Create a BinaryLane server in an existing VPC with a separate private network interface in one creation request. If your workload needs outgoing SSH, SMTP or Remote Desktop connections, you can also disable port blocking at creation.

Prefer the control panel? Follow Set up private networking between your BinaryLane servers.

Dedicated Interface, also called Split NICs, provides separate public and private network interfaces. This request configures those BinaryLane options; you still need to check the network configuration inside the operating system. Keep the public connection for access while you configure the private interface.

TABLE OF CONTENTS

Before you begin

You need an existing VPC, a BinaryLane API token and either the configured bl CLI or curl. The examples use Bash, including Bash in WSL on Windows, not PowerShell syntax. For the curl examples, use curl 7.76.0 or later for --fail-with-body.

Follow the CLI installation and configuration instructions. Check bl server create --help for the options below; update the CLI if your installed version does not provide them.

Using multiple accounts? See Manage multiple BinaryLane accounts with the CLI for choosing the intended account with --context NAME.

Keep API tokens secure
Access tokens are like passwords and should be kept secure. API access allows programmatic control of your account, including destructive actions such as deleting servers and data. Actions performed via the API are immediate and may not be reversible.

Treat the token as full account access, not a read-only or VPC-scoped credential. See BinaryLane API token permissions. Keep tokens out of scripts, screenshots and version control. mPanel shows the full token only once.

The examples use an account-default SSH key. Confirm your default key is set and you have its private key before creating the server. When ssh_keys is omitted, default keys are deployed where supported by the image. Other access methods can be configured separately.

Applies to

  • BinaryLane API
  • binarylane-cli 0.21.0
  • Creating a new server in a VPC with Split NICs; the examples use Ubuntu and public IPv4 access

Choose your resources

Identify the VPC ID, region, image and size before issuing the creation request. With the CLI, check the account and available resources:

bl account get --output json
bl vpc list --output json
bl region list --output json
bl image list --output json
bl size list --output json

Confirm the account, VPC name and address range. Choose available region, image and size values, and review the size's price and included options. The example values bne, ubuntu-26.04 and std-min must be checked against the available choices in your account.

Using only curl? Set the token without placing its literal value in shell history:

read -r -s -p 'BinaryLane API token: ' APITOKEN
printf '\n'
export APITOKEN
curl --silent --show-error --fail-with-body \
  -H "Authorization: Bearer ${APITOKEN}" \
  -H "Accept: application/json" \
  https://api.binarylane.com.au/v2/vpcs

Use the same GET request with /v2/account, /v2/regions, /v2/images and /v2/sizes to check the account and available resources. Follow pagination links where present. The APITOKEN environment variable is for these curl examples; it does not configure CLI authentication.

Choose port blocking

Port blocking is enabled by default for new servers and blocks outgoing TCP connections to ports 22 (SSH), 25 (SMTP) and 3389 (Remote Desktop). It applies to both IPv4 and IPv6.

Leave it enabled unless your server needs those outgoing connections. Disabling it requires a verified account. To disable it at creation, add --no-port-blocking to the CLI command or set "port_blocking": false in the API body.

This is separate from mPanel firewall rules and the operating system's firewall. Disabling port blocking does not disable those firewalls or open an inbound service. The mPanel firewall does not support IPv6; that limitation does not mean IPv6 is exempt from port blocking.

Create with the CLI

Use bl server create with the VPC and separate-interface options. Replace the example VPC ID and review every value before running it.

Check before creating a server
The next command creates a chargeable server. Choose either the CLI or API creation method, not both. Check the account, plan, region, access method and backup options first. The example explicitly selects no daily, weekly or monthly backups; choose the protection your workload needs.
vpc_id=123456
bl server create \
  --name vpc-web-01.example.com \
  --size std-min \
  --image ubuntu-26.04 \
  --region bne \
  --vpc "$vpc_id" \
  --separate-private-network-interface \
  --daily-backups 0 --weekly-backups 0 --monthly-backups 0 \
  --output json

For a verified account that needs port blocking disabled, add --no-port-blocking before running this command. Do not run it a second time just to change that setting: another create command creates another server.

