diff --git a/.gitignore b/.gitignore
index f11338e07..f2a70cedf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,6 +10,7 @@
 /vendor
 /build
 /storage/database.sqlite
+/storage/database.sqlite.bak*
 /storage/database-test.sqlite
 /storage/database.sqlite-journal
 /storage/database-test.sqlite-journal
diff --git a/.prettierignore b/.prettierignore
index 47061dda0..db8957b31 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -13,6 +13,7 @@ sail
 !*.blade.php
 !*.sh
 resources/views/ssh/
+resources/views/wireguard/
 resources/views/scribe/
 resources/js/ziggy.js
 resources/views/mail/*
diff --git a/app/Actions/FirewallRule/ManageRule.php b/app/Actions/FirewallRule/ManageRule.php
index bf6f541ef..b9d9524d8 100755
--- a/app/Actions/FirewallRule/ManageRule.php
+++ b/app/Actions/FirewallRule/ManageRule.php
@@ -6,6 +6,7 @@
 use App\Jobs\FirewallRule\ApplyRulesJob;
 use App\Models\FirewallRule;
 use App\Models\Server;
+use App\Support\Cidr;
 use App\ValidationRules\PortOrPortRangeRule;
 use Illuminate\Support\Facades\Validator;
 
@@ -55,6 +56,9 @@ public function delete(FirewallRule $rule): void
 
     private function validate(array $input): void
     {
+        $source = $input['source'] ?? null;
+        $maxMask = is_string($source) && Cidr::isValidAddress($source) ? Cidr::bits($source) : 32;
+
         $rules = [
             'name' => [
                 'required',
@@ -81,13 +85,13 @@ private function validate(array $input): void
                 'nullable',
                 'numeric',
                 'min:1',
-                'max:32',
+                'max:'.$maxMask,
             ],
         ];
 
         if (isset($input['source_any']) && $input['source_any'] === false) {
             $rules['source'] = ['required', 'ip'];
-            $rules['mask'] = ['required', 'numeric', 'min:1', 'max:32'];
+            $rules['mask'] = ['required', 'numeric', 'min:1', 'max:'.$maxMask];
         }
 
