---
schema_version: "1"
id: 16a431e2de24e39b9e4ca66150d72404801e61fabd2f043e619f772232438c8e
title: Private Spaces
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub-2/ch2-private-space-about.md
canonical_url: https://docs.mulesoft.com/cloudhub-2/ch2-private-space-about
source_site: docs.mulesoft.com
content_type: documentation
content_hash: b9d3ed511eb99261daab22498bed500623a84ff23c2a27206a3be1bedff9ed9f
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub 2.0
---

# Private Spaces

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

A _private space_ is a virtual, private, and isolated logical space in CloudHub 2.0 in which to run
your apps. You can create multiple private spaces, either in the same or different regions.

You connect your private intranet to your private space to function as a single, private network.

In each private space, you define:

- A _private network_, which is a virtual cloud where apps deployed to this private space run.

- One or more connections from the private network to your external network, either via Anypoint VPN
  or a transit gateway.

- TLS contexts, which define the domains that are available when deploying apps to the private
  spaces, and optionally enable mutual TLS.

- Firewall rules to allow and block inbound and outbound traffic to your private space.

- The environments and business groups to allow to deploy to the private space.

When you create a private space, your license for Mule runtime is automatically injected and managed
by MuleSoft.

## Private Network

When you create the private network, you associate a range of IP addresses for the apps in your
private space to use, the region in which they run, and optionally, any internal DNS servers to
resolve requests to custom domains.

You can configure multiple private spaces in a single region, enabling you to set up separate
isolated networks for your production and non-production environments, such as dev or staging.

For information about regions, see
[Private Network Region](https://docs.mulesoft.com/cloudhub-2/ps-gather-setup-info#private-network-region).

## Private Network Connections

You can connect a private space to your private network using the following methods:

- [Anypoint Virtual Private Network](https://docs.mulesoft.com/cloudhub-2/ps-vpn-about)

- [Transit Gateway Attachments](https://docs.mulesoft.com/cloudhub-2/ps-tgw-about)

## TLS Contexts

Using Transport Layer Security (TLS) contexts, CloudHub 2.0 enables clients to use custom domains
and paths to reach apps deployed to private spaces.

When setting up a private space, you configure Transport Layer Security (TLS) contexts that define
the domains that are available when deploying apps to the private spaces, and optionally enable
mutual TLS.

When deploying an app to the private space, you can use the domains from the TLS contexts to
configure multiple endpoints, which clients use to reach the app from the internet. If the domains
in the TLS context include a wildcard, you can configure an optional subdomain, such as the app name
or an organization. You can create as many endpoints as you need.

## Path Rewriting

You can configure the app to be accessible from a different path from the base path where the app is
listening.

## Firewall Rules

You control the traffic to and from your private spaces.

Inbound

By default, CloudHub 2.0 allows traffic to the private space on ports 80 (HTTP) and 443 (HTTPS) from
anywhere (0.0.0.0/0). Configure firewall rules to allow connections through specified ports, remove
ports, or use ports 80 and 443 to control traffic to your private space.

The private space provides load balancing to balance inbound traffic to apps across multiple
replicas.

Outbound

By default, CloudHub 2.0 allows all traffic from the private space to destinations outside the
private space. Configure firewall rules to remove this rule and allow traffic only on specified
ports.

By combining firewall rules and TLS context configuration, you can fine-tune the ingress and egress
of your application traffic.

Private space network traffic metrics aren’t available in Anypoint Monitoring. For
_application-level_ traffic metrics, see
[Can I get VPC-level network traffic metrics from Anypoint Monitoring?](https://docs.mulesoft.com/monitoring/am-faq#vpc-traffic-metrics).

## See Also

- [Creating Private Spaces](https://docs.mulesoft.com/cloudhub-2/ps-create-configure)

- [Creating VPN Connections](https://docs.mulesoft.com/cloudhub-2/ps-create-configure-vpn)

- [Creating Transit Gateway Attachments](https://docs.mulesoft.com/cloudhub-2/ps-create-configure-tgw)

- [Configuring Private Spaces](https://docs.mulesoft.com/cloudhub-2/ps-configure)

- [Configuring Domains and Certificates (TLS Context) for a Private Space](https://docs.mulesoft.com/cloudhub-2/ps-config-domains)

- [Configuring Firewall Rules to Manage Traffic to and from a Private Space](https://docs.mulesoft.com/cloudhub-2/ps-config-fw-rules)

- [Associating Business Groups and Environments with a Private Space](https://docs.mulesoft.com/cloudhub-2/ps-config-env)

- [Configuring Endpoints and Paths for Apps Deployed to a Private Space](https://docs.mulesoft.com/cloudhub-2/ch2-config-endpoints-paths)