The CLI waits for the creation action by default. Keep the resulting server ID. If it fails or the connection is interrupted, check mPanel or bl server list --output json before retrying. A lost response does not prove creation failed.

Create with the API instead

Send one POST /v2/servers request. This is an alternative to the CLI command, not the next step after it.

Create a local create-server.json file containing the following JSON, replacing 123456 with your VPC ID and reviewing the resource choices:

{
  "name": "vpc-web-01.example.com",
  "size": "std-min",
  "image": "ubuntu-26.04",
  "region": "bne",
  "vpc_id": 123456,
  "separate_private_network_interface": true,
  "port_blocking": true,
  "options": {
    "daily_backups": 0,
    "weekly_backups": 0,
    "monthly_backups": 0
  }
}

Set port_blocking to false only if you chose to disable it. Omitting vpc_ipv4_address lets BinaryLane assign an unused private address. These fields correspond to the CLI options above.

Create only once
This request creates a chargeable server with the settings in the file. Do not submit it if you already created the server using the CLI.
curl --silent --show-error --fail-with-body \
  -X POST \
  -H "Authorization: Bearer ${APITOKEN}" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  --data-binary @create-server.json \
  https://api.binarylane.com.au/v2/servers

Wait and verify

Wait for successful creation before treating the guest as ready. The API response contains server.id and action references under links.actions. Keep the creation action's id; an accepted request is not completed provisioning.

With curl, replace the example IDs with those returned and inspect the action:

action_id=789012
server_id=123457
curl --silent --show-error --fail-with-body \
  -H "Authorization: Bearer ${APITOKEN}" \
  -H "Accept: application/json" \
  "https://api.binarylane.com.au/v2/actions/${action_id}"

Recheck periodically while action.status is in-progress. Continue only when it is completed. If it is errored, inspect the reason rather than blindly resubmitting. For actions that require input, follow Poll a long-running action and respond when input is required.

After the CLI finishes, or the API action completes, retrieve the server using your chosen method:

Set server_id to the ID of the server you just created, replacing 123457:

server_id=123457
bl server get "$server_id" --output json

Or with curl:

curl --silent --show-error --fail-with-body \
  -H "Authorization: Bearer ${APITOKEN}" \
  -H "Accept: application/json" \
  "https://api.binarylane.com.au/v2/servers/${server_id}"

Check the server's name, region, size and VPC membership. Under networks, confirm separate_private_network_interface is true, port_blocking matches your choice, and v4 contains the expected public and private network entries. The API wraps these fields inside server. Check the assigned private address rather than assuming the address used in an example.

Finish inside the server

Connect over the public IP and check the private interface. On the Ubuntu 26.04 installations tested for this guide, the private interface existed but needed guest configuration. Follow the private-interface configuration and connection checks before using it for application traffic. That section starts inside the guest; you do not need to repeat the mPanel provisioning steps.

Use the assigned private address and an MTU of 1450 on the VPC interface. The separate public interface can remain at 1500. Preserve the public default route and DNS configuration, and have console access available before changing guest networking. Test private connectivity to another server in the VPC as well as public access.

If you disabled port blocking to make outgoing SSH connections, test against a host you control that accepts SSH. Replace the example destination:

ssh -v -o ConnectTimeout=5 -o ConnectionAttempts=1 user@ssh-target.example.com

A connection and remote SSH banner establish that the SSH service is reachable. You can stop with Ctrl+C at the host-key confirmation without accepting the key or logging in. A timeout alone does not identify port blocking: routing, destination availability and firewalls can also prevent a connection.

Moving an existing server

Use the existing-server workflow. Creation fields are not a shortcut for changing an existing server: change_network and change_separate_private_network_interface are separate API actions. Allow for the shutdown/start behaviour of each change and finish one action before starting the next.