         Validator::make($input, $rules)->validate();
diff --git a/app/Actions/Network/AddServersToNetwork.php b/app/Actions/Network/AddServersToNetwork.php
new file mode 100644
index 000000000..5f3109796
--- /dev/null
+++ b/app/Actions/Network/AddServersToNetwork.php
@@ -0,0 +1,188 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\IpAddressType;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkType;
+use App\Models\Network;
+use App\Models\Project;
+use App\Models\Server;
+use App\ValidationRules\WithinCidrRule;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+
+class AddServersToNetwork
+{
+    public function __construct(
+        private AllocateWireGuardPort $ports,
+        private CreateWireGuardMembers $members,
+        private DispatchNetworkServerSync $sync,
+        private RecomputeNetworkStatus $recompute,
+        private ApplyNetworkFirewall $firewall,
+    ) {}
+
+    /**
+     * @param  array<string, mixed>  $input
+     * @return ?int the port the network moved to, when an incoming server forced it off its own
+     */
+    public function add(Network $network, array $input): ?int
+    {
+        if ($network->type === NetworkType::PROVIDER) {
+            throw ValidationException::withMessages([
+                'servers' => __('Members of a provider-managed network are synced from the provider.'),
+            ]);
+        }
+
+        $this->validate($network, $input);
+
+        $portBefore = $network->port;
+
+        $newMemberIds = DB::transaction(function () use ($network, $input): array {
+            return $network->type === NetworkType::WIREGUARD
+                ? $this->addWireGuard($network, $input)
+                : $this->addCustom($network, $input);
+        });
+
+        if ($network->type === NetworkType::WIREGUARD) {
+            $network->load('servers.server');
+            foreach ($network->servers as $member) {
+                if (in_array($member->id, $newMemberIds, true)
+                    || in_array($member->status, [NetworkServerStatus::ACTIVE, NetworkServerStatus::UPDATING], true)) {
+                    $this->sync->toPresent($member);
+                }
+            }
+        } else {
+            $this->firewall->handle($network);
+        }
+
+        $this->recompute->handle($network);
+
+        return $network->port !== $portBefore ? $network->port : null;
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     * @return array<int, int>
+     */
+    private function addWireGuard(Network $network, array $input): array
+    {
+        Project::query()->whereKey($network->project_id)->lockForUpdate()->first();
+        Network::query()->whereKey($network->id)->lockForUpdate()->first();
+
+        $this->resolvePortConflict($network, $input['servers']);
+
+        $used = $network->servers()->lockForUpdate()->pluck('ip')
+            ->concat($network->peers()->lockForUpdate()->pluck('ip'))
+            ->filter()
+            ->values()
+            ->all();
+
+        $servers = Server::query()
+            ->where('project_id', $network->project_id)
+            ->whereIn('id', $input['servers'])
+            ->get();
+
+        return $this->members->create($network, $servers, $used);
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     * @return array<int, int>
+     */
+    private function addCustom(Network $network, array $input): array
+    {
+        $ids = [];
+        foreach ($input['servers'] as $serverId) {
+            $member = $network->servers()->create([
+                'server_id' => $serverId,
+                'server_ip_address_id' => $input['ip_addresses'][$serverId],
+                'status' => NetworkServerStatus::ACTIVE,
+            ]);
+            $ids[] = $member->id;
+        }
+
+        return $ids;
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    private function validate(Network $network, array $input): void
+    {
+        $rules = [
+            'servers' => ['required', 'array', 'min:1'],
+            'servers.*' => [
+                'integer',
+                'distinct',
+                Rule::exists('servers', 'id')->where('project_id', $network->project_id),
+                Rule::unique('network_servers', 'server_id')->where('network_id', $network->id),
+            ],
+        ];
+
+        if ($network->type === NetworkType::CUSTOM) {
+            $rules['ip_addresses'] = ['required', 'array'];
+        }
+
+        Validator::make($input, $rules)->validate();
+
+        if ($network->type === NetworkType::CUSTOM) {
+            $this->validateMemberIps($network, $input);
+        }
+    }
+
+    /**
+     * Runs only once `servers` is known to be a list of integers — building these rules from
+     * unvalidated input would interpolate an array into a rule key and fail with a 500.
+     *
+     * @param  array<string, mixed>  $input
+     */
+    private function validateMemberIps(Network $network, array $input): void
+    {
+        $rules = [];
+
+        foreach ($input['servers'] as $serverId) {
+            $rules["ip_addresses.$serverId"] = [
+                'required',
+                Rule::exists('server_ip_addresses', 'id')
+                    ->where('server_id', $serverId)
+                    ->where('type', IpAddressType::PRIVATE->value),
+                Rule::unique('network_servers', 'server_ip_address_id'),
+                new WithinCidrRule($network->cidr),
+            ];
+        }
+
+        Validator::make($input, $rules)->validate();
+    }
+
+    /**
+     * An incoming server may already run this network's port for a different network, which the
+     * two would then fight over on that host. The network moves to a free port instead of
+     * refusing the server — every healthy member is resynced by the caller, so they follow it.
+     *
+     * Peers do not follow: their endpoint port is baked into the config at download time, so an
+     * already-imported config keeps the old port. The caller warns when peers exist.
+     *
+     * @param  array<int, int>  $serverIds
+     */
+    private function resolvePortConflict(Network $network, array $serverIds): void
+    {
+        $serverIds = array_merge($network->servers()->pluck('server_id')->all(), $serverIds);
+
+        $port = $this->ports->allocate(
+            $network->project_id,
+            $serverIds,
+            $network->port ?? 51820,
+            $network->id,
+        );
+
+        if ($port === $network->port) {
+            return;
+        }
+
+        $network->port = $port;
+        $network->save();
+    }
+}
diff --git a/app/Actions/Network/AllocateNetworkBlock.php b/app/Actions/Network/AllocateNetworkBlock.php
new file mode 100644
index 000000000..321483cdf
--- /dev/null
+++ b/app/Actions/Network/AllocateNetworkBlock.php
@@ -0,0 +1,134 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkAddressingPool;
+use App\Models\Server;
+use App\Models\ServerIpAddress;
+use App\Support\Cidr;
+use Illuminate\Support\Collection;
+use Illuminate\Validation\ValidationException;
+
+class AllocateNetworkBlock
+{
+    /**
+     * Provider/Docker/AWS/Linode ranges to avoid on the RFC1918 opt-in path.
+     * The whole 172.16.0.0/12 (Docker/AWS default) is excluded by not listing
+     * it as an RFC1918 supernet below.
+     *
+     * @var array<int, string>
+     */
+    private const BLOCKLIST = [
+        '10.244.0.0/16',
+        '10.245.0.0/16',
+        '10.246.0.0/24',
+        '10.229.0.0/16',
+        '192.168.128.0/17',
+    ];
+
+    /**
+     * @return array<int, string>
+     */
+    private function supernets(NetworkAddressingPool $pool): array
+    {
+        return match ($pool) {
+            NetworkAddressingPool::CGNAT => ['100.64.0.0/10'],
+            NetworkAddressingPool::RFC1918 => ['10.0.0.0/8', '192.168.0.0/16'],
+        };
+    }
+
+    /**
+     * Carve the next free canonical block from the pool, avoiding overlap with
+     * existing project networks and with any member server's observed subnets
+     * (of any type — a CGNAT-WAN interface is stored PUBLIC).
+     *
+     * @param  Collection<int, string>  $existingCidrs
+     * @param  Collection<int, Server>  $memberServers
+     */
+    public function allocate(
+        NetworkAddressingPool $pool,
+        int $blockPrefix,
+        Collection $existingCidrs,
+        Collection $memberServers
+    ): string {
+        $existing = $existingCidrs->filter()->values()->all();
+        $memberSubnets = $this->memberSubnets($memberServers);
+        $blocklist = $pool === NetworkAddressingPool::RFC1918 ? self::BLOCKLIST : [];
+
+        foreach ($this->supernets($pool) as $supernet) {
+            $candidate = $this->scan($supernet, $blockPrefix, $existing, $memberSubnets, $blocklist);
+            if ($candidate !== null) {
+                return $candidate;
+            }
+        }
+
+        throw ValidationException::withMessages([
+            'servers' => __('No free address block is available in the selected pool. Choose a smaller block size or the RFC1918 pool.'),
+        ]);
+    }
+
+    /**
+     * @param  array<int, string>  $existing
+     * @param  array<int, string>  $memberSubnets
+     * @param  array<int, string>  $blocklist
+     */
+    private function scan(
+        string $supernet,
+        int $blockPrefix,
+        array $existing,
+        array $memberSubnets,
+        array $blocklist
+    ): ?string {
+        $supernetPrefix = Cidr::prefix($supernet);
+        if ($blockPrefix < $supernetPrefix) {
+            return null;
+        }
+
+        $base = Cidr::toLong(Cidr::network($supernet));
+        $blockSize = Cidr::size($blockPrefix);
+        $count = 2 ** ($blockPrefix - $supernetPrefix);
+
+        for ($i = 0; $i < $count; $i++) {
+            $candidate = long2ip($base + ($i * $blockSize)).'/'.$blockPrefix;
+
+            if ($this->conflicts($candidate, $existing) || $this->conflicts($candidate, $blocklist)
+                || $this->conflicts($candidate, $memberSubnets)) {
+                continue;
+            }
+
+            return $candidate;
+        }
+
+        return null;
+    }
+
+    /**
+     * @param  array<int, string>  $others
+     */
+    private function conflicts(string $candidate, array $others): bool
+    {
+        foreach ($others as $other) {
+            if (Cidr::overlaps($candidate, $other)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @param  Collection<int, Server>  $memberServers
+     * @return array<int, string>
+     */
+    private function memberSubnets(Collection $memberServers): array
+    {
+        return ServerIpAddress::query()
+            ->whereIn('server_id', $memberServers->pluck('id')->all())
+            ->get()
+            ->filter(fn (ServerIpAddress $address): bool => filter_var($address->ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false)
+            ->map(fn (ServerIpAddress $address): string => Cidr::canonical($address->ip.'/'.$address->prefix_length))
+            ->unique()
+            ->values()
+            ->all();
+    }
+}
diff --git a/app/Actions/Network/AllocateWireGuardPort.php b/app/Actions/Network/AllocateWireGuardPort.php
new file mode 100644
index 000000000..bd1a6be1c
--- /dev/null
+++ b/app/Actions/Network/AllocateWireGuardPort.php
@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkType;
+use App\Models\Network;
+use Illuminate\Validation\ValidationException;
+
+class AllocateWireGuardPort
+{
+    /**
+     * A server runs one WireGuard interface per network it belongs to, and two interfaces on
+     * one host cannot share a listen port. The port is therefore picked against the networks
+     * the given servers already belong to, not against the project as a whole.
+     *
+     * @param  array<int, int>  $serverIds
+     */
+    public function allocate(int $projectId, array $serverIds, int $requested, ?int $excludeNetworkId = null): int
+    {
+        $used = Network::query()
+            ->where('type', NetworkType::WIREGUARD)
+            ->where('project_id', $projectId)
+            ->when($excludeNetworkId !== null, fn ($query) => $query->whereKeyNot($excludeNetworkId))
+            ->whereHas('servers', fn ($query) => $query->whereIn('server_id', $serverIds))
+            ->pluck('port')
+            ->filter()
+            ->all();
+
+        $port = $requested;
+
+        while (in_array($port, $used, true)) {
+            $port++;
+
+            if ($port > 65535) {
+                throw ValidationException::withMessages([
+                    'port' => __('No free WireGuard port is available for the selected servers.'),
+                ]);
+            }
+        }
+
+        return $port;
+    }
+}
diff --git a/app/Actions/Network/ApplyNetworkFirewall.php b/app/Actions/Network/ApplyNetworkFirewall.php
new file mode 100644
index 000000000..f76f3325c
--- /dev/null
+++ b/app/Actions/Network/ApplyNetworkFirewall.php
@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkServerStatus;
+use App\Jobs\Network\ApplyNetworkFirewallJob;
+use App\Models\Network;
+use App\Models\NetworkServer;
+use App\Models\Service;
+use Illuminate\Support\Facades\DB;
+
+class ApplyNetworkFirewall
+{
+    public function __construct(
+        private RecomputeNetworkStatus $recompute,
+        private MaterializeServerNetworkRules $materialize,
+    ) {}
+
+    /**
+     * Re-apply the network's firewall on each member. Reachable servers apply
+     * now (lightweight, no WireGuard bounce); an unreachable server's member is
+     * marked PENDING so the reconciler re-applies when it comes back.
+     */
+    public function handle(Network $network): void
+    {
+        $this->materialize->forNetwork($network);
+
+        $deferred = false;
+
+        $network->servers()
+            ->where('status', '!=', NetworkServerStatus::LEAVING)
+            ->with('server')
+            ->get()
+            ->each(function (NetworkServer $member) use (&$deferred): void {
+                if ($member->server->isReady()) {
+                    if ($member->server->firewall() instanceof Service) {
+                        DB::afterCommit(fn () => dispatch(new ApplyNetworkFirewallJob($member))->onQueue('ssh'));
+                    }
+
+                    return;
+                }
+
+                if ($member->status === NetworkServerStatus::ACTIVE) {
+                    $member->status = NetworkServerStatus::PENDING;
+                    $member->save();
+                    $deferred = true;
+                }
+            });
+
+        if ($deferred) {
+            $this->recompute->handle($network);
+        }
+    }
+}
diff --git a/app/Actions/Network/CheckNetworkStranding.php b/app/Actions/Network/CheckNetworkStranding.php
new file mode 100644
index 000000000..476583bbe
--- /dev/null
+++ b/app/Actions/Network/CheckNetworkStranding.php
@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkType;
+use App\Models\Network;
+use App\Models\NetworkServer;
+use App\ServerProviders\ProvidesPrivateNetworks;
+
+class CheckNetworkStranding
+{
+    /**
+     * Whether a provider network can no longer be asked about at the provider: its connection
+     * cannot discover private networks, or none of its members still carries the instance id the
+     * provider identifies servers by. Sync can neither reconcile nor prune such a network, so the
+     * policy lets it be deleted by hand instead of stranding the row.
+     *
+     * A network with no members at all is not stranded — sync reaps that one on its own.
+     */
+    public function handle(Network $network): bool
+    {
+        if ($network->type !== NetworkType::PROVIDER || $network->server_provider_id === null) {
+            return false;
+        }
+
+        $provider = $network->serverProvider?->provider();
+
+        if (! $provider instanceof ProvidesPrivateNetworks) {
+            return true;
+        }
+
+        $members = $network->servers()->with('server:id,provider_data')->get();
+
+        if ($members->isEmpty()) {
+            return false;
+        }
+
+        $key = $provider->instanceIdKey();
+
+        return ! $members->contains(
+            fn (NetworkServer $member): bool => ($member->server->provider_data[$key] ?? '') !== ''
+        );
+    }
+}
diff --git a/app/Actions/Network/ConcealNetworkPeerKey.php b/app/Actions/Network/ConcealNetworkPeerKey.php
new file mode 100644
index 000000000..052196270
--- /dev/null
+++ b/app/Actions/Network/ConcealNetworkPeerKey.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\DTOs\SocketEventDTO;
+use App\Events\SocketEvent;
+use App\Http\Resources\NetworkPeerResource;
+use App\Models\NetworkPeer;
+use Illuminate\Validation\ValidationException;
+
+class ConcealNetworkPeerKey
+{
+    public function conceal(NetworkPeer $peer): void
+    {
+        if ($peer->byo) {
+            throw ValidationException::withMessages([
+                'peer' => __('This peer uses a user-provided key; there is nothing to conceal.'),
+            ]);
+        }
+
+        $peer->private_key = null;
+        $peer->save();
+
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $peer->network->project_id,
+            type: 'network-peer.updated',
+            data: new NetworkPeerResource($peer),
+        ));
+    }
+}
diff --git a/app/Actions/Network/CreateNetwork.php b/app/Actions/Network/CreateNetwork.php
new file mode 100644
index 000000000..4cf4b3ce7
--- /dev/null
+++ b/app/Actions/Network/CreateNetwork.php
@@ -0,0 +1,223 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\FirewallRuleStatus;
+use App\Enums\IpAddressType;
+use App\Enums\NetworkAddressingPool;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkStatus;
+use App\Enums\NetworkType;
+use App\Models\Network;
+use App\Models\Project;
+use App\Models\Server;
+use App\Support\Cidr;
+use App\ValidationRules\CidrRule;
+use App\ValidationRules\PrivateRangeRule;
+use App\ValidationRules\WithinCidrRule;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+
+class CreateNetwork
+{
+    public function __construct(
+        private AllocateNetworkBlock $allocator,
+        private AllocateWireGuardPort $ports,
+        private CreateWireGuardMembers $members,
+        private DispatchNetworkServerSync $sync,
+        private RecomputeNetworkStatus $recompute,
+        private ApplyNetworkFirewall $firewall,
+    ) {}
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    public function create(Project $project, array $input): Network
+    {
+        $this->validate($project, $input);
+
+        $type = NetworkType::from($input['type']);
+
+        $network = DB::transaction(function () use ($type, $project, $input): Network {
+            $network = $type === NetworkType::WIREGUARD
+                ? $this->buildWireGuard($project, $input)
+                : $this->buildCustom($project, $input);
+
+            $this->seedDefaultFirewallRule($network);
+
+            return $network;
+        });
+
+        if ($network->type === NetworkType::WIREGUARD) {
+            $network->load('servers.server');
+            foreach ($network->servers as $member) {
+                $this->sync->toPresent($member);
+            }
+        } else {
+            $this->firewall->handle($network);
+        }
+
+        $this->recompute->handle($network);
+
+        return $network->refresh();
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    private function buildWireGuard(Project $project, array $input): Network
+    {
+        $pool = NetworkAddressingPool::from($input['addressing_pool'] ?? NetworkAddressingPool::CGNAT->value);
+        $blockPrefix = (int) ($input['prefix'] ?? 24);
+
+        Project::query()->whereKey($project->id)->lockForUpdate()->first();
+
+        /** @var Collection<int, Server> $members */
+        $members = Server::query()
+            ->where('project_id', $project->id)
+            ->whereIn('id', $input['servers'])
+            ->get();
+
+        $existing = $project->networks()->pluck('cidr_canonical');
+
+        $cidr = $this->allocator->allocate($pool, $blockPrefix, $existing, $members);
+
+        $network = Network::create([
+            'project_id' => $project->id,
+            'name' => $input['name'],
+            'type' => NetworkType::WIREGUARD,
+            'status' => NetworkStatus::CREATING,
+            'addressing_pool' => $pool,
+            'cidr' => $cidr,
+            'cidr_canonical' => $cidr,
+            'port' => $this->ports->allocate($project->id, $members->pluck('id')->all(), (int) ($input['port'] ?? 51820)),
+        ]);
+
+        $this->members->create($network, $members);
+
+        return $network;
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    private function buildCustom(Project $project, array $input): Network
+    {
+        Project::query()->whereKey($project->id)->lockForUpdate()->first();
+
+        if (isset($input['cidr']) && $input['cidr'] !== '') {
+            $canonical = Cidr::canonical($input['cidr']);
+            if ($project->networks()
+                ->whereIn('type', [NetworkType::CUSTOM, NetworkType::WIREGUARD])
+                ->where('cidr_canonical', $canonical)
+                ->exists()) {
+                throw ValidationException::withMessages([
+                    'cidr' => __('This CIDR is already used by another network in this project.'),
+                ]);
+            }
+        }
+
+        $cidr = ($input['cidr'] ?? '') !== '' ? $input['cidr'] : null;
+
+        $network = Network::create([
+            'project_id' => $project->id,
+            'name' => $input['name'],
+            'type' => NetworkType::CUSTOM,
+            'status' => NetworkStatus::ACTIVE,
+            'cidr' => $cidr,
+            'cidr_canonical' => $cidr !== null ? Cidr::canonical($cidr) : null,
+        ]);
+
+        foreach ($input['servers'] as $serverId) {
+            $network->servers()->create([
+                'server_id' => $serverId,
+                'server_ip_address_id' => $input['ip_addresses'][$serverId],
+                'status' => NetworkServerStatus::ACTIVE,
+            ]);
+        }
+
+        return $network;
+    }
+
+    private function seedDefaultFirewallRule(Network $network): void
+    {
+        $network->firewallRules()->create([
+            'name' => 'Allow all',
+            'protocol' => null,
+            'port' => null,
+            'status' => FirewallRuleStatus::READY,
+        ]);
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    private function validate(Project $project, array $input): void
+    {
+        $rules = [
+            'name' => [
+                'required',
+                'string',
+                'max:255',
+                Rule::unique('networks', 'name')->where('project_id', $project->id),
+            ],
+            'type' => [
+                'required',
+                Rule::in([NetworkType::CUSTOM->value, NetworkType::WIREGUARD->value]),
+            ],
+            'servers' => ['required', 'array', 'min:1'],
+            'servers.*' => [
+                'integer',
+                'distinct',
+                Rule::exists('servers', 'id')->where('project_id', $project->id),
+            ],
+        ];
+
+        if (($input['type'] ?? null) === NetworkType::WIREGUARD->value) {
+            $rules['addressing_pool'] = [
+                'nullable',
+                Rule::in([NetworkAddressingPool::CGNAT->value, NetworkAddressingPool::RFC1918->value]),
+            ];
+            $rules['prefix'] = ['nullable', 'integer', 'min:16', 'max:28'];
+            $rules['port'] = ['nullable', 'integer', 'min:1024', 'max:65535'];
+        }
+
+        if (($input['type'] ?? null) === NetworkType::CUSTOM->value) {
+            $rules['cidr'] = ['nullable', 'string', new CidrRule, new PrivateRangeRule];
+            $rules['ip_addresses'] = ['required', 'array'];
+        }
+
+        Validator::make($input, $rules)->validate();
+
+        if (($input['type'] ?? null) === NetworkType::CUSTOM->value) {
+            $this->validateMemberIps($input);
+        }
+    }
+
+    /**
+     * Runs only once `servers` is known to be a list of integers — building these rules from
+     * unvalidated input would interpolate an array into a rule key and fail with a 500.
+     *
+     * @param  array<string, mixed>  $input
+     */
+    private function validateMemberIps(array $input): void
+    {
+        $rules = [];
+
+        foreach ($input['servers'] as $serverId) {
+            $rules["ip_addresses.$serverId"] = [
+                'required',
+                Rule::exists('server_ip_addresses', 'id')
+                    ->where('server_id', $serverId)
+                    ->where('type', IpAddressType::PRIVATE->value),
+                Rule::unique('network_servers', 'server_ip_address_id'),
+                new WithinCidrRule($input['cidr'] ?? null),
+            ];
+        }
+
+        Validator::make($input, $rules)->validate();
+    }
+}
diff --git a/app/Actions/Network/CreateNetworkPeer.php b/app/Actions/Network/CreateNetworkPeer.php
new file mode 100644
index 000000000..55cfdea56
--- /dev/null
+++ b/app/Actions/Network/CreateNetworkPeer.php
@@ -0,0 +1,116 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\DTOs\SocketEventDTO;
+use App\Enums\NetworkPeerStatus;
+use App\Enums\NetworkType;
+use App\Events\SocketEvent;
+use App\Http\Resources\NetworkPeerResource;
+use App\Models\Network;
+use App\Models\NetworkPeer;
+use App\Support\Cidr;
+use App\ValidationRules\WireGuardPublicKeyRule;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+
+class CreateNetworkPeer
+{
+    public function __construct(
+        private GenerateWireGuardKeys $keys,
+        private DispatchNetworkServerSync $sync,
+        private RecomputeNetworkStatus $recompute,
+    ) {}
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    public function create(Network $network, array $input): NetworkPeer
+    {
+        abort_unless($network->type === NetworkType::WIREGUARD, 404);
+
+        $this->validate($network, $input);
+
+        $peer = DB::transaction(function () use ($network, $input): NetworkPeer {
+            Network::query()->whereKey($network->id)->lockForUpdate()->first();
+
+            $used = $this->usedIps($network);
+            $ip = Cidr::nextHost((string) $network->cidr, $used);
+            if ($ip === null) {
+                throw ValidationException::withMessages([
+                    'name' => __('The network address block is full.'),
+                ]);
+            }
+
+            return $network->peers()->create([
+                ...$this->keyAttributes($input),
+                'name' => $input['name'],
+                'ip' => $ip,
+                'status' => NetworkPeerStatus::PENDING,
+            ]);
+        });
+
+        $this->sync->resyncMembers($network);
+        $this->recompute->handle($network);
+
+        $this->broadcast($network, $peer);
+
+        return $peer;
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     * @return array{public_key: string, private_key: ?string, byo: bool}
+     */
+    private function keyAttributes(array $input): array
+    {
+        $publicKey = $input['public_key'] ?? null;
+
+        if (is_string($publicKey) && $publicKey !== '') {
+            return ['public_key' => $publicKey, 'private_key' => null, 'byo' => true];
+        }
+
+        $keys = $this->keys->generate();
+
+        return ['public_key' => $keys['public_key'], 'private_key' => $keys['private_key'], 'byo' => false];
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function usedIps(Network $network): array
+    {
+        return $network->servers()->lockForUpdate()->pluck('ip')
+            ->concat($network->peers()->lockForUpdate()->pluck('ip'))
+            ->filter()
+            ->values()
+            ->all();
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    private function validate(Network $network, array $input): void
+    {
+        Validator::make($input, [
+            'name' => [
+                'required',
+                'string',
+                'max:255',
+                Rule::unique('network_peers', 'name')->where('network_id', $network->id),
+            ],
+            'public_key' => ['nullable', 'string', new WireGuardPublicKeyRule($network)],
+        ])->validate();
+    }
+
+    private function broadcast(Network $network, NetworkPeer $peer): void
+    {
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $network->project_id,
+            type: 'network-peer.updated',
+            data: new NetworkPeerResource($peer),
+        ));
+    }
+}
diff --git a/app/Actions/Network/CreateWireGuardMembers.php b/app/Actions/Network/CreateWireGuardMembers.php
new file mode 100644
index 000000000..50f7004bf
--- /dev/null
+++ b/app/Actions/Network/CreateWireGuardMembers.php
@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkServerStatus;
+use App\Models\Network;
+use App\Models\Server;
+use App\Support\Cidr;
+use Illuminate\Support\Collection;
+use Illuminate\Validation\ValidationException;
+
+class CreateWireGuardMembers
+{
+    public function __construct(private GenerateWireGuardKeys $keys) {}
+
+    /**
+     * Allocate the next free host address and a fresh key pair for each server,
+     * and create its membership row.
+     *
+     * @param  Collection<int, Server>  $servers
+     * @param  array<int, string>  $used
+     * @return array<int, int>
+     */
+    public function create(Network $network, Collection $servers, array $used = []): array
+    {
+        $ids = [];
+
+        foreach ($servers as $server) {
+            $ip = Cidr::nextHost((string) $network->cidr, $used);
+
+            if ($ip === null) {
+                throw ValidationException::withMessages([
+                    'servers' => __('The network address block is full.'),
+                ]);
+            }
+
+            $used[] = $ip;
+
+            $keys = $this->keys->generate();
+
+            $member = $network->servers()->create([
+                'server_id' => $server->id,
+                'ip' => $ip,
+                'public_key' => $keys['public_key'],
+                'private_key' => $keys['private_key'],
+                'status' => NetworkServerStatus::PENDING,
+            ]);
+
+            $ids[] = $member->id;
