# Private networking

> Services in one environment reach each other by name over a private network that spans every host.

Services in one environment reach each other by name over a private network that spans every host.

## Names

Every service has a private name, `<name>.internal` (also `<name>.railway.internal`), set in **Settings > Networking**. Call it on the port your service listens on:

```
http://api.internal:8080
```

Or use references: `${{api.RAILWAY_PRIVATE_DOMAIN}}`.

DNS answers with the healthy replicas (TTL 5 seconds), on whichever hosts they run. Renaming keeps the old name working for 24 hours.

## Across hosts

With two or more hosts, traffic between them goes over WireGuard (UDP 51820). Source addresses are kept, so logs show the real caller.

## Isolation

- Environments and projects cannot reach each other.
- Containers cannot reach the host, the cloud metadata address `169.254.169.254` or the mesh, unless an Admin turns on **Allow metadata** for that service.
- Private DNS keeps answering from the agent's cache while the control plane is down.

## Next steps

- [Quarantined environments](https://5050cloud.com/docs/guides/quarantined-environments)
- [Replicas and zero-downtime deploys](https://5050cloud.com/docs/guides/replicas-zero-downtime): keep-alive timeouts for internal callers.