> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-cli/commands/cloud/hetzner/create-network.md).

# create-network

Create a Rumi private network and the per-role cloud firewalls that secure the fleet.

## Syntax

```bash
rumi cloud hetzner create-network \
  --api-key <token> \
  --network <network> \
  [options]
```

## Options

| Option      | Short | Description                                                 | Default  |
| ----------- | ----- | ----------------------------------------------------------- | -------- |
| `--api-key` | `-k`  | The Hetzner Cloud project API token (or set `HCLOUD_TOKEN`) | Required |
| `--region`  | `-r`  | The Hetzner location to create the network in               | `fsn1`   |
| `--network` | `-n`  | The name to give the new network                            | Required |

## Example

```bash
rumi cloud hetzner create-network \
  --api-key $HCLOUD_TOKEN \
  --network my-cloud
```

## Notes

* Creates a private network `10.0.0.0/16` (subnet `10.0.0.0/24`, network zone derived from the location — `eu-central` for `fsn1`).
* Creates seven per-role cloud firewalls. The **bastion** firewall opens `22`/`80`/`443` to the world; every other role opens only its own ports to the network CIDR. All roles allow in-network ICMP.
* Firewalls **auto-apply by label selector** (`rumi-network=<name>,rumi-role=<role>`), so a node launched with the right labels is firewalled without any explicit attach step.
* Fails if a network of this name already exists; tear it down first with [deprovision](/rumi-cli/commands/cloud/hetzner/deprovision.md).

## See Also

* [launch-bastion](/rumi-cli/commands/cloud/hetzner/launch-bastion.md)
* [launch-platform](/rumi-cli/commands/cloud/hetzner/launch-platform.md)
* [deprovision](/rumi-cli/commands/cloud/hetzner/deprovision.md)