+        }
+
+        return $ids;
+    }
+}
diff --git a/app/Actions/Network/DeleteNetwork.php b/app/Actions/Network/DeleteNetwork.php
new file mode 100644
index 000000000..7645b8493
--- /dev/null
+++ b/app/Actions/Network/DeleteNetwork.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkStatus;
+use App\Models\Network;
+
+class DeleteNetwork
+{
+    public function __construct(
+        private DispatchNetworkServerSync $sync,
+        private RecomputeNetworkStatus $recompute,
+    ) {}
+
+    public function delete(Network $network): void
+    {
+        $network->status = NetworkStatus::DELETING;
+        $network->save();
+
+        $network->load('servers.server');
+        foreach ($network->servers as $member) {
+            $this->sync->teardown($member);
+        }
+
+        $this->recompute->handle($network);
+    }
+}
diff --git a/app/Actions/Network/DeleteNetworkPeer.php b/app/Actions/Network/DeleteNetworkPeer.php
new file mode 100644
index 000000000..2af24b047
--- /dev/null
+++ b/app/Actions/Network/DeleteNetworkPeer.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\DTOs\SocketEventDTO;
+use App\Events\SocketEvent;
+use App\Models\NetworkPeer;
+
+class DeleteNetworkPeer
+{
+    public function __construct(
+        private DispatchNetworkServerSync $sync,
+        private RecomputeNetworkStatus $recompute,
+    ) {}
+
+    public function delete(NetworkPeer $peer): void
+    {
+        $network = $peer->network;
+        $peerId = $peer->id;
+
+        $peer->delete();
+
+        $this->sync->resyncMembers($network);
+        $this->recompute->handle($network);
+
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $network->project_id,
+            type: 'network-peer.deleted',
+            data: ['id' => $peerId],
+        ));
+    }
+}
diff --git a/app/Actions/Network/DispatchNetworkServerSync.php b/app/Actions/Network/DispatchNetworkServerSync.php
new file mode 100644
index 000000000..44c7a2d69
--- /dev/null
+++ b/app/Actions/Network/DispatchNetworkServerSync.php
@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkServerStatus;
+use App\Jobs\Network\SyncNetworkServerJob;
+use App\Models\Network;
+use App\Models\NetworkServer;
+use Illuminate\Support\Facades\DB;
+
+class DispatchNetworkServerSync
+{
+    /**
+     * Re-push the current configuration to every already-provisioned member.
+     * Used when peer/topology data changes and existing members must rewrite
+     * their WireGuard config and firewall rules.
+     */
+    public function resyncMembers(Network $network, ?int $excludeMemberId = null): void
+    {
+        $network->load('servers.server');
+
+        foreach ($network->servers as $member) {
+            if ($member->id !== $excludeMemberId
+                && in_array($member->status, [NetworkServerStatus::ACTIVE, NetworkServerStatus::UPDATING], true)) {
+                $this->toPresent($member);
+            }
+        }
+    }
+
+    public function toPresent(NetworkServer $member): void
+    {
+        if ($member->server->isReady()) {
+            $member->status = NetworkServerStatus::UPDATING;
+            $member->save();
+            DB::afterCommit(fn () => dispatch(new SyncNetworkServerJob($member))->onQueue('ssh'));
+
+            return;
+        }
+
+        $member->status = NetworkServerStatus::PENDING;
+        $member->save();
+    }
+
+    public function teardown(NetworkServer $member): void
+    {
+        $member->status = NetworkServerStatus::LEAVING;
+        $member->sync_attempts = 0;
+        $member->save();
+
+        DB::afterCommit(fn () => dispatch(new SyncNetworkServerJob($member, true))->onQueue('ssh'));
+    }
+}
diff --git a/app/Actions/Network/FinalizeServerNetworkRules.php b/app/Actions/Network/FinalizeServerNetworkRules.php
new file mode 100644
index 000000000..8994d5eed
--- /dev/null
+++ b/app/Actions/Network/FinalizeServerNetworkRules.php
@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\DTOs\SocketEventDTO;
+use App\Enums\FirewallRuleStatus;
+use App\Events\SocketEvent;
+use App\Models\Server;
+use App\Models\ServerNetworkRule;
+use Illuminate\Support\Facades\DB;
+
+class FinalizeServerNetworkRules
+{
+    /**
+     * The full ruleset was pushed successfully: the emitted rows are now live,
+     * and the rows that were dropped from the emit set are gone from the box.
+     *
+     * @param  array<int, int>  $emittedIds
+     * @param  array<int, int>  $deletingIds
+     */
+    public function success(Server $server, array $emittedIds, array $deletingIds): void
+    {
+        DB::transaction(function () use ($emittedIds, $deletingIds): void {
+            if ($emittedIds !== []) {
+                ServerNetworkRule::query()
+                    ->whereIn('id', $emittedIds)
+                    ->where('status', '!=', FirewallRuleStatus::READY)
+                    ->update(['status' => FirewallRuleStatus::READY]);
+            }
+
+            if ($deletingIds !== []) {
+                ServerNetworkRule::query()->whereIn('id', $deletingIds)->delete();
+            }
+        });
+
+        $this->broadcast($server);
+    }
+
+    /**
+     * @param  array<int, int>  $emittedIds
+     */
+    public function failure(Server $server, array $emittedIds): void
+    {
+        if ($emittedIds !== []) {
+            ServerNetworkRule::query()
+                ->whereIn('id', $emittedIds)
+                ->whereIn('status', [FirewallRuleStatus::CREATING, FirewallRuleStatus::UPDATING])
+                ->update(['status' => FirewallRuleStatus::FAILED]);
+        }
+
+        $this->broadcast($server);
+    }
+
+    private function broadcast(Server $server): void
+    {
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $server->project_id,
+            type: 'server-network-rule.updated',
+            data: ['server_id' => $server->id],
+        ));
+    }
+}
diff --git a/app/Actions/Network/GenerateWireGuardKeys.php b/app/Actions/Network/GenerateWireGuardKeys.php
new file mode 100644
index 000000000..49688810d
--- /dev/null
+++ b/app/Actions/Network/GenerateWireGuardKeys.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Actions\Network;
+
+class GenerateWireGuardKeys
+{
+    /**
+     * Generate a WireGuard (Curve25519) key pair, base64-encoded, matching
+     * `wg genkey` / `wg pubkey`: the private key is clamped and the public key
+     * is derived via X25519 base-point multiplication.
+     *
+     * @return array{private_key: string, public_key: string}
+     */
+    public function generate(): array
+    {
+        $private = random_bytes(32);
+        $private[0] = chr(ord($private[0]) & 248);
+        $private[31] = chr((ord($private[31]) & 127) | 64);
+
+        $public = sodium_crypto_scalarmult_base($private);
+
+        return [
+            'private_key' => base64_encode($private),
+            'public_key' => base64_encode($public),
+        ];
+    }
+}
diff --git a/app/Actions/Network/GetNetworkPeerConfig.php b/app/Actions/Network/GetNetworkPeerConfig.php
new file mode 100644
index 000000000..c5addc607
--- /dev/null
+++ b/app/Actions/Network/GetNetworkPeerConfig.php
@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkServerStatus;
+use App\Models\NetworkPeer;
+use App\Models\NetworkServer;
+use App\Support\Cidr;
+
+class GetNetworkPeerConfig
+{
+    private const PRIVATE_KEY_PLACEHOLDER = 'REPLACE_WITH_YOUR_PRIVATE_KEY';
+
+    /**
+     * The configuration is always available so it can be regenerated after the network's
+     * membership changes. The private key is returned separately and only while Vito still
+     * holds it — once concealed, the config renders a placeholder in its place.
+     *
+     * @return array{config: string, private_key: ?string}
+     */
+    public function config(NetworkPeer $peer): array
+    {
+        $hasKey = $peer->hasPrivateKey();
+
+        $config = view('wireguard.peer-conf', [
+            'address' => $peer->ip,
+            'prefix' => Cidr::hostPrefix($peer->ip),
+            'privateKey' => $hasKey ? $peer->private_key : self::PRIVATE_KEY_PLACEHOLDER,
+            'peers' => $this->peers($peer),
+        ])->render();
+
+        return [
+            'config' => $config,
+            'private_key' => $hasKey ? $peer->private_key : null,
+        ];
+    }
+
+    /**
+     * The first member carries the whole network range as its `AllowedIPs` so the device routes
+     * the subnet through it, and the rest carry only their own host address. That makes the
+     * order load-bearing: without a deterministic one, regenerating a config could silently
+     * move which server the device routes through.
+     *
+     * @return array<int, array{public_key: string, allowed_ips: string, endpoint: string}>
+     */
+    private function peers(NetworkPeer $peer): array
+    {
+        $network = $peer->network;
+
+        $members = $network->servers()
+            ->where('status', '!=', NetworkServerStatus::LEAVING)
+            ->whereNotNull('public_key')
+            ->whereNotNull('ip')
+            ->with('server')
+            ->orderBy('id')
+            ->get()
+            ->filter(fn (NetworkServer $member): bool => Cidr::isValidAddress((string) $member->server->ip))
+            ->values();
+
+        return $members
+            ->map(fn (NetworkServer $member, int $index): array => [
+                'public_key' => (string) $member->public_key,
+                'allowed_ips' => $index === 0
+                    ? (string) $network->cidr
+                    : $member->ip.'/'.Cidr::hostPrefix((string) $member->ip),
+                'endpoint' => Cidr::endpoint((string) $member->server->ip, (int) $network->port),
+            ])
+            ->all();
+    }
+}
diff --git a/app/Actions/Network/ManageNetworkFirewallRule.php b/app/Actions/Network/ManageNetworkFirewallRule.php
new file mode 100644
index 000000000..45fb6490a
--- /dev/null
+++ b/app/Actions/Network/ManageNetworkFirewallRule.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\DTOs\SocketEventDTO;
+use App\Enums\FirewallRuleStatus;
+use App\Events\SocketEvent;
+use App\Http\Resources\NetworkFirewallRuleResource;
+use App\Models\Network;
+use App\Models\NetworkFirewallRule;
+use App\ValidationRules\PortOrPortRangeRule;
+use Illuminate\Support\Facades\Validator;
+
+class ManageNetworkFirewallRule
+{
+    public function __construct(private ApplyNetworkFirewall $apply) {}
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    public function create(Network $network, array $input): NetworkFirewallRule
+    {
+        $this->validate($input);
+
+        $rule = $network->firewallRules()->create($this->attributes($input));
+
+        $this->broadcast($network, 'network-firewall-rule.updated', new NetworkFirewallRuleResource($rule));
+        $this->apply->handle($network);
+
+        return $rule;
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    public function update(NetworkFirewallRule $rule, array $input): NetworkFirewallRule
+    {
+        $this->validate($input);
+
+        $rule->update($this->attributes($input));
+
+        $this->broadcast($rule->network, 'network-firewall-rule.updated', new NetworkFirewallRuleResource($rule));
+        $this->apply->handle($rule->network);
+
+        return $rule;
+    }
+
+    public function delete(NetworkFirewallRule $rule): void
+    {
+        $network = $rule->network;
+        $ruleId = $rule->id;
+        $rule->delete();
+
+        $this->broadcast($network, 'network-firewall-rule.deleted', ['id' => $ruleId]);
+        $this->apply->handle($network);
+    }
+
+    /**
+     * @param  array<string, mixed>|NetworkFirewallRuleResource  $data
+     */
+    private function broadcast(Network $network, string $type, array|NetworkFirewallRuleResource $data): void
+    {
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $network->project_id,
+            type: $type,
+            data: $data,
+        ));
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     * @return array<string, mixed>
+     */
+    private function attributes(array $input): array
+    {
+        $port = $input['port'] ?? null;
+
+        return [
+            'name' => $input['name'],
+            'protocol' => $input['protocol'] ?? null,
+            'port' => ($port === null || $port === '') ? null : (string) $port,
+            'status' => FirewallRuleStatus::READY,
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    private function validate(array $input): void
+    {
+        $port = $input['port'] ?? null;
+        $isRange = is_string($port) && str_contains($port, ':');
+
+        Validator::make($input, [
+            'name' => ['required', 'string', 'max:255'],
+            'protocol' => [$isRange ? 'required' : 'nullable', 'in:tcp,udp'],
+            'port' => ['nullable', new PortOrPortRangeRule],
+        ], [
+            'protocol.required' => __('A protocol is required when the port is a range, because ufw rejects a multi-port rule without one.'),
+        ])->validate();
+    }
+}
diff --git a/app/Actions/Network/MaterializeServerNetworkRules.php b/app/Actions/Network/MaterializeServerNetworkRules.php
new file mode 100644
index 000000000..3a6100b87
--- /dev/null
+++ b/app/Actions/Network/MaterializeServerNetworkRules.php
@@ -0,0 +1,294 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\DTOs\SocketEventDTO;
+use App\Enums\FirewallRuleStatus;
+use App\Enums\NetworkPeerStatus;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkType;
+use App\Enums\ServerNetworkRuleKind;
+use App\Events\SocketEvent;
+use App\Models\Network;
+use App\Models\NetworkFirewallRule;
+use App\Models\NetworkServer;
+use App\Models\Server;
+use App\Models\ServerNetworkRule;
+use App\Models\Service;
+use App\Support\Cidr;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+
+class MaterializeServerNetworkRules
+{
+    /** @var array<int, Collection<int, NetworkServer>> */
+    private array $peerCache = [];
+
+    /** @var array<int, Collection<int, NetworkFirewallRule>> */
+    private array $ruleCache = [];
+
+    /** @var array<int, bool> */
+    private array $deviceCache = [];
+
+    /**
+     * Re-materialise every non-LEAVING member's server. A topology change on the
+     * network (membership, IP, keys) affects the handshake/source rows on all peers.
+     */
+    public function forNetwork(Network $network): void
+    {
+        $network->servers()
+            ->where('status', '!=', NetworkServerStatus::LEAVING)
+            ->with('server')
+            ->get()
+            ->each(fn (NetworkServer $member) => $this->forServer($member->server));
+    }
+
+    /**
+     * Reconcile the materialised network-rule rows for a single server against the
+     * desired set derived from its current memberships.
+     */
+    public function forServer(Server $server): void
+    {
+        $desired = $this->desiredFor($server);
+        $applied = $server->firewall() instanceof Service;
+
+        $changed = DB::transaction(function () use ($server, $desired, $applied): bool {
+            $existing = $server->networkRules()->get()->keyBy(fn (ServerNetworkRule $row): string => $this->identity(
+                $row->network_server_id,
+                $row->kind,
+                $row->network_firewall_rule_id,
+                $row->source,
+                $row->mask,
+            ));
+
+            $changed = false;
+
+            foreach ($desired as $key => $spec) {
+                /** @var ?ServerNetworkRule $row */
+                $row = $existing->get($key);
+
+                if (! $row instanceof ServerNetworkRule) {
+                    $server->networkRules()->create([
+                        ...$spec,
+                        'status' => $applied ? FirewallRuleStatus::CREATING : FirewallRuleStatus::READY,
+                    ]);
+                    $changed = true;
+
+                    continue;
+                }
+
+                if ($row->name !== $spec['name']
+                    || $row->type !== $spec['type']
+                    || $row->protocol !== $spec['protocol']
+                    || $row->port !== $spec['port']) {
+                    $row->fill([
+                        'name' => $spec['name'],
+                        'type' => $spec['type'],
+                        'protocol' => $spec['protocol'],
+                        'port' => $spec['port'],
+                        'status' => $applied ? FirewallRuleStatus::UPDATING : FirewallRuleStatus::READY,
+                    ])->save();
+                    $changed = true;
+
+                    continue;
+                }
+
+                if ($row->status === FirewallRuleStatus::DELETING) {
+                    $row->status = $applied ? FirewallRuleStatus::CREATING : FirewallRuleStatus::READY;
+                    $row->save();
+                    $changed = true;
+                }
+            }
+
+            foreach ($existing as $key => $row) {
+                if (isset($desired[$key])) {
+                    continue;
+                }
+
+                if (! $applied || $row->status === FirewallRuleStatus::CREATING) {
+                    $row->delete();
+                } else {
+                    $row->status = FirewallRuleStatus::DELETING;
+                    $row->save();
+                }
+                $changed = true;
+            }
+
+            return $changed;
+        });
+
+        if ($changed) {
+            $this->broadcast($server);
+        }
+    }
+
+    /**
+     * @return array<string, array<string, mixed>>
+     */
+    private function desiredFor(Server $server): array
+    {
+        $memberships = NetworkServer::query()
+            ->where('server_id', $server->id)
+            ->where('status', '!=', NetworkServerStatus::LEAVING)
+            ->with('network')
+            ->get();
+
+        $this->peerCache = [];
+        $this->ruleCache = [];
+        $this->deviceCache = [];
+
+        $desired = [];
+
+        foreach ($memberships as $membership) {
+            $network = $membership->network;
+
+            if ($network->type === NetworkType::WIREGUARD) {
+                foreach ($this->handshakes($network, $server) as $handshake) {
+                    $mask = Cidr::hostPrefix($handshake['ip']);
+                    $spec = [
+                        'network_id' => $network->id,
+                        'network_server_id' => $membership->id,
+                        'network_firewall_rule_id' => null,
+                        'kind' => ServerNetworkRuleKind::HANDSHAKE,
+                        'name' => 'WireGuard handshake ('.$handshake['name'].')',
+                        'type' => 'allow',
+                        'protocol' => 'udp',
+                        'port' => (string) $network->port,
+                        'source' => $handshake['ip'],
+                        'mask' => $mask,
+                    ];
+                    $desired[$this->identity($membership->id, ServerNetworkRuleKind::HANDSHAKE, null, $handshake['ip'], $mask)] = $spec;
+                }
+
+                if ($this->hasDevices($network)) {
+                    $desired[$this->identity($membership->id, ServerNetworkRuleKind::HANDSHAKE, null, null, null)] = [
+                        'network_id' => $network->id,
+                        'network_server_id' => $membership->id,
+                        'network_firewall_rule_id' => null,
+                        'kind' => ServerNetworkRuleKind::HANDSHAKE,
+                        'name' => 'WireGuard handshake (devices)',
+                        'type' => 'allow',
+                        'protocol' => 'udp',
+                        'port' => (string) $network->port,
+                        'source' => null,
+                        'mask' => null,
+                    ];
+                }
+            }
+
+            $sources = $this->sources($network, $server);
+
+            foreach ($this->firewallRules($network) as $rule) {
+                foreach ($sources as $source) {
+                    $spec = [
+                        'network_id' => $network->id,
+                        'network_server_id' => $membership->id,
+                        'network_firewall_rule_id' => $rule->id,
+                        'kind' => ServerNetworkRuleKind::RULE,
+                        'name' => $rule->name,
+                        'type' => 'allow',
+                        'protocol' => $rule->protocol,
+                        'port' => $rule->port,
+                        'source' => $source['ip'],
+                        'mask' => $source['mask'],
+                    ];
+                    $desired[$this->identity($membership->id, ServerNetworkRuleKind::RULE, $rule->id, $source['ip'], $source['mask'])] = $spec;
+                }
+            }
+        }
+
+        return $desired;
+    }
+
+    /**
+     * Sources are interpolated unquoted into the `ufw` blade template, which is a shell
+     * script — Blade escapes HTML, not shell metacharacters. Every address is re-checked
+     * here so nothing but a literal IP can reach it, whatever wrote the column.
+     *
+     * @return array<int, array{ip: string, name: string}>
+     */
+    private function handshakes(Network $network, Server $server): array
+    {
+        return $this->peers($network, $server)
+            ->filter(fn (NetworkServer $peer): bool => Cidr::isValidAddress((string) $peer->server->ip))
+            ->map(fn (NetworkServer $peer): array => ['ip' => (string) $peer->server->ip, 'name' => $peer->server->name])
+            ->values()
+            ->all();
+    }
+
+    /**
+     * @return array<int, array{ip: string, mask: int}>
+     */
+    private function sources(Network $network, Server $server): array
+    {
+        if ($network->type !== NetworkType::PROVIDER && $network->cidr !== null && $network->cidr !== '') {
+            if (! Cidr::isValid($network->cidr)) {
+                return [];
+            }
+
+            return [[
+                'ip' => Cidr::network($network->cidr),
+                'mask' => Cidr::prefix($network->cidr),
+            ]];
+        }
+
+        $sources = [];
+
+        foreach ($this->peers($network, $server) as $peer) {
+            $ip = $peer->server_ip_address_id !== null ? $peer->serverIpAddress?->ip : $peer->ip;
+
+            if ($ip === null || ! Cidr::isValidAddress($ip)) {
+                continue;
+            }
+
+            $sources[] = ['ip' => $ip, 'mask' => Cidr::hostPrefix($ip)];
+        }
+
+        return $sources;
+    }
+
+    /**
+     * @return Collection<int, NetworkServer>
+     */
+    private function peers(Network $network, Server $server): Collection
+    {
+        return $this->peerCache[$network->id] ??= NetworkServer::query()
+            ->where('network_id', $network->id)
+            ->where('server_id', '!=', $server->id)
+            ->where('status', '!=', NetworkServerStatus::LEAVING)
+            ->with('server', 'serverIpAddress')
+            ->get();
+    }
+
+    /**
+     * @return Collection<int, NetworkFirewallRule>
+     */
+    private function firewallRules(Network $network): Collection
+    {
+        return $this->ruleCache[$network->id] ??= $network->firewallRules()
+            ->where('status', '!=', FirewallRuleStatus::DELETING)
+            ->orderBy('id')
+            ->get();
+    }
+
+    private function hasDevices(Network $network): bool
+    {
+        return $this->deviceCache[$network->id] ??= $network->peers()
+            ->where('status', '!=', NetworkPeerStatus::DISABLED)
+            ->exists();
+    }
+
+    private function identity(int $networkServerId, ServerNetworkRuleKind $kind, ?int $ruleId, ?string $source, ?int $mask): string
+    {
+        return implode('|', [$networkServerId, $kind->value, $ruleId ?? '', $source ?? '', $mask ?? '']);
+    }
+
+    private function broadcast(Server $server): void
+    {
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $server->project_id,
+            type: 'server-network-rule.updated',
+            data: ['server_id' => $server->id],
+        ));
+    }
+}
diff --git a/app/Actions/Network/RecomputeNetworkStatus.php b/app/Actions/Network/RecomputeNetworkStatus.php
new file mode 100644
index 000000000..21ad4d7e7
--- /dev/null
+++ b/app/Actions/Network/RecomputeNetworkStatus.php
@@ -0,0 +1,108 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\DTOs\SocketEventDTO;
+use App\Enums\NetworkPeerStatus;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkStatus;
+use App\Events\SocketEvent;
+use App\Http\Resources\NetworkPeerResource;
+use App\Http\Resources\NetworkResource;
+use App\Models\Network;
+use App\Models\NetworkPeer;
+
+class RecomputeNetworkStatus
+{
+    public function handle(Network $network): void
+    {
+        $network = $network->fresh();
+
+        if (! $network instanceof Network) {
+            return;
+        }
+
+        if ($network->status === NetworkStatus::DELETING) {
+            if ($network->servers()->count() === 0) {
+                $projectId = $network->project_id;
+                $id = $network->id;
+                $network->delete();
+
+                SocketEvent::dispatch(new SocketEventDTO(
+                    projectId: $projectId,
+                    type: 'network.deleted',
+                    data: ['id' => $id],
+                ));
+            }
+
+            return;
+        }
+
+        $statuses = $network->servers()->pluck('status');
+
+        $computed = match (true) {
+            $statuses->isEmpty() => NetworkStatus::CREATING,
+            $statuses->contains(NetworkServerStatus::FAILED) => NetworkStatus::FAILED,
+            $statuses->contains(NetworkServerStatus::PENDING),
+            $statuses->contains(NetworkServerStatus::UPDATING),
+            $statuses->contains(NetworkServerStatus::LEAVING) => NetworkStatus::SYNCING,
+            default => NetworkStatus::ACTIVE,
+        };
+
+        if ($network->status !== $computed) {
+            $network->status = $computed;
+            $network->save();
+        }
+
+        if ($computed === NetworkStatus::ACTIVE) {
+            $this->activatePendingPeers($network);
+        }
+
+        if ($computed === NetworkStatus::CREATING) {
+            $this->holdActivePeers($network);
+        }
+
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $network->project_id,
+            type: 'network.updated',
+            data: new NetworkResource($network->load('serverProvider')->loadCount('servers')),
+        ));
+    }
+
+    /**
+     * No member is left to hold the peer's key, so it is not connected to anything. It waits
+     * for a server to join rather than reporting itself active against an empty network.
+     */
+    private function holdActivePeers(Network $network): void
+    {
+        $network->peers()
+            ->where('status', NetworkPeerStatus::ACTIVE)
+            ->get()
+            ->each(function (NetworkPeer $peer) use ($network): void {
+                $peer->status = NetworkPeerStatus::PENDING;
+                $peer->save();
+
+                SocketEvent::dispatch(new SocketEventDTO(
+                    projectId: $network->project_id,
+                    type: 'network-peer.updated',
+                    data: new NetworkPeerResource($peer),
+                ));
+            });
+    }
+
+    private function activatePendingPeers(Network $network): void
+    {
+        $peers = $network->peers()->where('status', NetworkPeerStatus::PENDING)->get();
+
+        foreach ($peers as $peer) {
+            $peer->status = NetworkPeerStatus::ACTIVE;
+            $peer->save();
+
+            SocketEvent::dispatch(new SocketEventDTO(
+                projectId: $network->project_id,
+                type: 'network-peer.updated',
+                data: new NetworkPeerResource($peer),
+            ));
+        }
+    }
+}
diff --git a/app/Actions/Network/RegenerateNetworkPeerKeys.php b/app/Actions/Network/RegenerateNetworkPeerKeys.php
new file mode 100644
index 000000000..130775e26
--- /dev/null
+++ b/app/Actions/Network/RegenerateNetworkPeerKeys.php
@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\DTOs\SocketEventDTO;
+use App\Enums\NetworkPeerStatus;
+use App\Events\SocketEvent;
+use App\Http\Resources\NetworkPeerResource;
+use App\Models\NetworkPeer;
+use App\ValidationRules\WireGuardPublicKeyRule;
+use Illuminate\Support\Facades\Validator;
+
+class RegenerateNetworkPeerKeys
+{
+    public function __construct(
+        private GenerateWireGuardKeys $keys,
+        private DispatchNetworkServerSync $sync,
+        private RecomputeNetworkStatus $recompute,
+    ) {}
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    public function regenerate(NetworkPeer $peer, array $input): void
+    {
+        $network = $peer->network;
+
+        Validator::make($input, [
+            'public_key' => ['nullable', 'string', new WireGuardPublicKeyRule($network, $peer->id)],
+        ])->validate();
+
+        $publicKey = $input['public_key'] ?? null;
+
+        if (is_string($publicKey) && $publicKey !== '') {
+            $peer->fill(['public_key' => $publicKey, 'private_key' => null, 'byo' => true]);
+        } else {
+            $keys = $this->keys->generate();
+            $peer->fill(['public_key' => $keys['public_key'], 'private_key' => $keys['private_key'], 'byo' => false]);
+        }
+
+        $peer->status = NetworkPeerStatus::PENDING;
+        $peer->last_handshake_at = null;
+        $peer->save();
+
+        $this->sync->resyncMembers($network);
+        $this->recompute->handle($network);
+
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $network->project_id,
+            type: 'network-peer.updated',
+            data: new NetworkPeerResource($peer),
+        ));
+    }
+}
diff --git a/app/Actions/Network/RemoveMembershipsForAddress.php b/app/Actions/Network/RemoveMembershipsForAddress.php
new file mode 100644
index 000000000..998363d68
--- /dev/null
+++ b/app/Actions/Network/RemoveMembershipsForAddress.php
@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkType;
+use App\Models\NetworkServer;
+use App\Models\ServerIpAddress;
+use Illuminate\Support\Facades\DB;
+
+class RemoveMembershipsForAddress
+{
+    public function __construct(private RemoveServerFromNetwork $remove) {}
