Use public bandwidth for traffic that must reach the internet, such as customer requests, downloads, and video delivery. Use private bandwidth for traffic between systems on a private network, such as database replication, backups, and cluster updates. A customer-facing cluster often needs both.
Size each connection for the traffic it carries. A server can have enough public bandwidth to serve customers and still miss its backup window because the private link is too slow. The two paths can also have different fees, even when they carry traffic for the same application.
What is the difference between public and private bandwidth?
Public bandwidth is the data rate available on an internet-facing connection. Private bandwidth is the data rate available on a private network path between systems that have access to that network. Providers may list different rates for the two paths on the same server.
| What to compare | Public bandwidth | Private bandwidth |
|---|---|---|
| Where traffic goes | Between your infrastructure and internet destinations | Between permitted endpoints on the private network |
| Common uses | Websites, public APIs, downloads, and video delivery | Database queries, replication, backups, and cluster traffic |
| What determines access | Internet routing, IP configuration, and firewall rules | Private routes, network membership, and access rules |
| What limits throughput | Port speed, provider limits, and available upstream capacity | Private port or service limit, shared links, and capacity between endpoints |
| How it may be billed | Flat monthly fee, transfer allowance, or usage-based pricing | Included transfer, network or port fees, or charges for specific paths |
Bandwidth measures rate. Data transfer measures volume. A 1Gbps link has a rated speed of one gigabit per second. A 100 TB allowance sets how much data the plan includes in a billing period. Check which path the allowance applies to.
Public network vs private network
A public network path can carry traffic to or from the internet. A public IP gives a service an address that can be routed on the internet. A service still needs the correct route, a listener, and permission from the firewall to accept traffic.
A private network connects a defined set of systems. Private IPv4 ranges include 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These addresses can be routed within your organization or between connected private networks. A server that uses a private address can also reach internet services through an approved gateway or proxy.
Network engineers often call traffic entering or leaving a deployment north-south traffic. They call traffic between systems within the deployment east-west traffic. These terms describe the direction of a flow. Check its actual route to determine which connection and billing rules apply.
Does private bandwidth require a separate port?
It depends on the provider and configuration. Some servers have a separate physical interface for the private network. Others use a virtual local area network, or VLAN, to carry private traffic over a physical link that also carries other traffic. Two logical interfaces can share one physical speed limit. Ask how your provider delivers each connection and where the paths share capacity.
Which connection should each workload use?
Consider a web server, a primary database, a database replica, and a backup server. The web server accepts public HTTPS requests. It connects to the database over the private network. The database pair and backup server also use the private network in this example.
| Traffic flow | Connection to use | What to check |
|---|---|---|
| Customer → website or public API | Public HTTPS, directly or through a public load balancer | Size for peak demand. Expose only the required public services. |
| Public CDN → origin server | Public if the CDN fetches from a public origin | Use a private path if the CDN supports one and you have configured it. |
| Web server → database | Private | Use the database’s private address and allow only the required application hosts and ports. |
| Primary database → replica | Private where both servers share a supported path | Check replication lag, catch-up traffic, and any charge for crossing sites. |
| Database → backup server | Private when the target is reachable on that network | Check the backup window and restore speed. Confirm the path for any off-site copy. |
| Cluster node → cluster node | Private for heartbeats and internal service traffic | Check latency and packet loss during heavy transfers. |
| Administrator → database server | Approved VPN or bastion, then private | Limit access to authorized admins and the ports they need. |
| Private server → public software repository | Approved outbound gateway or proxy | Check the route, access policy, and any gateway fees. |
Check the address the application resolves and the route the operating system selects. Two servers can share a private network while an application still connects to a public endpoint. That choice can change latency, exposure, and billing.
How much public and private bandwidth do you need?
Size the public connection from busy-hour traffic. Include normal peaks and events such as a product launch or a live stream. Size the private connection from the amount of data you must move and the time available to move it. Include jobs that run at the same time.
