateway remains bound to your public interface (typically eth0) while adding a specific route for the private subnet via the private interface (ens3, enpXsY, or similar). Modern Linux distributions use Netplan or systemd-networkd, making manual edits to /etc/network/interfaces obsolete and potentially dangerous if they overwrite the primary gateway configuration.
Understanding Network Interface Roles
Before applying any configuration changes, it is critical to distinguish between your public and private network interfaces. In Hetzner data centers, the public IP address is always assigned to the primary interface, which serves as the default gateway for all outbound traffic to the internet. This is typically namedeth0 on older systems or follows the predictable naming convention of enpXsY (e.g., enp5s0) on newer kernels using systemd-udev.
The private network interface, often referred to as the "Hetzner Robot" network, connects your server to other servers within the same data center. This interface does not have a default gateway. If you mistakenly set the private interface as the default gateway, your server will lose external internet access because it will attempt to route all traffic through the private VLAN, which has no path to the outside world. Therefore, the core rule is: the default gateway (0.0.0.0/0) must always point to the public interface's gateway IP, while the private subnet should be routed specifically through the private interface.
Verifying Current Network Configuration
Start by identifying your current network state. Run the following command to list all active routes:ip route showdefault via. Note the IP address listed after "via" and the interface name at the end of that line. For example:
default via 213.133.98.1 dev eth0 proto dhcp src 178.XX.XX.XX metric 100eth0 is your public interface and its gateway is 213.133.98.1. Next, identify your private interface by checking its IP address range. Hetzner private networks typically use ranges like 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. You can check this with:
ip addr showens3 and your private subnet is 10.0.0.0/24 with a gateway of 10.0.0.1. Always verify these values from your Hetzner Robot console, as they vary per server.
Configuring Netplan (Ubuntu/Debian)
Most modern Hetzner Ubuntu images use Netplan for network management. The configuration files are located in/etc/netplan/. List the files in this directory to find the active YAML configuration:
ls /etc/netplan/50-cloud-init.yaml or 01-netcfg.yaml) using a text editor. It is crucial to edit this file carefully, as syntax errors can break networking. Do not remove the existing routes section for the default gateway. Instead, add a new entry for the private network.
Your configuration should look something like this, ensuring the default gateway remains on the public interface:
network:
version: 2
ethernets:
eth0: # Public interface
dhcp4: true
nameservers:
addresses: [8.8.8.8, 1.1.1.1]
ens3: # Private interface
dhcp4: false
addresses:
- 10.0.0.2/24
routes:
- to: 10.0.0.0/24
via: 10.0.0.1
scope: link
# Do NOT add a default gateway here
Key points:
1. The eth0 section retains dhcp4: true or static public IP settings.
2. The ens3 section defines the static private IP.
3. A routes block under ens3 specifies how to reach the private subnet.
4. No gateway4 or routes with to: 0.0.0.0/0 should exist under ens3.
Apply the changes with:
sudo netplan apply
If the command fails, revert the file and check for YAML indentation errors.
Configuring systemd-networkd (Fedora/RHEL/CentOS)
For systems using systemd-networkd, configurations are stored in /etc/systemd/network/. You will likely have two files, such as 10-eth0.network and 20-ens3.network.
Ensure the public interface file contains the default gateway:
[Network]
DHCP=yes
[Route]
Gateway=213.133.98.1
The private interface file should only define the address and a static route to the private subnet:
[Network]
Address=10.0.0.2/24
[Route]
Gateway=10.0.0.1
Destination=10.0.0.0/24
Restart the network service to apply changes:
sudo systemctl restart systemd-networkd
Testing Connectivity
After applying the configuration, test your connectivity. First, verify you can still reach the internet:
ping -c 4 google.com
Then, test connectivity to another server in the same private network:
ping -c 4 10.0.0.3
If the first ping fails, you may have accidentally overwritten the default gateway. Check your route table again with ip route show and ensure the default route still points to the public interface. If the second ping fails, verify that the firewall on the target server allows ICMP traffic and that the routing table on your server correctly lists the private subnet via the private interface.
Common Pitfalls
Avoid editing /etc/network/interfaces on Debian-based systems if Netplan is present, as Netplan generates the final configuration and may ignore manual edits. Similarly, do not use route add commands persistently without proper configuration files, as they will disappear on reboot. Always back up your network configuration files before making changes. For more complex setups involving multiple private subnets, consider reviewing related resources on managing network storage. See Unknown Issue in Setting up RAID 12 on Hetzner NVMe Drives for context on hardware-level configurations that might interact with network stability.
Frequently Asked Questions
Why did my internet connection drop after adding the private network?
You likely added a default gateway (0.0.0.0/0) to your private interface configuration. The system prioritizes the lowest metric route, so if both interfaces have a default gateway, the private one may take precedence, blocking external traffic. Remove the default gateway from the private interface config and keep it only on the public interface.
How do I find my Hetzner private network gateway IP?
Log into the Hetzner Robot web interface, select your server, and navigate to the "Network" tab. Under the "Private Network" section, you will see the IP address of the gateway for that specific VLAN. It is usually the first usable IP in the subnet provided.
Can I use DHCP for the private network interface?
Hetzner private networks generally do not support DHCP for client devices. You must assign a static IP address manually within the subnet range provided by Hetzner. Ensure the IP you choose is not already in use by another server in the same data center.
What if I am using Cloud-init and my config gets overwritten?
Netplan configurations generated by cloud-init are often stored in /run/netplan/ or merged with /etc/netplan/. To make persistent changes, edit the files in /etc/netplan/. If cloud-init regenerates the config, ensure your custom entries are preserved or merge them into the cloud-init template if you have access to modify it.
How do I troubleshoot if I can ping the gateway but not other private IPs?
This indicates a routing or firewall issue. Verify your routing table with ip route to ensure the private subnet is associated with the correct private interface. Then, check if the target server’s firewall (like UFW or iptables) is blocking ICMP or the specific port you are trying to reach. Ensure both servers are in the same private network VLAN.