+
+    /**
+     * Custom networks a server joined with this address, collected before it is deleted. The
+     * membership's foreign key is nullOnDelete, so afterwards nothing records which address the
+     * membership announced.
+     *
+     * @return array<int, int>
+     */
+    public function capture(ServerIpAddress $address): array
+    {
+        return NetworkServer::query()
+            ->where('server_ip_address_id', $address->id)
+            ->whereHas('network', fn ($query) => $query->where('type', NetworkType::CUSTOM))
+            ->pluck('network_id')
+            ->unique()
+            ->values()
+            ->all();
+    }
+
+    /**
+     * A custom membership is addressed solely by that row, so losing the address leaves it with
+     * nothing to announce — it is removed rather than re-applied with an incomplete source.
+     *
+     * @param  array<int, int>  $networkIds
+     */
+    public function handle(int $serverId, array $networkIds): void
+    {
+        if ($networkIds === []) {
+            return;
+        }
+
+        DB::afterCommit(function () use ($serverId, $networkIds): void {
+            NetworkServer::query()
+                ->whereIn('network_id', $networkIds)
+                ->where('server_id', $serverId)
+                ->get()
+                ->each(fn (NetworkServer $member) => $this->remove->remove($member));
+        });
+    }
+}
diff --git a/app/Actions/Network/RemoveServerFromNetwork.php b/app/Actions/Network/RemoveServerFromNetwork.php
new file mode 100644
index 000000000..99a5fbdd9
--- /dev/null
+++ b/app/Actions/Network/RemoveServerFromNetwork.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkType;
+use App\Models\NetworkServer;
+
+class RemoveServerFromNetwork
+{
+    public function __construct(
+        private DispatchNetworkServerSync $sync,
+        private RecomputeNetworkStatus $recompute,
+        private ApplyNetworkFirewall $firewall,
+    ) {}
+
+    public function remove(NetworkServer $member): void
+    {
+        $network = $member->network;
+
+        $this->sync->teardown($member);
+
+        if ($network->type === NetworkType::WIREGUARD) {
+            $this->sync->resyncMembers($network, $member->id);
+        } else {
+            $this->firewall->handle($network);
+        }
+
+        $this->recompute->handle($network);
+    }
+}
diff --git a/app/Actions/Network/ResyncNetworkSiblings.php b/app/Actions/Network/ResyncNetworkSiblings.php
new file mode 100644
index 000000000..db06c48b9
--- /dev/null
+++ b/app/Actions/Network/ResyncNetworkSiblings.php
@@ -0,0 +1,75 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkServerStatus;
+use App\Models\Network;
+use App\Models\NetworkServer;
+use App\Models\Server;
+use Illuminate\Support\Facades\DB;
+
+class ResyncNetworkSiblings
+{
+    public function __construct(
+        private DispatchNetworkServerSync $sync,
+        private RecomputeNetworkStatus $recompute,
+    ) {}
+
+    /**
+     * The networks a server belongs to, and their other members, collected before its membership
+     * rows cascade away. Every network type needs the siblings, not just WireGuard: a network
+     * without a CIDR — and every provider network — derives per-member host rules, so the
+     * remaining members keep an allow rule for a departed server's address until they
+     * re-materialise, and that address can later be reassigned to an unrelated host.
+     *
+     * The network ids are kept separately because a network losing its last member has no
+     * sibling to recompute its status as a side effect.
+     *
+     * @return array{members: array<int, int>, networks: array<int, int>}
+     */
+    public function capture(Server $server): array
+    {
+        $networkIds = NetworkServer::query()
+            ->where('server_id', $server->id)
+            ->pluck('network_id')
+            ->unique()
+            ->values()
+            ->all();
+
+        $memberIds = NetworkServer::query()
+            ->whereIn('network_id', $networkIds)
+            ->where('server_id', '!=', $server->id)
+            ->where('status', '!=', NetworkServerStatus::LEAVING)
+            ->pluck('id')
+            ->all();
+
+        return ['members' => $memberIds, 'networks' => $networkIds];
+    }
+
+    /**
+     * Deferred to after commit so the members are rewritten, and the statuses computed, against
+     * the topology that survives the deletion rather than the one still inside the transaction.
+     *
+     * @param  array{members: array<int, int>, networks: array<int, int>}  $departure
+     */
+    public function handle(array $departure): void
+    {
+        if ($departure['networks'] === []) {
+            return;
+        }
+
+        DB::afterCommit(function () use ($departure): void {
+            NetworkServer::query()
+                ->whereIn('id', $departure['members'])
+                ->where('status', '!=', NetworkServerStatus::LEAVING)
+                ->with('server', 'network')
+                ->get()
+                ->each(fn (NetworkServer $member) => $this->sync->toPresent($member));
+
+            Network::query()
+                ->whereIn('id', $departure['networks'])
+                ->get()
+                ->each(fn (Network $network) => $this->recompute->handle($network));
+        });
+    }
+}
diff --git a/app/Actions/Network/ResyncServerEndpoint.php b/app/Actions/Network/ResyncServerEndpoint.php
new file mode 100644
index 000000000..1794067bb
--- /dev/null
+++ b/app/Actions/Network/ResyncServerEndpoint.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkType;
+use App\Models\NetworkServer;
+use App\Models\Server;
+
+class ResyncServerEndpoint
+{
+    public function __construct(private DispatchNetworkServerSync $sync) {}
+
+    /**
+     * The server's public address feeds every peer's WireGuard endpoint and handshake firewall
+     * rule, so a change to it has to be pushed to the other members of each of its WireGuard
+     * networks — otherwise they keep dialling the old address.
+     */
+    public function handle(Server $server): void
+    {
+        NetworkServer::query()
+            ->where('server_id', $server->id)
+            ->where('status', '!=', NetworkServerStatus::LEAVING)
+            ->whereHas('network', fn ($query) => $query->where('type', NetworkType::WIREGUARD))
+            ->with('network')
+            ->get()
+            ->each(fn (NetworkServer $membership) => $this->sync->resyncMembers($membership->network, $membership->id));
+    }
+}
diff --git a/app/Actions/Network/SyncNetwork.php b/app/Actions/Network/SyncNetwork.php
new file mode 100644
index 000000000..ca0f6fc8a
--- /dev/null
+++ b/app/Actions/Network/SyncNetwork.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkType;
+use App\Jobs\Network\SyncProviderNetworksJob;
+use App\Models\Network;
+use App\Models\NetworkServer;
+
+class SyncNetwork
+{
+    public function __construct(
+        private DispatchNetworkServerSync $sync,
+        private RecomputeNetworkStatus $recompute,
+    ) {}
+
+    public function network(Network $network): void
+    {
+        if ($network->type === NetworkType::PROVIDER) {
+            SyncProviderNetworksJob::dispatchUnlessRecent($network->project, $network);
+
+            return;
+        }
+
+        $network->load('servers.server');
+        foreach ($network->servers as $member) {
+            if ($member->status !== NetworkServerStatus::LEAVING) {
+                $member->sync_attempts = 0;
+                $member->save();
+                $this->sync->toPresent($member);
+            }
+        }
+
+        $this->recompute->handle($network);
+    }
+
+    public function member(NetworkServer $member): void
+    {
+        if ($member->status === NetworkServerStatus::LEAVING) {
+            return;
+        }
+
+        $member->sync_attempts = 0;
+        $member->save();
+        $this->sync->toPresent($member);
+        $this->recompute->handle($member->network);
+    }
+}
diff --git a/app/Actions/Network/SyncProviderNetworks.php b/app/Actions/Network/SyncProviderNetworks.php
new file mode 100644
index 000000000..ea44e0ec3
--- /dev/null
+++ b/app/Actions/Network/SyncProviderNetworks.php
@@ -0,0 +1,462 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\DTOs\PrivateNetworkDTO;
+use App\Enums\FirewallRuleStatus;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkStatus;
+use App\Enums\NetworkType;
+use App\Exceptions\PrivateNetworkPersistError;
+use App\Exceptions\PrivateNetworkSyncError;
+use App\Models\Network;
+use App\Models\NetworkServer;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\ServerProvider;
+use App\ServerProviders\ProvidesPrivateNetworks;
+use Illuminate\Database\QueryException;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+
+class SyncProviderNetworks
+{
+    public function __construct(
+        private ApplyNetworkFirewall $firewall,
+        private RecomputeNetworkStatus $recompute,
+        private RemoveServerFromNetwork $remove,
+        private DeleteNetwork $delete,
+    ) {}
+
+    /**
+     * A discovered network is recorded as seen before it is reconciled, so that a network the
+     * provider reported is never pruned just because persisting it failed.
+     *
+     * One connection's failure must not suppress pruning for the others, so failures are
+     * collected and rethrown once every healthy connection has been processed — the caller
+     * still sees the error instead of a silent success. A network that could not be written
+     * is counted the same way, so a partial sweep never reports success either.
+     *
+     * @throws PrivateNetworkSyncError|PrivateNetworkPersistError
+     */
+    public function forProject(Project $project, ?Network $only = null): void
+    {
+        if ($only instanceof Network && $only->project_id !== $project->id) {
+            return;
+        }
+
+        $failure = null;
+        $persistFailures = 0;
+
+        foreach ($this->connections($project, $only) as $context) {
+            $connection = $context['connection'];
+
+            $asked = $context['servers'] !== []
+                && $context['provider']->canDiscoverPrivateNetworks($context['regions'], $context['serversWithoutRegion']);
+
+            try {
+                $discovered = $asked
+                    ? $context['provider']->privateNetworks(
+                        array_map('strval', array_keys($context['servers'])),
+                        $context['regions'],
+                    )
+                    : [];
+            } catch (PrivateNetworkSyncError $e) {
+                $this->logFailure($e);
+                $failure ??= $e;
+
+                continue;
+            }
+
+            $seen = [];
+
+            foreach ($discovered as $dto) {
+                if ($only instanceof Network && $dto->externalId !== $only->external_id) {
+                    continue;
+                }
+
+                $seen[] = $dto->externalId;
+
+                if (! $this->reconcile($project, $connection, $dto, $context['servers'])) {
+                    $persistFailures++;
+                }
+            }
+
+            $this->prune($project, $connection, $seen, $only, $asked);
+        }
+
+        if ($failure instanceof PrivateNetworkSyncError) {
+            throw $failure;
+        }
+
+        if ($persistFailures > 0) {
+            throw new PrivateNetworkPersistError($project->id, $persistFailures);
+        }
+    }
+
+    /**
+     * Discovered networks are upserted on (project, connection, external id). A per-network DB
+     * failure is logged and skipped rather than propagated, so it never counts as a connection
+     * failure — that would wrongly suppress pruning for every other network on the connection.
+     *
+     * @param  array<string, Server>  $servers
+     * @return bool whether the network was persisted; the caller fails the sweep at the end
+     */
+    private function reconcile(Project $project, ServerProvider $connection, PrivateNetworkDTO $dto, array $servers): bool
+    {
+        try {
+            $network = DB::transaction(function () use ($project, $connection, $dto, $servers): Network {
+                $network = $this->upsert($project, $connection, $dto);
+
+                $this->reconcileMembers($network, $dto, $servers);
+
+                return $network;
+            });
+        } catch (QueryException $e) {
+            Log::warning('Could not reconcile provider network.', [
+                'project_id' => $project->id,
+                'server_provider_id' => $connection->id,
+                'external_id' => $dto->externalId,
+                'reason' => $e->getCode(),
+            ]);
+
+            return false;
+        }
+
+        $this->firewall->handle($network);
+        $this->recompute->handle($network);
+
+        return true;
+    }
+
+    private function upsert(Project $project, ServerProvider $connection, PrivateNetworkDTO $dto): Network
+    {
+        /** @var ?Network $network */
+        $network = $project->networks()
+            ->where('server_provider_id', $connection->id)
+            ->where('external_id', $dto->externalId)
+            ->lockForUpdate()
+            ->first();
+
+        if (! $network instanceof Network) {
+            $network = new Network([
+                'project_id' => $project->id,
+                'name' => $this->uniqueName($project, $dto->name),
+                'type' => NetworkType::PROVIDER,
+                'status' => NetworkStatus::SYNCING,
+                'cidr' => $dto->cidr,
+                'cidr_canonical' => $dto->cidr,
+                'region' => $dto->region,
+            ]);
+
+            $network->server_provider_id = $connection->id;
+            $network->external_id = $dto->externalId;
+            $network->last_synced_at = now();
+            $network->save();
+
+            $network->firewallRules()->create([
+                'name' => 'Allow all',
+                'protocol' => null,
+                'port' => null,
+                'status' => FirewallRuleStatus::READY,
+            ]);
+
+            return $network;
+        }
+
+        $this->resurrect($network);
+
+        $network->cidr = $dto->cidr;
+        $network->cidr_canonical = $dto->cidr;
+        $network->region = $dto->region;
+        $network->last_synced_at = now();
+        $network->save();
+
+        return $network;
+    }
+
+    /**
+     * A network pruned on an earlier run can legitimately reappear — a transient omission
+     * from the provider, or a region that failed and then recovered. `RecomputeNetworkStatus`
+     * returns early for DELETING networks without recomputing, and only hard-deletes at zero
+     * members, so a resurrected network would otherwise stay DELETING forever with members
+     * that never converge, and D2 blocks the user from deleting it.
+     */
+    private function resurrect(Network $network): void
+    {
+        if ($network->status !== NetworkStatus::DELETING) {
+            return;
+        }
+
+        $network->status = NetworkStatus::SYNCING;
+        $network->save();
+
+        $network->servers()
+            ->where('status', NetworkServerStatus::LEAVING)
+            ->update(['status' => NetworkServerStatus::PENDING, 'sync_attempts' => 0]);
+    }
+
+    /**
+     * Membership is a fact reported by the provider, so members start ACTIVE — there is no
+     * on-server provisioning beyond firewall rules. `ApplyNetworkFirewall` downgrades a member
+     * to PENDING when its server is unreachable, and the reconciler drives it back up.
+     *
+     * Departure is keyed on array_key_exists rather than isset, because a member the provider
+     * reports without an address is present with a null value.
+     *
+     * @param  array<string, Server>  $servers
+     */
+    private function reconcileMembers(Network $network, PrivateNetworkDTO $dto, array $servers): void
+    {
+        /** @var Collection<int, NetworkServer> $existing */
+        $existing = $network->servers()->lockForUpdate()->get()->keyBy('server_id');
+
+        $desired = [];
+
+        foreach ($dto->members as $member) {
+            $server = $servers[$member->instanceId] ?? null;
+
+            if ($server instanceof Server) {
+                $desired[$server->id] = $member->ip;
+            }
+        }
+
+        $this->releaseChangedIps($existing, $desired);
+
+        foreach ($desired as $serverId => $ip) {
+            /** @var ?NetworkServer $member */
+            $member = $existing->get($serverId);
+
+            if (! $member instanceof NetworkServer) {
+                $network->servers()->create([
+                    'server_id' => $serverId,
+                    'ip' => $ip,
+                    'status' => NetworkServerStatus::ACTIVE,
+                ]);
+
+                continue;
+            }
+
+            $member->ip = $ip;
+
+            if ($member->status === NetworkServerStatus::LEAVING) {
+                $member->status = NetworkServerStatus::ACTIVE;
+                $member->sync_attempts = 0;
+            }
+
+            $member->save();
+        }
+
+        foreach ($existing as $member) {
+            if (array_key_exists($member->server_id, $desired)) {
+                continue;
+            }
+
+            if ($member->status === NetworkServerStatus::LEAVING) {
+                continue;
+            }
+
+            $this->remove->remove($member);
+        }
+    }
+
+    /**
+     * `network_servers` carries unique(network_id, ip). When a provider recycles an address
+     * onto a different instance within one run, writing the new owner before clearing the old
+     * one violates it, so changed addresses are released first.
+     *
+     * @param  Collection<int, NetworkServer>  $existing
+     * @param  array<int, ?string>  $desired
+     */
+    private function releaseChangedIps(Collection $existing, array $desired): void
+    {
+        foreach ($existing as $member) {
+            $target = $desired[$member->server_id] ?? null;
+
+            if ($member->ip !== null && $member->ip !== $target) {
+                $member->ip = null;
+                $member->save();
+            }
+        }
+    }
+
+    /**
+     * `$asked` is false when the connection had no instance ids to query, or when the provider
+     * could not be queried at all (an EC2 connection whose servers carry no region), so `$seen`
+     * being empty carries no information about what still exists at the provider. Only a network
+     * with no members left may be reaped in that case — anything else has to wait for a run
+     * that could actually ask.
+     *
+     * @param  array<int, string>  $seen
+     */
+    private function prune(Project $project, ServerProvider $connection, array $seen, ?Network $only, bool $asked): void
+    {
+        $project->networks()
+            ->where('type', NetworkType::PROVIDER)
+            ->where('server_provider_id', $connection->id)
+            ->where('status', '!=', NetworkStatus::DELETING)
+            ->when($only instanceof Network, fn ($query) => $query->whereKey($only?->id))
+            ->get()
+            ->each(function (Network $network) use ($seen, $asked): void {
+                if (! $asked) {
+                    if ($this->hasLiveMembers($network)) {
+                        return;
+                    }
+
+                    $this->delete->delete($network);
+
+                    return;
+                }
+
+                $stillPresent = in_array($network->external_id, $seen, true);
+
+                if ($stillPresent && $this->hasLiveMembers($network)) {
+                    return;
+                }
+
+                $this->delete->delete($network);
+            });
+    }
+
+    private function hasLiveMembers(Network $network): bool
+    {
+        return $network->servers()
+            ->where('status', '!=', NetworkServerStatus::LEAVING)
+            ->exists();
+    }
+
+    private function uniqueName(Project $project, string $name): string
+    {
+        $name = trim($name) !== '' ? trim($name) : 'network';
+        $candidate = $name;
+        $suffix = 2;
+
+        while ($project->networks()->where('name', $candidate)->exists()) {
+            $candidate = $name.'-'.$suffix;
+            $suffix++;
+        }
+
+        return $candidate;
+    }
+
+    /**
+     * @return array<int, array{connection: ServerProvider, provider: ProvidesPrivateNetworks, key: string, servers: array<string, Server>, regions: array<int, string>, serversWithoutRegion: int}>
+     */
+    private function connections(Project $project, ?Network $only): array
+    {
+        /** @var Collection<int, Server> $servers */
+        $servers = $project->servers()
+            ->whereNotNull('provider_id')
+            ->when(
+                $only instanceof Network,
+                fn ($query) => $query->where('provider_id', $only?->server_provider_id)
+            )
+            ->with('serverProvider')
+            ->get();
+
+        $contexts = [];
+
+        foreach ($servers as $server) {
+            $connection = $server->serverProvider;
+
+            if (! isset($contexts[$connection->id])) {
+                $provider = $connection->provider();
+
+                if (! $provider instanceof ProvidesPrivateNetworks) {
+                    continue;
+                }
+
+                $contexts[$connection->id] = [
+                    'connection' => $connection,
+                    'provider' => $provider,
+                    'key' => $provider->instanceIdKey(),
+                    'servers' => [],
+                    'regions' => [],
+                    'serversWithoutRegion' => 0,
+                ];
+            }
+
+            $instanceId = $server->provider_data[$contexts[$connection->id]['key']] ?? null;
+
+            if ($instanceId === null || $instanceId === '') {
+                continue;
+            }
+
+            $contexts[$connection->id]['servers'][(string) $instanceId] = $server;
+
+            $region = $server->provider_data['region'] ?? null;
+
+            if (! is_string($region) || $region === '') {
+                $contexts[$connection->id]['serversWithoutRegion']++;
+
+                continue;
+            }
+
+            if (! in_array($region, $contexts[$connection->id]['regions'], true)) {
+                $contexts[$connection->id]['regions'][] = $region;
+            }
+        }
+
+        foreach ($this->orphanedConnections($project, $only, array_keys($contexts)) as $connection) {
+            $provider = $connection->provider();
+
+            if (! $provider instanceof ProvidesPrivateNetworks) {
+                continue;
+            }
+
+            $contexts[$connection->id] = [
+                'connection' => $connection,
+                'provider' => $provider,
+                'key' => $provider->instanceIdKey(),
+                'servers' => [],
+                'regions' => [],
+                'serversWithoutRegion' => 0,
+            ];
+        }
+
+        return array_values($contexts);
+    }
+
+    /**
+     * A connection whose last managed server has been deleted still needs a pass. Its provider
+     * networks have no members left, so nothing can reconcile them, and because they are
+     * provider-managed the policy also refuses a manual delete — without this they would be
+     * stranded permanently. There is nothing to ask the provider in that case, so the context
+     * carries no servers and `forProject()` goes straight to pruning.
+     *
+     * @param  array<int, int>  $known
+     * @return Collection<int, ServerProvider>
+     */
+    private function orphanedConnections(Project $project, ?Network $only, array $known): Collection
+    {
+        $ids = $project->networks()
+            ->where('type', NetworkType::PROVIDER)
+            ->where('status', '!=', NetworkStatus::DELETING)
+            ->whereNotNull('server_provider_id')
+            ->when($only instanceof Network, fn ($query) => $query->whereKey($only?->id))
+            ->pluck('server_provider_id')
+            ->unique()
+            ->reject(fn (int $id): bool => in_array($id, $known, true))
+            ->values()
+            ->all();
+
+        if ($ids === []) {
+            return new Collection;
+        }
+
+        return ServerProvider::query()->whereIn('id', $ids)->get();
+    }
+
+    private function logFailure(PrivateNetworkSyncError $e): void
+    {
+        Log::warning('Provider private network sync failed.', [
+            'server_provider_id' => $e->serverProviderId,
+            'provider' => $e->provider,
+            'profile' => $e->profile,
+            'status' => $e->status,
+            'region' => $e->region,
+            'permission_error' => $e->isPermissionError(),
+        ]);
+    }
+}
diff --git a/app/Actions/Network/UpdateNetwork.php b/app/Actions/Network/UpdateNetwork.php
new file mode 100644
index 000000000..13c4899c3
--- /dev/null
+++ b/app/Actions/Network/UpdateNetwork.php
@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Models\Network;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+
+class UpdateNetwork
+{
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    public function update(Network $network, array $input): Network
+    {
+        $this->validate($network, $input);
+
+        $network->update([
+            'name' => $input['name'] ?? $network->name,
+        ]);
+
+        return $network->refresh();
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    private function validate(Network $network, array $input): void
+    {
+        Validator::make($input, [
+            'name' => [
+                'sometimes',
+                'required',
+                'string',
+                'max:255',
+                Rule::unique('networks', 'name')
+                    ->where('project_id', $network->project_id)
+                    ->ignore($network->id),
+            ],
+        ])->validate();
+    }
+}
diff --git a/app/Actions/Network/UpdateNetworkPeer.php b/app/Actions/Network/UpdateNetworkPeer.php
new file mode 100644
index 000000000..9c59e5b9c
--- /dev/null
+++ b/app/Actions/Network/UpdateNetworkPeer.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\DTOs\SocketEventDTO;
+use App\Enums\NetworkPeerStatus;
+use App\Events\SocketEvent;
+use App\Http\Resources\NetworkPeerResource;
+use App\Models\NetworkPeer;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+
+class UpdateNetworkPeer
+{
+    public function __construct(
+        private DispatchNetworkServerSync $sync,
+        private RecomputeNetworkStatus $recompute,
+    ) {}
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    public function update(NetworkPeer $peer, array $input): void
+    {
+        $network = $peer->network;
+
+        Validator::make($input, [
+            'name' => [
+                'required',
+                'string',
+                'max:255',
+                Rule::unique('network_peers', 'name')->where('network_id', $network->id)->ignore($peer->id),
+            ],
+            'enabled' => ['required', 'boolean'],
+        ])->validate();
+
+        $target = $input['enabled']
+            ? ($peer->status === NetworkPeerStatus::DISABLED ? NetworkPeerStatus::PENDING : $peer->status)
+            : NetworkPeerStatus::DISABLED;
+
+        $statusChanged = $target !== $peer->status;
+
+        $peer->name = $input['name'];
+        $peer->status = $target;
+        $peer->save();
+
+        if ($statusChanged) {
+            $this->sync->resyncMembers($network);
+            $this->recompute->handle($network);
+        }
+
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $network->project_id,
+            type: 'network-peer.updated',
+            data: new NetworkPeerResource($peer),
+        ));
+    }
+}
diff --git a/app/Actions/Network/UpdateNetworkServerIp.php b/app/Actions/Network/UpdateNetworkServerIp.php
new file mode 100644
index 000000000..5e3b046a7
--- /dev/null
+++ b/app/Actions/Network/UpdateNetworkServerIp.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Actions\Network;
+
+use App\Enums\IpAddressType;
+use App\Models\NetworkServer;
+use App\ValidationRules\WithinCidrRule;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+
+class UpdateNetworkServerIp
+{
+    public function __construct(private ApplyNetworkFirewall $firewall) {}
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    public function update(NetworkServer $member, array $input): NetworkServer
+    {
+        $this->validate($member, $input);
+
+        $member->update(['server_ip_address_id' => $input['server_ip_address_id']]);
+
+        $this->firewall->handle($member->network);
+
+        return $member->refresh();
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    private function validate(NetworkServer $member, array $input): void
+    {
+        Validator::make($input, [
+            'server_ip_address_id' => [
+                'required',
+                Rule::exists('server_ip_addresses', 'id')
+                    ->where('server_id', $member->server_id)
+                    ->where('type', IpAddressType::PRIVATE->value),
+                Rule::unique('network_servers', 'server_ip_address_id')->ignore($member->id),
+                new WithinCidrRule($member->network->cidr),
+            ],
+        ])->validate();
+    }
+}
diff --git a/app/Actions/Server/CreateServer.php b/app/Actions/Server/CreateServer.php
index b7c23d9d7..84ca85e66 100755
--- a/app/Actions/Server/CreateServer.php
+++ b/app/Actions/Server/CreateServer.php
@@ -110,6 +110,7 @@ private function validate(Project $project, array $input): void
             'ip' => [
                 Rule::when(fn (): bool => isset($input['provider']) && $input['provider'] == Custom::id(), [
                     'required',
+                    'ip',
                     new RestrictedIPAddressesRule,
                 ]),
             ],
diff --git a/app/Actions/Server/EditServer.php b/app/Actions/Server/EditServer.php
index 83f2450ce..824f49e04 100755
--- a/app/Actions/Server/EditServer.php
+++ b/app/Actions/Server/EditServer.php
@@ -2,6 +2,7 @@
 
