---
schema_version: "1"
id: 929b250eb05307214812c2862123f4de05ba485602774d24002b455eb33f474c
title: Private Spaces
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub-2/ps-about.md
canonical_url: https://docs.mulesoft.com/cloudhub-2/ps-about
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 0484de92ac4194d894b6339fea1deae05d4dba32bf754d9384f878005e66d9a8
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub 2.0
---

# Private Spaces

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

A _private space_ is a virtual, private, and isolated area in CloudHub 2.0 in which to run your
apps. You can create multiple private spaces, either in the same or different regions.

You connect your private intranet to your private space to function as a single, private network.

In each private space, you define:

- A _private network_, which is a virtual cloud where apps deployed to this private space run.

- A connection from the private network to your external network, either via Anypoint VPN or a
  transit gateway connection.

- TLS contexts, which define the domains that are available when deploying apps to the private
  spaces.

- Firewall rules to allow and block inbound and outbound traffic to your private space.

- The environments and business groups to allow to deploy to the private space.

- Where to forward logs, either Anypoint Monitoring or an external service such as Splunk.

## Private Network

When you create the private network, you associate a range of IP addresses for the apps in your
private space to use, the region in which they run, and optionally, any internal DNS servers to
resolve requests to custom domain.

Private spaces support Amazon regions. You can configure multiple private spaces in a single Amazon
region, enabling you to set up separate isolated networks for your production and non-production
environments, such as QA or staging.

## Private Network Connections

You can connect a private space to your private network using the following methods:

- [Anypoint Virtual Private Network](https://docs.mulesoft.com/cloudhub-2/ps-vpn-about)

- [Transit Gateway Attachments](https://docs.mulesoft.com/cloudhub-2/ps-tgw-about)

> [!NOTE] Before configuring routing, consolidate networks to the fewest number possible. A maximum
> of 95 route table entries is allowed per private space, regardless of the number of connections.

## TLS Contexts

Using Transport Layer Security (TLS) contexts, CloudHub 2.0 enables clients to use custom domains to
reach apps deployed to private spaces.

When setting up a private space, you configure Transport Layer Security (TLS) contexts that define
the domains that are available when deploying apps to the private spaces.

When deploying an app to the private space, you use the domains from the TLS contexts to configure
multiple endpoints, which clients use to reach the app from the internet. If the domains in the TLS
context include a wildcard, you can configure an optional subdomain, such as the app name or an
organization. You can create as many endpoints as you need.

In addition to custom domains, you can configure the app to be accessible from a different path from
the base path where the app is listening.

## Firewall Rules

You control the traffic to and from your private spaces. By default, CloudHub 2.0 blocks all traffic
to the private space and provides firewall rules to allow connections through specified ports. You
can configure additional firewall rules to control traffic to your private space, expose or block
your custom ports, and block requests to your apps.

The private space provides load balancing to balance inbound traffic to apps across multiple
replicas.

By combining firewall rules and TLS context configuration, you can fine-tune how external services
reach your applications.

## See Also

- [Creating Private Spaces](https://docs.mulesoft.com/cloudhub-2/ps-create-configure)

- [Creating VPN Connections](https://docs.mulesoft.com/cloudhub-2/ps-create-configure-vpn)

- [Creating Transit Gateway Attachments](https://docs.mulesoft.com/cloudhub-2/ps-create-configure-tgw)

- [Configuring Private Spaces](https://docs.mulesoft.com/cloudhub-2/ps-configure)

- [Configuring Domains and Certificates (TLS Context) for a Private Space](https://docs.mulesoft.com/cloudhub-2/ps-config-domains)

- [Configuring Firewall Rules to Manage Traffic to and from a Private Space](https://docs.mulesoft.com/cloudhub-2/ps-config-fw-rules)

- [Associating Business Groups and Environments with a Private Space](https://docs.mulesoft.com/cloudhub-2/ps-config-env)

- [Configuring Endpoints and Paths for Apps Deployed to a Private Space](https://docs.mulesoft.com/cloudhub-2/ch2-config-endpoints-paths)