Worked example: Move 2.4 TB in four hours
Suppose the primary database sends a 2.4 TB backup to the backup server every night. The job has four hours to finish. Using decimal units, calculate the required average payload throughput:
Required Gbps = data in TB × 8,000 ÷ time in seconds
Required Gbps = 2.4 × 8,000 ÷ 14,400 ≈ 1.33 Gbps
A 1Gbps private link cannot meet the four-hour window, even before protocol overhead. A faster link can help if the source disk, destination disk, CPU, and backup software can keep up. Test a restore too. A four-hour backup window may still be too slow for your recovery target.
Now assume the database backup and 600 Mbps of public delivery pass through the same capacity-limited link in the same direction. The combined target is about 1.93 Gbps before overhead. If the paths have separate capacity end to end, size them separately. Recheck the limits during failover, when a surviving link or server may carry more traffic than usual.
Is a private network more secure?
A private network can reduce exposure by limiting which systems can reach a service. Access still depends on routing, firewall rules, and identity. A compromised machine on the private network can try to reach other systems. Use authentication and authorization for services on both paths.
For the example cluster:
- Expose the web service through the public interface or load balancer.
- Bind the database listener to its private address if the application supports that setup.
- Allow database traffic only from the application and replication hosts that require it.
- Give admins an approved VPN or bastion path with separate access controls.
- Use TLS or another approved encryption control for sensitive traffic in transit.
- Test the allowed private path and check that the database port is unreachable from a controlled external host. Include IPv6 if the server has public IPv6.
A VLAN provides network separation. Use TLS or another encryption mechanism when the data must stay confidential in transit.
Is private bandwidth free?
Private traffic can be included, billed by volume, or bundled with a separate network service. The same-site path and a path to another data center can have different terms. Leaseweb documents included transfer for eligible private paths. AWS documents charges for certain cross-Availability Zone paths, with exceptions for specific services. Read the rules for the product and locations in your quote.
| Illustrative terms for the same 2.4 TB backup | Added transfer charge |
|---|---|
| Same-site private transfer included | $0 |
| One billable inter-site leg at $0.02 per GB | $48 |
The second example uses 2,400 decimal GB × $0.02. These prices are illustrative. The table covers transfer only. Compare port fees, network add-ons, speed upgrades, and gateway processing separately. If the provider charges for more than one leg, apply the rate to each billable leg.
What should you check before ordering a dedicated server?
| Ask the provider | Why it matters |
|---|---|
| What public and private rates apply to these exact locations and server models? | The rated port speed, guaranteed rate, and usable throughput can differ. |
| Do the two paths share a physical port, uplink, or rate limit? | Backup traffic can compete with public delivery at a shared bottleneck. |
| Which locations can the private network connect? | Same-rack, same-site, and inter-site connectivity can have different terms. |
| Which transfers count toward the allowance or incur charges? | The answer depends on the path, product, and contract. |
| What VLAN settings and maximum packet size does the path support? | A mismatch can disrupt communication or reduce throughput. |
| What happens if a link or server fails? | The remaining path must carry the traffic you need during recovery. |
After provisioning, confirm that the application resolves the intended address and uses the expected interface. Run a backup or throughput test during an approved window. Compare interface counters and provider usage records where available. Check whether public response times change while the private transfer runs.
Frequently asked questions
Can a dedicated server use public and private bandwidth at the same time?
Yes, if the provider supports both paths. A web server can serve visitors on its public interface and query a database over its private interface. Check whether the paths share capacity.
Does private traffic count toward my public bandwidth allowance?
That depends on the traffic path and the contract. Ask the provider whether it counts transfers between your exact endpoints. Verify that your application uses the private route.
Can a server with only a private IP download updates?
Yes, if it has an approved outbound route, such as a NAT gateway or proxy. That route can let the server initiate internet connections without accepting unsolicited inbound internet connections.
Does a 10Gbps public port also provide 10Gbps on the private network?
Only if the provider offers that private rate for your configuration. Check each rate separately and confirm any shared capacity limit.