 namespace App\Actions\Server;
 
+use App\Actions\Network\ResyncServerEndpoint;
 use App\Models\Server;
 use App\ValidationRules\RestrictedIPAddressesRule;
 use Illuminate\Support\Facades\Validator;
@@ -10,6 +11,8 @@
 
 class EditServer
 {
+    public function __construct(private ResyncServerEndpoint $resync) {}
+
     /**
      * @param  array<string, mixed>  $input
      * @return Server $server
@@ -21,12 +24,14 @@ public function edit(Server $server, array $input): Server
         $this->validate($server, $input);
 
         $checkConnection = false;
+        $ipChanged = false;
         if (isset($input['name'])) {
             $server->name = $input['name'];
         }
         if (isset($input['ip'])) {
             if ($server->ip !== $input['ip']) {
                 $checkConnection = true;
+                $ipChanged = true;
             }
             $server->ip = $input['ip'];
         }
@@ -41,6 +46,10 @@ public function edit(Server $server, array $input): Server
         }
         $server->save();
 
+        if ($ipChanged) {
+            $this->resync->handle($server);
+        }
+
         if ($checkConnection) {
             return $server->checkConnection();
         }
@@ -58,12 +67,14 @@ private function validate(Server $server, array $input): void
             ],
             'ip' => [
                 'string',
+                'ip',
                 new RestrictedIPAddressesRule,
                 Rule::unique('servers')->where('project_id', $server->project_id)->ignore($server->id),
             ],
             'local_ip' => [
                 'nullable',
                 'string',
+                'ip',
                 Rule::unique('servers')->where('project_id', $server->project_id)->ignore($server->id),
             ],
             'port' => [
diff --git a/app/Actions/ServerIp/ManageServerIp.php b/app/Actions/ServerIp/ManageServerIp.php
index f640a2877..55d4c2ae6 100644
--- a/app/Actions/ServerIp/ManageServerIp.php
+++ b/app/Actions/ServerIp/ManageServerIp.php
@@ -2,6 +2,7 @@
 
 namespace App\Actions\ServerIp;
 
+use App\Actions\Network\ResyncServerEndpoint;
 use App\DTOs\SocketEventDTO;
 use App\Enums\IpAddressFamily;
 use App\Enums\IpAddressStatus;
@@ -67,6 +68,7 @@ public function create(Server $server, array $input): void
     public function setPrimary(ServerIpAddress $address): void
     {
         $server = $address->server;
+        $endpointChanged = $address->type !== IpAddressType::PRIVATE && $server->ip !== $address->ip;
 
         DB::transaction(function () use ($server, $address): void {
             if ($address->type === IpAddressType::PRIVATE) {
@@ -81,6 +83,10 @@ public function setPrimary(ServerIpAddress $address): void
             $server->ipAddresses()->whereIn('ip', $primaryIps)->update(['is_primary' => true]);
         });
 
