---
title: Use Private Network interfaces
description: Learn how to create, attach, detach, and delete Private Network interfaces, and how to apply security groups to them to filter Private Network traffic.
tags: private-network-interface pnic private-networks security-group instance vpc
dates:
  validation: 2026-10-19
  posted: 2026-10-19
---

import Requirements from '@macros/iam/requirements.mdx'


A [Private Network interface](/instances/concepts/#private-network-interface) is the virtual network interface that connects an Instance to a [Private Network](/instances/concepts/#private-networks). Each Private Network interface has its own private IPv4 and IPv6 addresses, and can have a [security group](/instances/concepts/#security-group) applied to it to filter the traffic it sends and receives.

Private Network interfaces exist independently of Instances. You can create a Private Network interface without attaching it to an Instance, or detach it from one Instance and attach it to another. It keeps its private IP addresses and its security group.

Each Private Network interface belongs to one Private Network, and an Instance can have up to 8 Private Network interfaces, each on a different Private Network.

You can apply one security group to each Private Network interface. Private Network interfaces only accept [stateful security groups](/instances/concepts/#stateful-security-groups).

You do not need to power off your Instance to attach or detach a Private Network interface.

<Requirements />

- A Scaleway account logged in to the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/glossary/#owner) status or [IAM permissions](/iam/concepts/glossary/#permission) allowing you to perform actions in the intended Organization
- A [Private Network](/vpc/how-to/create-private-network/)
- (Optional) An [Instance](/instances/how-to/create-an-instance/)
- (Optional) A stateful [security group](/instances/how-to/use-security-groups/)

## Create a Private Network interface

1. In the **Compute** section of the side menu, click **CPU & GPU Instances**. The [Instances page](https://console.scaleway.com/instance/servers) opens.
2. Click the **Private Network interfaces** tab.
3. Click **Create a Private Network interface**. The creation wizard opens.
4. Choose the **region** in which to create your Private Network interface.
5. Enter a **name** for your Private Network interface, or keep the randomly generated name. Optionally, add tags.
6. Select the **VPC** and the **Private Network** to connect the Private Network interface to. You can only select a Private Network in the region you chose in step 4.
7. Choose whether to auto-allocate an available IP address from the [CIDR block](/vpc/concepts/#cidr-block) of the Private Network, or use a [reserved IP address](/ipam/concepts/#reserved-ip-address). You must make this choice for both the **Private IPv4 address** and the **Private IPv6 address**.
8. (Optional). Check the **Attach to an Instance** box, then select the **Availability Zone** and the **Instance** to attach the Private Network interface to.
9. (Optional). Check the **Apply a security group** box, then select the **Availability Zone** and the **security group** to apply to the Private Network interface.<br/>
   You can also attach an Instance or apply a security group after you create the Private Network interface.
10. Click **Create Private Network interface**.

The **Private Network interfaces** tab opens, and your new Private Network interface appears in the list.

## Attach a Private Network interface to an Instance

When you attach a Private Network interface to an Instance, the Instance connects to the Private Network of the interface, using its private IP addresses. If a security group is applied to the Private Network interface, its rules filter the Private Network traffic of the Instance.

1. In the **Compute** section of the side menu, click **CPU & GPU Instances**. The [Instances page](https://console.scaleway.com/instance/servers) opens.
2. Click the **Private Network interfaces** tab.
3. In the **Attached Instance** column of the Private Network interface you want to attach, click **Attach an Instance**. A dialog box appears.<br/>
   Alternatively, click the name of the Private Network interface, then click **Actions** > **Attach to Instance**.
4. Select the **Availability Zone** of the Instance. Only the Availability Zones within the region of the Private Network interface appear in the list.
5. Select the **Instance** to attach the Private Network interface to.
6. Click **Attach to Instance**.

The Instance connects to the Private Network and remains running during the operation.

## Detach a Private Network interface from an Instance

When you detach a Private Network interface from an Instance, the Instance immediately disconnects from the associated Private Network. The Private Network interface keeps its private IP addresses and its security group, so you can attach it to another Instance later.

1. In the **Compute** section of the side menu, click **CPU & GPU Instances**. The [Instances page](https://console.scaleway.com/instance/servers) opens.
2. Click the **Private Network interfaces** tab.
3. Click <Icon name="more" /> next to the Private Network interface you want to detach, then click **Detach from Instance**. A dialog box appears.<br/>
   Alternatively, click the name of the Private Network interface, then click **Actions** > **Detach from Instance**.
4. (Optional). Check the **Delete Private Network interface** box to delete the Private Network interface after you detach it.
5. Click **Detach**.

The Instance disconnects from the Private Network and remains running during the operation.

<Message type="tip">
  To move a Private Network interface to a new Instance, for example when you replace an Instance, detach it from the current Instance without deleting it, then [attach it to the new Instance](#attach-a-private-network-interface-to-an-instance). The new Instance uses the same private IP addresses and security group rules, without any reconfiguration.
</Message>

## Change the security group of a Private Network interface

1. In the **Compute** section of the side menu, click **CPU & GPU Instances**. The [Instances page](https://console.scaleway.com/instance/servers) opens.
2. Click the **Private Network interfaces** tab.
3. Click <Icon name="more" /> next to the Private Network interface, then click **Change security group**. A dialog box appears.<br/>
   Alternatively, click the name of the Private Network interface, then click **Actions** > **Change security group**.
4. Select the security group to apply to the Private Network interface. The security group currently applied appears with a **Current** badge.
5. Click **Change security group**.

The rules of the new security group apply to the traffic of the Private Network interface.

<Message type="note">
  You can also apply a security group to a Private Network interface from the security group page. See [Attach resources to a security group](/instances/how-to/use-security-groups/#attach-resources-to-a-security-group) for more information.
</Message>

## Delete a Private Network interface

You can only delete a Private Network interface that is not attached to an Instance. [Detach it](#detach-a-private-network-interface-from-an-instance) first if necessary.

1. In the **Compute** section of the side menu, click **CPU & GPU Instances**. The [Instances page](https://console.scaleway.com/instance/servers) opens.
2. Click the **Private Network interfaces** tab.
3. Click the name of the Private Network interface you want to delete. The overview page of the Private Network interface opens.
4. Click the **Settings** tab.
5. Click **Delete Private Network interface**. A dialog box appears.
6. Confirm the deletion.

The Private Network interface is deleted.