> ## Documentation Index
> Fetch the complete documentation index at: https://docs.suji.fr/llms.txt
> Use this file to discover all available pages before exploring further.

# Network

> Public IPv4/IPv6, tunnel hostname, and the VM's traffic counters.

The **Network** tab shows your VM's public-facing addresses and its outbound/inbound traffic for the current billing month.

## Public addresses

| Type                | What it is                                            | When to use                                                                  |
| ------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------- |
| **Tunnel hostname** | `<install-subdomain>.suji.fr` per exposed install     | The "real" entry point for users of the app. HTTPS-terminated by Cloudflare. |
| **IPv4**            | Dedicated public IPv4                                 | SSH, anything that needs a raw IP                                            |
| **IPv6**            | Dedicated public IPv6 (where the region provides one) | Direct IPv6 access                                                           |

Each row has a one-click **Copy** button.

## How traffic is counted

* **Outgoing** — bytes leaving the VM in the current billing month.
* **Incoming** — bytes arriving at the VM in the current billing month. **Free** — never counts toward your quota.
* **Quota** — the monthly outbound allowance included per VM (20 TB). Overage is billed per GB beyond the allowance.

Units use the binary convention (a "20 TB" included quota is 20 × 1024⁴ bytes).

## Resetting / billing cycle

The traffic counters reset on the first of the calendar month, matching the billing cycle.

## The tunnel

Every Suji VM ships with **cloudflared** running as a system container. It:

* Holds a long-lived authenticated connection out to Cloudflare's edge.
* Receives inbound HTTPS for the hostnames in its ingress rules.
* Forwards requests to your apps via `localhost:<port>` inside the VM.

You don't manage cloudflared directly. Suji updates its ingress rules every time you install / upgrade / uninstall an exposed app.

## Why use the tunnel hostname instead of the public IP?

* **TLS**: the tunnel terminates valid certificates for `*.suji.fr` automatically.
* **No direct exposure**: your app doesn't have to open a public port — cloudflared connects out, not in.
* **DDoS protection**: Cloudflare absorbs typical noise.

Direct IP access (e.g. running `curl https://1.2.3.4`) won't reach your apps because the apps don't bind public ports. They listen only on `localhost` inside the VM's network namespace.

## Next

<CardGroup cols={2}>
  <Card title="Firewall" icon="shield" href="/manage-vm/firewall">
    Inbound rules for the public IP.
  </Card>

  <Card title="Snapshots" icon="camera" href="/manage-vm/snapshots">
    Backups of the VM's disk.
  </Card>
</CardGroup>