+        if ($endpointChanged) {
+            app(ResyncServerEndpoint::class)->handle($server);
+        }
+
         SocketEvent::dispatch(new SocketEventDTO(
             projectId: $server->project_id,
             type: 'server-ip.updated',
diff --git a/app/Actions/ServerIp/RefreshServerIps.php b/app/Actions/ServerIp/RefreshServerIps.php
index c12155fe6..50449273f 100644
--- a/app/Actions/ServerIp/RefreshServerIps.php
+++ b/app/Actions/ServerIp/RefreshServerIps.php
@@ -185,7 +185,8 @@ private function reconcile(Server $server, array $discovered, array $managedIps)
             $server->ipAddresses()
                 ->where('is_managed', false)
                 ->whereNotIn('ip', $seen)
-                ->delete();
+                ->get()
+                ->each(fn (ServerIpAddress $address) => $address->delete());
         });
     }
 }
diff --git a/app/Actions/Service/Install.php b/app/Actions/Service/Install.php
index f83c5d93c..ffb1d9e63 100644
--- a/app/Actions/Service/Install.php
+++ b/app/Actions/Service/Install.php
@@ -50,10 +50,15 @@ public function install(Server $server, array $input): Service
 
     private function validate(array $input): void
     {
+        $installable = collect(config('service.services'))
+            ->reject(fn (array $service): bool => ($service['type'] ?? null) === 'vpn')
+            ->keys()
+            ->all();
+
         $rules = [
             'name' => [
                 'required',
-                Rule::in(array_keys(config('service.services'))),
+                Rule::in($installable),
             ],
             'version' => [
                 'required',
diff --git a/app/Console/Commands/ReconcileNetworksCommand.php b/app/Console/Commands/ReconcileNetworksCommand.php
new file mode 100644
index 000000000..21eba7b4c
--- /dev/null
+++ b/app/Console/Commands/ReconcileNetworksCommand.php
@@ -0,0 +1,215 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\Network\ApplyNetworkFirewall;
+use App\Actions\Network\DispatchNetworkServerSync;
+use App\Actions\Network\RecomputeNetworkStatus;
+use App\DTOs\SocketEventDTO;
+use App\Enums\NetworkPeerStatus;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkStatus;
+use App\Enums\NetworkType;
+use App\Enums\ServerStatus;
+use App\Events\SocketEvent;
+use App\Jobs\Network\PollPeerHandshakesJob;
+use App\Jobs\Network\SyncNetworkServerJob;
+use App\Models\Network;
+use App\Models\NetworkServer;
+use App\Models\ServerLog;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+
+class ReconcileNetworksCommand extends Command
+{
+    protected $signature = 'networks:reconcile';
+
+    protected $description = 'Drive pending/failed/stuck network member syncs for reachable servers and reap stalled teardowns.';
+
+    private const MAX_ATTEMPTS = 5;
+
+    private const SLOW_RETRY_MINUTES = 60;
+
+    private const MAX_LEAVING_ATTEMPTS = 30;
+
+    public function handle(): void
+    {
+        $this->reconcilePending();
+        $this->reconcileFailed();
+        $this->reconcileStaleUpdating();
+        $this->reconcileLeaving();
+        $this->pollHandshakes();
+    }
+
+    private function pollHandshakes(): void
+    {
+        Network::query()
+            ->where('type', NetworkType::WIREGUARD)
+            ->where('status', NetworkStatus::ACTIVE)
+            ->whereHas('peers', fn ($query) => $query->where('status', '!=', NetworkPeerStatus::DISABLED))
+            ->get()
+            ->each(fn (Network $network) => dispatch(new PollPeerHandshakesJob($network))->onQueue('ssh'));
+    }
+
+    private function reconcilePending(): void
+    {
+        NetworkServer::query()
+            ->where('status', NetworkServerStatus::PENDING)
+            ->whereHas('server', $this->reachable())
+            ->pluck('id')
+            ->each(function (int $id): void {
+                $claimed = NetworkServer::query()
+                    ->whereKey($id)
+                    ->where('status', NetworkServerStatus::PENDING)
+                    ->update(['status' => NetworkServerStatus::UPDATING]);
+
+                if ($claimed === 1) {
+                    $this->dispatchSync($id);
+                }
+            });
+    }
+
+    /**
+     * The first attempts run at the command's own cadence; past that the member drops to an
+     * hourly retry rather than being abandoned. A member that gave up permanently would keep
+     * its network `failed` forever and would never pick up a later change — a moved WireGuard
+     * port, say — with nothing in the UI to say a manual sync is required.
+     */
+    private function reconcileFailed(): void
+    {
+        $slowRetry = now()->subMinutes(self::SLOW_RETRY_MINUTES);
+
+        $due = fn ($query) => $query->where(fn ($due) => $due
+            ->where('sync_attempts', '<', self::MAX_ATTEMPTS)
+            ->orWhere('updated_at', '<', $slowRetry));
+
+        NetworkServer::query()
+            ->where('status', NetworkServerStatus::FAILED)
+            ->tap($due)
+            ->whereHas('server', $this->reachable())
+            ->pluck('id')
+            ->each(function (int $id) use ($due): void {
+                $claimed = NetworkServer::query()
+                    ->whereKey($id)
+                    ->where('status', NetworkServerStatus::FAILED)
+                    ->tap($due)
+                    ->update([
+                        'status' => NetworkServerStatus::UPDATING,
+                        'sync_attempts' => DB::raw('sync_attempts + 1'),
+                    ]);
+
+                if ($claimed === 1) {
+                    $this->dispatchSync($id);
+                }
+            });
+    }
+
+    private function reconcileStaleUpdating(): void
+    {
+        $threshold = now()->subMinutes(90);
+
+        NetworkServer::query()
+            ->where('status', NetworkServerStatus::UPDATING)
+            ->where('updated_at', '<', $threshold)
+            ->whereHas('server', $this->reachable())
+            ->pluck('id')
+            ->each(function (int $id) use ($threshold): void {
+                $claimed = NetworkServer::query()
+                    ->whereKey($id)
+                    ->where('status', NetworkServerStatus::UPDATING)
+                    ->where('updated_at', '<', $threshold)
+                    ->update(['updated_at' => now()]);
+
+                if ($claimed === 1) {
+                    $this->dispatchSync($id);
+                }
+            });
+    }
+
+    /**
+     * On-server cleanup only works while the server is reachable, so a teardown keeps retrying —
+     * quickly at first, then hourly — for about a day before the membership is force-removed.
+     * Giving up after the fast attempts alone would abandon the tunnel config on a server that
+     * was merely rebooting.
+     */
+    private function reconcileLeaving(): void
+    {
+        $threshold = now()->subMinutes(2);
+        $slowRetry = now()->subMinutes(self::SLOW_RETRY_MINUTES);
+
+        NetworkServer::query()
+            ->where('status', NetworkServerStatus::LEAVING)
+            ->where('updated_at', '<', $threshold)
+            ->with('network', 'server')
+            ->get()
+            ->each(function (NetworkServer $member) use ($threshold, $slowRetry): void {
+                if ($member->sync_attempts >= self::MAX_LEAVING_ATTEMPTS) {
+                    $this->forceConverge($member);
+
+                    return;
+                }
+
+                if ($member->sync_attempts >= self::MAX_ATTEMPTS
+                    && $member->updated_at instanceof Carbon
+                    && $member->updated_at->greaterThan($slowRetry)) {
+                    return;
+                }
+
+                $claimed = NetworkServer::query()
+                    ->whereKey($member->id)
+                    ->where('status', NetworkServerStatus::LEAVING)
+                    ->where('updated_at', '<', $threshold)
+                    ->update([
+                        'sync_attempts' => DB::raw('sync_attempts + 1'),
+                        'updated_at' => now(),
+                    ]);
+
+                if ($claimed === 1) {
+                    dispatch(new SyncNetworkServerJob($member, true))->onQueue('ssh');
+                }
+            });
+    }
+
+    private function forceConverge(NetworkServer $member): void
+    {
+        $network = $member->network;
+        $projectId = $network->project_id;
+        $memberId = $member->id;
+
+        ServerLog::withNetwork($network->id, fn () => ServerLog::log(
+            $member->server,
+            'network-leave-incomplete',
+            'On-server cleanup could not complete after repeated attempts; membership force-removed. '
+            .'The tunnel configuration may still exist on the server; it is cleared the next time the server syncs a network.'
+        ));
+
+        $member->delete();
+
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $projectId,
+            type: 'network-server.deleted',
+            data: ['id' => $memberId],
+        ));
+
+        if ($network->type === NetworkType::WIREGUARD) {
+            app(DispatchNetworkServerSync::class)->resyncMembers($network);
+        }
+
+        app(ApplyNetworkFirewall::class)->handle($network);
+        app(RecomputeNetworkStatus::class)->handle($network);
+    }
+
+    private function dispatchSync(int $id): void
+    {
+        $member = NetworkServer::find($id);
+        if ($member instanceof NetworkServer) {
+            dispatch(new SyncNetworkServerJob($member))->onQueue('ssh');
+        }
+    }
+
+    private function reachable(): callable
+    {
+        return fn ($query) => $query->whereIn('status', [ServerStatus::READY, ServerStatus::UPDATING]);
+    }
+}
diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index 9a5e47e2f..d2fc79e57 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -21,6 +21,7 @@ protected function schedule(Schedule $schedule): void
         $schedule->command('servers:check-updates')->dailyAt('02:00');
         $schedule->command('servers:auto-update')->everyMinute()->withoutOverlapping();
         $schedule->command('domains:check-pending')->everyFiveMinutes();
+        $schedule->command('networks:reconcile')->everyThreeMinutes()->withoutOverlapping(10);
         $schedule->command('ssl:renew-wildcards')->daily();
         $schedule->command('ssl:check-expiry')->daily();
         $schedule->command('github-app:sync')->cron('0 */4 * * *');
diff --git a/app/DTOs/PrivateNetworkDTO.php b/app/DTOs/PrivateNetworkDTO.php
new file mode 100644
index 000000000..91cb37e0e
--- /dev/null
+++ b/app/DTOs/PrivateNetworkDTO.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace App\DTOs;
+
+use App\Support\Cidr;
+
+final readonly class PrivateNetworkDTO
+{
+    /** @var array<int, PrivateNetworkMemberDTO> */
+    public array $members;
+
+    public ?string $cidr;
+
+    /**
+     * @param  array<int, PrivateNetworkMemberDTO>  $members
+     */
+    public function __construct(
+        public string $externalId,
+        public string $name,
+        ?string $cidr = null,
+        public ?string $region = null,
+        array $members = [],
+    ) {
+        $this->cidr = self::normalizeCidr($cidr);
+        $this->members = array_values($members);
+    }
+
+    /**
+     * Ranges reach a shell template via the firewall rules derived from them, so a malformed
+     * value is dropped rather than stored. Both families are accepted; the prefix must be
+     * explicit and within range for the family it belongs to.
+     */
+    private static function normalizeCidr(?string $cidr): ?string
+    {
+        if ($cidr === null || $cidr === '') {
+            return null;
+        }
+
+        return Cidr::isValid($cidr) ? Cidr::canonical($cidr) : null;
+    }
+}
diff --git a/app/DTOs/PrivateNetworkMemberDTO.php b/app/DTOs/PrivateNetworkMemberDTO.php
new file mode 100644
index 000000000..c57807eb0
--- /dev/null
+++ b/app/DTOs/PrivateNetworkMemberDTO.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\DTOs;
+
+use App\Support\Cidr;
+
+final readonly class PrivateNetworkMemberDTO
+{
+    public ?string $ip;
+
+    public function __construct(
+        public string $instanceId,
+        ?string $ip = null,
+    ) {
+        $this->ip = self::normalizeIp($ip);
+    }
+
+    /**
+     * Member addresses reach `ServerNetworkRule.source` and are interpolated into the `ufw`
+     * blade template, which is a shell script — Blade's escaping is HTML escaping and offers
+     * no protection there. Both families are accepted, but only a literal address: anything
+     * carrying whitespace, a prefix or shell metacharacters is dropped.
+     */
+    private static function normalizeIp(?string $ip): ?string
+    {
+        if ($ip === null || $ip === '') {
+            return null;
+        }
+
+        return Cidr::isValidAddress($ip) ? $ip : null;
+    }
+}
diff --git a/app/Enums/NetworkAddressingPool.php b/app/Enums/NetworkAddressingPool.php
new file mode 100644
index 000000000..ba7e2a46f
--- /dev/null
+++ b/app/Enums/NetworkAddressingPool.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Enums;
+
+use App\Contracts\VitoEnum;
+use Forjed\InertiaTable\Contracts\HasTableDisplay;
+
+enum NetworkAddressingPool: string implements HasTableDisplay, VitoEnum
+{
+    case CGNAT = 'cgnat';
+    case RFC1918 = 'rfc1918';
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::CGNAT => 'info',
+            self::RFC1918 => 'warning',
+        };
+    }
+
+    public function getText(): string
+    {
+        return match ($this) {
+            self::CGNAT => 'CGNAT (100.64.0.0/10)',
+            self::RFC1918 => 'Private (RFC1918)',
+        };
+    }
+}
diff --git a/app/Enums/NetworkPeerStatus.php b/app/Enums/NetworkPeerStatus.php
new file mode 100644
index 000000000..93b8ec623
--- /dev/null
+++ b/app/Enums/NetworkPeerStatus.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Enums;
+
+use App\Contracts\VitoEnum;
+use Forjed\InertiaTable\Contracts\HasTableDisplay;
+
+enum NetworkPeerStatus: string implements HasTableDisplay, VitoEnum
+{
+    case PENDING = 'pending';
+    case ACTIVE = 'active';
+    case DISABLED = 'disabled';
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::PENDING => 'info',
+            self::ACTIVE => 'success',
+            self::DISABLED => 'gray',
+        };
+    }
+
+    public function getText(): string
+    {
+        return $this->value;
+    }
+}
diff --git a/app/Enums/NetworkServerStatus.php b/app/Enums/NetworkServerStatus.php
new file mode 100644
index 000000000..039b96eb1
--- /dev/null
+++ b/app/Enums/NetworkServerStatus.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Enums;
+
+use App\Contracts\VitoEnum;
+use Forjed\InertiaTable\Contracts\HasTableDisplay;
+
+enum NetworkServerStatus: string implements HasTableDisplay, VitoEnum
+{
+    case PENDING = 'pending';
+    case UPDATING = 'updating';
+    case ACTIVE = 'active';
+    case FAILED = 'failed';
+    case LEAVING = 'leaving';
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::PENDING => 'info',
+            self::UPDATING,
+            self::LEAVING => 'warning',
+            self::ACTIVE => 'success',
+            self::FAILED => 'danger',
+        };
+    }
+
+    public function getText(): string
+    {
+        return $this->value;
+    }
+}
diff --git a/app/Enums/NetworkStatus.php b/app/Enums/NetworkStatus.php
new file mode 100644
index 000000000..3cc2ca8e0
--- /dev/null
+++ b/app/Enums/NetworkStatus.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Enums;
+
+use App\Contracts\VitoEnum;
+use Forjed\InertiaTable\Contracts\HasTableDisplay;
+
+enum NetworkStatus: string implements HasTableDisplay, VitoEnum
+{
+    case CREATING = 'creating';
+    case SYNCING = 'syncing';
+    case ACTIVE = 'active';
+    case FAILED = 'failed';
+    case DELETING = 'deleting';
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::CREATING => 'info',
+            self::SYNCING => 'warning',
+            self::ACTIVE => 'success',
+            self::DELETING,
+            self::FAILED => 'danger',
+        };
+    }
+
+    public function getText(): string
+    {
+        return $this->value;
+    }
+}
diff --git a/app/Enums/NetworkType.php b/app/Enums/NetworkType.php
new file mode 100644
index 000000000..195fe9e2c
--- /dev/null
+++ b/app/Enums/NetworkType.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Enums;
+
+use App\Contracts\VitoEnum;
+use Forjed\InertiaTable\Contracts\HasTableDisplay;
+
+enum NetworkType: string implements HasTableDisplay, VitoEnum
+{
+    case PROVIDER = 'provider';
+    case CUSTOM = 'custom';
+    case WIREGUARD = 'wireguard';
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::PROVIDER => 'info',
+            self::CUSTOM => 'warning',
+            self::WIREGUARD => 'success',
+        };
+    }
+
+    public function getText(): string
+    {
+        return match ($this) {
+            self::PROVIDER => 'provider',
+            self::CUSTOM => 'custom',
+            self::WIREGUARD => 'wireguard',
+        };
+    }
+}
diff --git a/app/Enums/ServerNetworkRuleKind.php b/app/Enums/ServerNetworkRuleKind.php
new file mode 100644
index 000000000..dbc33b139
--- /dev/null
+++ b/app/Enums/ServerNetworkRuleKind.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Enums;
+
+use App\Contracts\VitoEnum;
+
+enum ServerNetworkRuleKind: string implements VitoEnum
+{
+    case HANDSHAKE = 'handshake';
+    case RULE = 'rule';
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::HANDSHAKE => 'info',
+            self::RULE => 'success',
+        };
+    }
+
+    public function getText(): string
+    {
+        return $this->value;
+    }
+}
diff --git a/app/Exceptions/PrivateNetworkPersistError.php b/app/Exceptions/PrivateNetworkPersistError.php
new file mode 100644
index 000000000..6dfe79e09
--- /dev/null
+++ b/app/Exceptions/PrivateNetworkPersistError.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Exceptions;
+
+use Exception;
+
+/**
+ * Raised when discovered networks were read from the provider but could not be written. The
+ * sweep continues so one bad network cannot suppress pruning for the rest, and this is thrown
+ * at the end so the job reports failure rather than a silent partial sync. Carries no message
+ * from the underlying database error, which can echo back the values it was given.
+ */
+class PrivateNetworkPersistError extends Exception
+{
+    public function __construct(
+        public readonly int $projectId,
+        public readonly int $networks,
+    ) {
+        parent::__construct(sprintf(
+            '%d discovered network(s) could not be reconciled for project %d.',
+            $this->networks,
+            $this->projectId,
+        ));
+    }
+}
diff --git a/app/Exceptions/PrivateNetworkSyncError.php b/app/Exceptions/PrivateNetworkSyncError.php
new file mode 100644
index 000000000..ad60b5605
--- /dev/null
+++ b/app/Exceptions/PrivateNetworkSyncError.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Exceptions;
+
+use Exception;
+
+/**
+ * Raised at the provider boundary so no upstream exception — which may carry
+ * credentials in its message or trace arguments — reaches the queue's failed-job
+ * serialisation or the log.
+ */
+class PrivateNetworkSyncError extends Exception
+{
+    public function __construct(
+        public readonly int $serverProviderId,
+        public readonly string $provider,
+        public readonly string $profile,
+        public readonly ?int $status = null,
+        public readonly ?string $region = null,
+    ) {
+        parent::__construct(sprintf(
+            'Could not read private networks from %s connection "%s"%s%s.',
+            $this->provider,
+            $this->profile,
+            $this->region !== null ? ' in region '.$this->region : '',
+            $this->status !== null ? ' (HTTP '.$this->status.')' : '',
+        ));
+    }
+
+    public function isPermissionError(): bool
+    {
+        return in_array($this->status, [401, 403], true);
+    }
+}
diff --git a/app/Http/Controllers/FirewallController.php b/app/Http/Controllers/FirewallController.php
index b67e1ac96..24f8ae113 100644
--- a/app/Http/Controllers/FirewallController.php
+++ b/app/Http/Controllers/FirewallController.php
@@ -6,6 +6,7 @@
 use App\Models\FirewallRule;
 use App\Models\Server;
 use App\Tables\Servers\FirewallRuleTable;
+use App\Tables\Servers\ServerNetworkRuleTable;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Inertia\Inertia;
@@ -28,6 +29,9 @@ public function index(Server $server): Response
 
         return Inertia::render('firewall/index', [
             'rules' => FirewallRuleTable::make($server->firewallRules())->simplePaginate(),
+            'networkRules' => ServerNetworkRuleTable::make($server->networkRules())
+                ->identifier('networkRules')
+                ->simplePaginate(),
         ]);
     }
 
diff --git a/app/Http/Controllers/NetworkController.php b/app/Http/Controllers/NetworkController.php
new file mode 100644
index 000000000..4866b95ca
--- /dev/null
+++ b/app/Http/Controllers/NetworkController.php
@@ -0,0 +1,190 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Network\CreateNetwork;
+use App\Actions\Network\DeleteNetwork;
+use App\Actions\Network\SyncNetwork;
+use App\Actions\Network\UpdateNetwork;
+use App\Enums\IpAddressType;
+use App\Enums\NetworkType;
+use App\Helpers\QueryBuilder;
+use App\Http\Resources\NetworkMemberIpResource;
+use App\Http\Resources\NetworkServerOptionResource;
+use App\Http\Resources\ServerLogResource;
+use App\Jobs\Network\SyncProviderNetworksJob;
+use App\Models\Network;
+use App\Models\Project;
+use App\Tables\Networks\NetworkServerTable;
+use App\Tables\NetworkTable;
+use Illuminate\Contracts\Pagination\Paginator;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Inertia\Inertia;
+use Inertia\Response;
+use Spatie\RouteAttributes\Attributes\Delete;
+use Spatie\RouteAttributes\Attributes\Get;
+use Spatie\RouteAttributes\Attributes\Middleware;
+use Spatie\RouteAttributes\Attributes\Post;
+use Spatie\RouteAttributes\Attributes\Prefix;
+use Spatie\RouteAttributes\Attributes\Put;
+
+#[Prefix('networks')]
+#[Middleware(['auth', 'has-project'])]
+class NetworkController extends Controller
+{
+    #[Get('/', name: 'networks')]
+    public function index(): Response
+    {
+        $project = user()->currentProject;
+
+        $this->authorize('viewAny', [Network::class, $project]);
+
+        return Inertia::render('networks/index', [
+            'networks' => NetworkTable::make($project->networks())->simplePaginate(),
+            'servers' => $this->serversPayload($project),
+        ]);
+    }
+
+    #[Post('/', name: 'networks.store')]
+    public function store(Request $request): RedirectResponse
+    {
+        $project = user()->currentProject;
+
+        $this->authorize('create', [Network::class, $project]);
+
+        $network = app(CreateNetwork::class)->create($project, $request->all());
+
+        return redirect()->route('networks.show', $network->id)
+            ->with('info', 'Network is being created.');
+    }
+
+    #[Get('/{network}', name: 'networks.show')]
+    public function show(Network $network): Response
+    {
+        $this->authorize('view', $network);
+
+        $network->loadCount(['servers', 'peers', 'firewallRules']);
+
+        return Inertia::render('networks/show', [
+            'stats' => [
+                'servers' => $network->servers_count,
+                'peers' => $network->peers_count,
+                'firewall_rules' => $network->firewall_rules_count,
+            ],
+            'logs' => ServerLogResource::collection($this->logsQuery($network)),
+        ]);
+    }
+
+    /**
+     * @return Paginator<int, Model>
+     */
+    private function logsQuery(Network $network): Paginator
+    {
+        return QueryBuilder::for($network->serverLogs()->with('server'))
+            ->searchableFields(['name'])
+            ->sortable('created_at', 'desc')
+            ->query()
+            ->simplePaginate(config('web.pagination_size'));
+    }
+
+    #[Get('/{network}/servers', name: 'networks.servers')]
+    public function servers(Network $network): Response
+    {
+        $this->authorize('view', $network);
+
+        $memberServerIds = $network->servers()->pluck('server_id')->all();
+
+        return Inertia::render('networks/servers', [
+            'members' => NetworkServerTable::make($network->servers())->identifier('members')->simplePaginate(),
+            'servers' => $this->serversPayload($network->project, $memberServerIds),
+            'memberIps' => $network->type === NetworkType::CUSTOM ? $this->memberIpsPayload($network) : [],
+        ]);
+    }
+
+    private function memberIpsPayload(Network $network): AnonymousResourceCollection
+    {
+        return NetworkMemberIpResource::collection(
+            $network->servers()
+                ->with(['server', 'server.ipAddresses' => fn ($query) => $query->where('type', IpAddressType::PRIVATE)])
+                ->get()
+        );
+    }
+
+    #[Get('/{network}/logs', name: 'networks.logs')]
+    public function logs(Network $network): Response
+    {
+        $this->authorize('view', $network);
+
+        return Inertia::render('networks/logs', [
+            'logs' => ServerLogResource::collection($this->logsQuery($network)),
+        ]);
+    }
+
+    #[Get('/{network}/settings', name: 'networks.settings')]
+    public function settings(Network $network): Response
+    {
+        $this->authorize('view', $network);
+
+        return Inertia::render('networks/settings');
+    }
+
+    #[Put('/{network}', name: 'networks.update')]
+    public function update(Request $request, Network $network): RedirectResponse
+    {
+        $this->authorize('update', $network);
+
+        app(UpdateNetwork::class)->update($network, $request->all());
+
+        return back()->with('success', 'Changes saved!');
+    }
+
+    #[Delete('/{network}', name: 'networks.destroy')]
+    public function destroy(Network $network): RedirectResponse
+    {
+        $this->authorize('delete', $network);
+
+        app(DeleteNetwork::class)->delete($network);
+
+        return redirect()->route('networks')->with('success', 'Network deleted!');
+    }
+
+    #[Post('/sync', name: 'networks.sync-providers')]
+    public function syncProviders(): RedirectResponse
+    {
+        $project = user()->currentProject;
+
+        $this->authorize('create', [Network::class, $project]);
+
+        if (! SyncProviderNetworksJob::dispatchUnlessRecent($project)) {
+            return back()->with('info', 'A provider sync is already in progress.');
+        }
+
+        return back()->with('info', 'Syncing networks from your cloud providers.');
+    }
+
+    #[Post('/{network}/sync', name: 'networks.sync')]
+    public function sync(Network $network): RedirectResponse
+    {
+        $this->authorize('update', $network);
+
+        app(SyncNetwork::class)->network($network);
+
+        return back()->with('info', 'Network is being synced.');
+    }
+
+    /**
+     * @param  array<int, int>  $excludeServerIds
+     */
+    private function serversPayload(Project $project, array $excludeServerIds = []): AnonymousResourceCollection
+    {
+        return NetworkServerOptionResource::collection(
+            $project->servers()
+                ->when($excludeServerIds !== [], fn ($query) => $query->whereNotIn('id', $excludeServerIds))
+                ->with(['ipAddresses' => fn ($query) => $query->where('type', IpAddressType::PRIVATE)])
+                ->get()
+        );
+    }
+}
diff --git a/app/Http/Controllers/NetworkFirewallRuleController.php b/app/Http/Controllers/NetworkFirewallRuleController.php
new file mode 100644
index 000000000..732f8f1ac
--- /dev/null
+++ b/app/Http/Controllers/NetworkFirewallRuleController.php
@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Network\ManageNetworkFirewallRule;
+use App\Models\Network;
+use App\Models\NetworkFirewallRule;
+use App\Tables\Networks\NetworkFirewallRuleTable;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+use Spatie\RouteAttributes\Attributes\Delete;
+use Spatie\RouteAttributes\Attributes\Get;
+use Spatie\RouteAttributes\Attributes\Middleware;
+use Spatie\RouteAttributes\Attributes\Post;
+use Spatie\RouteAttributes\Attributes\Prefix;
+use Spatie\RouteAttributes\Attributes\Put;
+
+#[Prefix('networks/{network}/firewall')]
+#[Middleware(['auth', 'has-project'])]
+class NetworkFirewallRuleController extends Controller
+{
+    #[Get('/', name: 'networks.firewall')]
+    public function index(Network $network): Response
+    {
+        $this->authorize('view', $network);
+
+        return Inertia::render('networks/firewall', [
+            'rules' => NetworkFirewallRuleTable::make($network->firewallRules())->identifier('rules')->simplePaginate(),
+        ]);
+    }
+
+    #[Post('/', name: 'networks.firewall.store')]
+    public function store(Request $request, Network $network): RedirectResponse
+    {
+        $this->authorize('update', $network);
+
+        app(ManageNetworkFirewallRule::class)->create($network, $request->all());
+
+        return back()->with('info', 'Firewall rule is being created.');
+    }
+
+    #[Put('/{networkFirewallRule}', name: 'networks.firewall.update')]
+    public function update(Request $request, Network $network, NetworkFirewallRule $networkFirewallRule): RedirectResponse
+    {
+        $this->authorize('update', $network);
+        $this->ensureBelongsToNetwork($network, $networkFirewallRule);
+
+        app(ManageNetworkFirewallRule::class)->update($networkFirewallRule, $request->all());
+
+        return back()->with('info', 'Firewall rule is being updated.');
+    }
+
+    #[Delete('/{networkFirewallRule}', name: 'networks.firewall.destroy')]
+    public function destroy(Network $network, NetworkFirewallRule $networkFirewallRule): RedirectResponse
+    {
+        $this->authorize('update', $network);
+        $this->ensureBelongsToNetwork($network, $networkFirewallRule);
+
+        app(ManageNetworkFirewallRule::class)->delete($networkFirewallRule);
+
+        return back()->with('info', 'Firewall rule is being deleted.');
+    }
+
+    private function ensureBelongsToNetwork(Network $network, NetworkFirewallRule $networkFirewallRule): void
+    {
+        abort_unless($networkFirewallRule->network_id === $network->id, 404);
+    }
+}
diff --git a/app/Http/Controllers/NetworkPeerController.php b/app/Http/Controllers/NetworkPeerController.php
new file mode 100644
index 000000000..0e87c3454
--- /dev/null
+++ b/app/Http/Controllers/NetworkPeerController.php
@@ -0,0 +1,111 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Network\ConcealNetworkPeerKey;
+use App\Actions\Network\CreateNetworkPeer;
+use App\Actions\Network\DeleteNetworkPeer;
+use App\Actions\Network\GetNetworkPeerConfig;
+use App\Actions\Network\RegenerateNetworkPeerKeys;
+use App\Actions\Network\UpdateNetworkPeer;
+use App\Enums\NetworkType;
+use App\Models\Network;
+use App\Models\NetworkPeer;
+use App\Tables\Networks\NetworkPeerTable;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+use Spatie\RouteAttributes\Attributes\Delete;
+use Spatie\RouteAttributes\Attributes\Get;
+use Spatie\RouteAttributes\Attributes\Middleware;
+use Spatie\RouteAttributes\Attributes\Post;
+use Spatie\RouteAttributes\Attributes\Prefix;
+use Spatie\RouteAttributes\Attributes\Put;
+
+#[Prefix('networks/{network}/peers')]
+#[Middleware(['auth', 'has-project'])]
+class NetworkPeerController extends Controller
+{
+    #[Get('/', name: 'networks.peers')]
+    public function index(Network $network): Response
+    {
+        $this->authorize('view', $network);
+        abort_unless($network->type === NetworkType::WIREGUARD, 404);
+
+        return Inertia::render('networks/peers', [
+            'peers' => NetworkPeerTable::make($network->peers())->identifier('peers')->simplePaginate(),
+        ]);
+    }
+
+    #[Post('/', name: 'networks.peers.store')]
+    public function store(Request $request, Network $network): RedirectResponse
+    {
+        $this->authorize('update', $network);
+        abort_unless($network->type === NetworkType::WIREGUARD, 404);
+
+        app(CreateNetworkPeer::class)->create($network, $request->all());
+
+        return back()->with('info', 'Peer is being added to the network.');
+    }
+
+    #[Get('/{networkPeer}/config', name: 'networks.peers.config')]
+    public function config(Network $network, NetworkPeer $networkPeer): JsonResponse
+    {
+        $this->authorize('update', $network);
+        $this->ensureBelongsToNetwork($network, $networkPeer);
+
+        return response()->json(app(GetNetworkPeerConfig::class)->config($networkPeer))
+            ->header('Cache-Control', 'no-store');
+    }
+
+    #[Post('/{networkPeer}/conceal', name: 'networks.peers.conceal')]
+    public function conceal(Network $network, NetworkPeer $networkPeer): RedirectResponse
+    {
+        $this->authorize('update', $network);
+        $this->ensureBelongsToNetwork($network, $networkPeer);
+
+        app(ConcealNetworkPeerKey::class)->conceal($networkPeer);
+
+        return back();
+    }
+
+    #[Post('/{networkPeer}/regenerate', name: 'networks.peers.regenerate')]
+    public function regenerate(Request $request, Network $network, NetworkPeer $networkPeer): RedirectResponse
+    {
+        $this->authorize('update', $network);
+        $this->ensureBelongsToNetwork($network, $networkPeer);
+
+        app(RegenerateNetworkPeerKeys::class)->regenerate($networkPeer, $request->all());
+
+        return back()->with('info', 'Peer keys are being regenerated.');
+    }
+
+    #[Put('/{networkPeer}', name: 'networks.peers.update')]
+    public function update(Request $request, Network $network, NetworkPeer $networkPeer): RedirectResponse
+    {
+        $this->authorize('update', $network);
+        $this->ensureBelongsToNetwork($network, $networkPeer);
+
+        app(UpdateNetworkPeer::class)->update($networkPeer, $request->all());
+
+        return back()->with('success', 'Peer updated.');
+    }
+
+    #[Delete('/{networkPeer}', name: 'networks.peers.destroy')]
+    public function destroy(Network $network, NetworkPeer $networkPeer): RedirectResponse
+    {
+        $this->authorize('update', $network);
+        $this->ensureBelongsToNetwork($network, $networkPeer);
+
+        app(DeleteNetworkPeer::class)->delete($networkPeer);
+
+        return back()->with('info', 'Peer is being removed from the network.');
+    }
+
+    private function ensureBelongsToNetwork(Network $network, NetworkPeer $networkPeer): void
+    {
+        abort_unless($networkPeer->network_id === $network->id, 404);
+    }
+}
diff --git a/app/Http/Controllers/NetworkServerController.php b/app/Http/Controllers/NetworkServerController.php
new file mode 100644
index 000000000..b6808186b
--- /dev/null
+++ b/app/Http/Controllers/NetworkServerController.php
@@ -0,0 +1,84 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Network\AddServersToNetwork;
+use App\Actions\Network\RemoveServerFromNetwork;
+use App\Actions\Network\SyncNetwork;
+use App\Actions\Network\UpdateNetworkServerIp;
+use App\Enums\NetworkType;
+use App\Models\Network;
+use App\Models\NetworkServer;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Spatie\RouteAttributes\Attributes\Delete;
+use Spatie\RouteAttributes\Attributes\Middleware;
+use Spatie\RouteAttributes\Attributes\Post;
+use Spatie\RouteAttributes\Attributes\Prefix;
+use Spatie\RouteAttributes\Attributes\Put;
+
+#[Prefix('networks/{network}/servers')]
+#[Middleware(['auth', 'has-project'])]
+class NetworkServerController extends Controller
+{
+    #[Post('/', name: 'networks.servers.store')]
+    public function store(Request $request, Network $network): RedirectResponse
+    {
+        $this->authorize('update', $network);
+        $this->ensureNotProviderManaged($network);
+
+        $movedPort = app(AddServersToNetwork::class)->add($network, $request->all());
+
+        if ($movedPort !== null && $network->peers()->exists()) {
+            return back()->with('warning', 'Servers are being added. The listen port moved to '.$movedPort.', so every peer must download its config again to reconnect.');
+        }
+
+        return back()->with('info', 'Servers are being added to the network.');
+    }
+
+    #[Post('/{networkServer}/sync', name: 'networks.servers.sync')]
+    public function sync(Network $network, NetworkServer $networkServer): RedirectResponse
+    {
+        $this->authorize('update', $network);
+        $this->ensureBelongsToNetwork($network, $networkServer);
+        $this->ensureNotProviderManaged($network);
+
+        app(SyncNetwork::class)->member($networkServer);
+
+        return back()->with('info', 'Server configuration is being regenerated.');
+    }
+
+    #[Put('/{networkServer}', name: 'networks.servers.update')]
+    public function update(Request $request, Network $network, NetworkServer $networkServer): RedirectResponse
+    {
+        $this->authorize('update', $network);
+        $this->ensureBelongsToNetwork($network, $networkServer);
+        abort_unless($network->type === NetworkType::CUSTOM, 404);
+
+        app(UpdateNetworkServerIp::class)->update($networkServer, $request->only('server_ip_address_id'));
+
+        return back()->with('success', 'IP address updated.');
+    }
+
+    #[Delete('/{networkServer}', name: 'networks.servers.destroy')]
+    public function destroy(Network $network, NetworkServer $networkServer): RedirectResponse
+    {
+        $this->authorize('update', $network);
+        $this->ensureBelongsToNetwork($network, $networkServer);
+        $this->ensureNotProviderManaged($network);
+
+        app(RemoveServerFromNetwork::class)->remove($networkServer);
+
+        return back()->with('info', 'Server is being removed from the network.');
+    }
+
+    private function ensureBelongsToNetwork(Network $network, NetworkServer $networkServer): void
+    {
+        abort_unless($networkServer->network_id === $network->id, 404);
+    }
+
+    private function ensureNotProviderManaged(Network $network): void
+    {
+        abort_if($network->type === NetworkType::PROVIDER, 404);
+    }
+}
diff --git a/app/Http/Middleware/HandleInertiaRequests.php b/app/Http/Middleware/HandleInertiaRequests.php
index 85ded423c..795233003 100644
--- a/app/Http/Middleware/HandleInertiaRequests.php
+++ b/app/Http/Middleware/HandleInertiaRequests.php
@@ -3,10 +3,12 @@
 namespace App\Http\Middleware;
 
 use App\Actions\Bootstrap\GetBootstrap;
+use App\Http\Resources\NetworkResource;
 use App\Http\Resources\ProjectResource;
 use App\Http\Resources\ServerResource;
 use App\Http\Resources\SiteResource;
 use App\Http\Resources\UserResource;
+use App\Models\Network;
 use App\Models\Server;
 use App\Models\Site;
 use App\Models\User;
@@ -78,6 +80,23 @@ public function share(Request $request): array
             }
         }
 
+        if ($request->route('network')) {
+            /** @var Network $network */
+            $network = $request->route('network');
+            if ($user && $user->can('view', $network)) {
+                if ($user->current_project_id !== $network->project_id) {
+                    $user->current_project_id = $network->project_id;
+                    $user->save();
+                    $user->unsetRelation('currentProject');
+                    $currentProject = $user->currentProject;
+                }
+
+                $data['network'] = fn () => NetworkResource::make(
+                    $network->load('serverProvider')->loadCount('servers')
+                );
+            }
+        }
+
         return [
             ...parent::share($request),
             ...$data,
diff --git a/app/Http/Resources/NetworkFirewallRuleResource.php b/app/Http/Resources/NetworkFirewallRuleResource.php
new file mode 100644
index 000000000..586da6535
--- /dev/null
+++ b/app/Http/Resources/NetworkFirewallRuleResource.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Models\NetworkFirewallRule;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin NetworkFirewallRule */
+class NetworkFirewallRuleResource extends JsonResource
+{
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'network_id' => $this->network_id,
+            'name' => $this->name,
+            'protocol' => $this->protocol,
+            'port' => $this->port,
+            'status' => $this->status->getText(),
+            'status_color' => $this->status->getColor(),
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at,
+        ];
+    }
+}
diff --git a/app/Http/Resources/NetworkMemberIpResource.php b/app/Http/Resources/NetworkMemberIpResource.php
new file mode 100644
index 000000000..567de8618
--- /dev/null
+++ b/app/Http/Resources/NetworkMemberIpResource.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Models\NetworkServer;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin NetworkServer */
+class NetworkMemberIpResource extends JsonResource
+{
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'server_id' => $this->server_id,
+            'server_name' => $this->whenLoaded('server', fn (): string => $this->server->name),
+            'ip_address_id' => $this->server_ip_address_id,
+            'private_ips' => $this->whenLoaded(
+                'server',
+                fn () => NetworkPrivateIpResource::collection($this->server->ipAddresses)
+            ),
+        ];
+    }
+}
diff --git a/app/Http/Resources/NetworkPeerResource.php b/app/Http/Resources/NetworkPeerResource.php
new file mode 100644
index 000000000..a2a98f827
--- /dev/null
+++ b/app/Http/Resources/NetworkPeerResource.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Models\NetworkPeer;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin NetworkPeer */
+class NetworkPeerResource extends JsonResource
+{
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'network_id' => $this->network_id,
+            'name' => $this->name,
+            'ip' => $this->ip,
+            'public_key' => $this->public_key,
+            'status' => $this->status->getText(),
+            'status_color' => $this->status->getColor(),
+            'last_handshake_at' => $this->last_handshake_at,
+            'byo' => $this->byo,
+            'has_private_key' => $this->hasPrivateKey(),
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at,
+        ];
+    }
+}
diff --git a/app/Http/Resources/NetworkPrivateIpResource.php b/app/Http/Resources/NetworkPrivateIpResource.php
new file mode 100644
index 000000000..0cd22f2ab
--- /dev/null
+++ b/app/Http/Resources/NetworkPrivateIpResource.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Models\ServerIpAddress;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin ServerIpAddress */
+class NetworkPrivateIpResource extends JsonResource
+{
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'ip' => $this->ip,
+            'is_primary' => $this->is_primary,
+        ];
+    }
+}
diff --git a/app/Http/Resources/NetworkResource.php b/app/Http/Resources/NetworkResource.php
new file mode 100644
index 000000000..b11152297
--- /dev/null
+++ b/app/Http/Resources/NetworkResource.php
@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Actions\Network\CheckNetworkStranding;
+use App\Enums\NetworkType;
+use App\Models\Network;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin Network */
+class NetworkResource extends JsonResource
+{
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'project_id' => $this->project_id,
+            'name' => $this->name,
+            'type' => $this->type->getText(),
+            'type_value' => $this->type->value,
+            'type_color' => $this->type->getColor(),
+            'addressing_pool' => $this->addressing_pool->getText(),
+            'cidr' => $this->cidr,
+            'port' => $this->port,
+            'region' => $this->region,
+            'is_managed' => $this->type === NetworkType::PROVIDER,
+            'is_orphaned' => $this->type === NetworkType::PROVIDER && $this->server_provider_id === null,
+            'is_stranded' => app(CheckNetworkStranding::class)->handle($this->resource),
+            'provider' => $this->whenLoaded('serverProvider', fn (): ?string => $this->serverProvider?->provider),
+            'last_synced_at' => $this->last_synced_at,
+            'status' => $this->status->getText(),
+            'status_color' => $this->status->getColor(),
+            'servers_count' => $this->whenCounted('servers'),
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at,
+        ];
+    }
+}
diff --git a/app/Http/Resources/NetworkServerOptionResource.php b/app/Http/Resources/NetworkServerOptionResource.php
new file mode 100644
index 000000000..47d44f2d2
--- /dev/null
+++ b/app/Http/Resources/NetworkServerOptionResource.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Models\Server;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin Server */
+class NetworkServerOptionResource extends JsonResource
+{
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'is_ready' => $this->isReady(),
+            'private_ips' => NetworkPrivateIpResource::collection($this->whenLoaded('ipAddresses')),
+        ];
+    }
+}
diff --git a/app/Http/Resources/NetworkServerResource.php b/app/Http/Resources/NetworkServerResource.php
new file mode 100644
index 000000000..247d9ab64
--- /dev/null
+++ b/app/Http/Resources/NetworkServerResource.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Models\NetworkServer;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin NetworkServer */
+class NetworkServerResource extends JsonResource
+{
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'network_id' => $this->network_id,
+            'server_id' => $this->server_id,
+            'server_name' => $this->whenLoaded('server', fn (): string => $this->server->name),
+            'ip' => $this->ip,
+            'private_ip' => $this->whenLoaded('serverIpAddress', fn (): ?string => $this->serverIpAddress?->ip),
+            'public_key' => $this->public_key,
+            'status' => $this->status->getText(),
+            'status_color' => $this->status->getColor(),
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at,
+        ];
+    }
+}
diff --git a/app/Http/Resources/ServerLogResource.php b/app/Http/Resources/ServerLogResource.php
index b813464be..616dcf72a 100644
--- a/app/Http/Resources/ServerLogResource.php
+++ b/app/Http/Resources/ServerLogResource.php
@@ -17,7 +17,9 @@ public function toArray(Request $request): array
         return [
             'id' => $this->id,
             'server_id' => $this->server_id,
+            'server_name' => $this->whenLoaded('server', fn (): string => $this->server->name),
             'site_id' => $this->site_id,
+            'network_id' => $this->network_id,
             'type' => $this->type,
             'name' => $this->name,
             'disk' => $this->disk,
diff --git a/app/Jobs/Network/ApplyNetworkFirewallJob.php b/app/Jobs/Network/ApplyNetworkFirewallJob.php
new file mode 100644
index 000000000..c5e6c1347
--- /dev/null
+++ b/app/Jobs/Network/ApplyNetworkFirewallJob.php
@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Jobs\Network;
+
+use App\Actions\Network\RecomputeNetworkStatus;
+use App\Enums\NetworkServerStatus;
+use App\Models\NetworkServer;
+use App\Models\ServerLog;
+use App\Models\Service;
+use App\Services\Firewall\Firewall;
+use App\Traits\UniqueQueue;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Queue\Queueable;
+use Throwable;
+
+class ApplyNetworkFirewallJob implements ShouldQueue
+{
+    use Queueable;
+    use UniqueQueue;
+
+    public function __construct(protected NetworkServer $member) {}
+
+    public function handle(): void
+    {
+        $this->run("server-{$this->member->server_id}", function (): void {
+            ServerLog::withNetwork($this->member->network_id, function (): void {
+                $service = $this->member->server->firewall();
+                if (! $service instanceof Service) {
+                    return;
+                }
+
+                /** @var Firewall $handler */
+                $handler = $service->handler();
+                $handler->applyRules();
+            });
+        });
+    }
+
+    public function failed(Throwable $e): void
+    {
+        NetworkServer::query()
+            ->whereKey($this->member->id)
+            ->whereIn('status', [
+                NetworkServerStatus::ACTIVE,
+                NetworkServerStatus::PENDING,
+                NetworkServerStatus::UPDATING,
+            ])
+            ->update(['status' => NetworkServerStatus::FAILED]);
+
+        ServerLog::withNetwork(
+            $this->member->network_id,
+            fn () => ServerLog::log($this->member->server, 'apply-network-firewall-failed', $e->getMessage()),
+        );
+
+        app(RecomputeNetworkStatus::class)->handle($this->member->network);
+    }
+}
diff --git a/app/Jobs/Network/PollPeerHandshakesJob.php b/app/Jobs/Network/PollPeerHandshakesJob.php
new file mode 100644
index 000000000..1989d040d
--- /dev/null
+++ b/app/Jobs/Network/PollPeerHandshakesJob.php
@@ -0,0 +1,100 @@
+<?php
+
+namespace App\Jobs\Network;
+
+use App\DTOs\SocketEventDTO;
+use App\Enums\NetworkServerStatus;
+use App\Enums\ServerStatus;
+use App\Enums\ServiceStatus;
+use App\Events\SocketEvent;
+use App\Http\Resources\NetworkPeerResource;
+use App\Models\Network;
+use App\Models\NetworkServer;
+use App\Models\ServerLog;
+use App\Models\Service;
+use App\Services\VPN\WireGuard;
+use App\Traits\UniqueQueue;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Foundation\Queue\Queueable;
+use Illuminate\Support\Carbon;
+use Throwable;
+
+class PollPeerHandshakesJob implements ShouldQueue
+{
+    use Queueable;
+    use UniqueQueue;
+
+    public function __construct(protected Network $network) {}
+
+    public function handle(): void
+    {
+        $this->run("network-{$this->network->id}-handshakes", function (): void {
+            foreach ($this->reachableMembers() as $member) {
+                $service = $member->server->service(WireGuard::type());
+
+                if (! $service instanceof Service || $service->status !== ServiceStatus::READY) {
+                    continue;
+                }
+
+                /** @var WireGuard $handler */
+                $handler = $service->handler();
+
+                $this->apply($handler->latestHandshakes($this->network));
+
+                return;
+            }
+        });
+    }
+
+    public function failed(Throwable $e): void
+    {
+        $member = $this->reachableMembers()->first();
+        if ($member instanceof NetworkServer) {
+            ServerLog::withNetwork(
+                $this->network->id,
+                fn () => ServerLog::log($member->server, 'network-handshake-poll-failed', $e->getMessage()),
+            );
+        }
+    }
+
+    /**
+     * @param  array<string, int>  $handshakes
+     */
+    private function apply(array $handshakes): void
+    {
+        foreach ($this->network->peers()->get() as $peer) {
+            $epoch = $handshakes[$peer->public_key] ?? 0;
+            if ($epoch <= 0) {
+                continue;
+            }
+
+            $seenAt = Carbon::createFromTimestamp($epoch);
+            if ($peer->last_handshake_at !== null && $peer->last_handshake_at->greaterThanOrEqualTo($seenAt)) {
+                continue;
+            }
+
+            $peer->last_handshake_at = $seenAt;
+            $peer->save();
+
+            SocketEvent::dispatch(new SocketEventDTO(
+                projectId: $this->network->project_id,
+                type: 'network-peer.updated',
+                data: new NetworkPeerResource($peer),
+            ));
+        }
+    }
+
+    /**
+     * @return Collection<int, NetworkServer>
+     */
+    private function reachableMembers(): Collection
+    {
+        return $this->network->servers()
+            ->where('status', NetworkServerStatus::ACTIVE)
+            ->whereHas('server', fn ($query) => $query->whereIn('status', [ServerStatus::READY, ServerStatus::UPDATING]))
+            ->with('server')
+            ->orderBy('id')
+            ->get();
+    }
+}
diff --git a/app/Jobs/Network/SyncNetworkServerJob.php b/app/Jobs/Network/SyncNetworkServerJob.php
new file mode 100644
index 000000000..ad1aada31
--- /dev/null
+++ b/app/Jobs/Network/SyncNetworkServerJob.php
@@ -0,0 +1,226 @@
+<?php
+
+namespace App\Jobs\Network;
+
+use App\Actions\Network\MaterializeServerNetworkRules;
+use App\Actions\Network\RecomputeNetworkStatus;
+use App\DTOs\SocketEventDTO;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkType;
+use App\Enums\ServiceStatus;
+use App\Events\SocketEvent;
+use App\Http\Resources\NetworkServerResource;
+use App\Models\NetworkServer;
+use App\Models\Server;
+use App\Models\ServerLog;
+use App\Models\Service;
+use App\Services\Firewall\Firewall;
+use App\Services\VPN\WireGuard;
+use App\Traits\UniqueQueue;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Queue\Queueable;
+use Throwable;
+
+class SyncNetworkServerJob implements ShouldQueue
+{
+    use Queueable;
+    use UniqueQueue;
+
+    public function __construct(protected NetworkServer $member, protected bool $teardown = false) {}
+
+    public function handle(): void
+    {
+        $this->run("server-{$this->member->server_id}", function (): void {
+            if (! $this->claim()) {
+                return;
+            }
+
+            ServerLog::withNetwork($this->member->network_id, function (): void {
+                if ($this->teardown) {
+                    $this->tearDown();
+
+                    return;
+                }
+
+                $this->syncToPresent();
+            });
+        });
+    }
+
+    /**
+     * The membership is serialised at dispatch time, so a queued job can outlive the state
+     * it was queued for — a removal turns a pending sync stale, and a completed teardown
+     * leaves no row at all. Re-read under the per-server queue lock and only proceed while
+     * the membership still holds the status this job was dispatched to act on.
+     */
+    private function claim(): bool
+    {
+        $fresh = NetworkServer::query()->whereKey($this->member->id)->first();
+
+        if (! $fresh instanceof NetworkServer) {
+            return false;
+        }
+
+        $expected = $this->teardown ? NetworkServerStatus::LEAVING : NetworkServerStatus::UPDATING;
+
+        if ($fresh->status !== $expected) {
+            return false;
+        }
+
+        $this->member = $fresh;
+
+        return true;
+    }
+
+    public function failed(Throwable $e): void
+    {
+        ServerLog::withNetwork($this->member->network_id, function () use ($e): void {
+            if ($this->teardown) {
+                ServerLog::log($this->member->server, 'network-teardown-failed', $e->getMessage());
+                app(RecomputeNetworkStatus::class)->handle($this->member->network);
+
+                return;
+            }
+
+            $failed = NetworkServer::query()
+                ->whereKey($this->member->id)
+                ->whereIn('status', [
+                    NetworkServerStatus::ACTIVE,
+                    NetworkServerStatus::PENDING,
+                    NetworkServerStatus::UPDATING,
+                ])
+                ->update(['status' => NetworkServerStatus::FAILED]);
+
+            if ($failed === 1) {
+                $this->broadcastMember();
+            }
+
+            ServerLog::log($this->member->server, 'network-sync-failed', $e->getMessage());
+
+            app(RecomputeNetworkStatus::class)->handle($this->member->network);
+        });
+    }
+
+    private function syncToPresent(): void
+    {
+        $network = $this->member->network;
+
+        if ($network->type === NetworkType::WIREGUARD) {
+            /** @var WireGuard $handler */
+            $handler = $this->wireGuardService()->handler();
+            $handler->configureNetwork($this->member);
+        }
+
+        $this->applyFirewall();
+
+        $this->member->status = NetworkServerStatus::ACTIVE;
+        $this->member->sync_attempts = 0;
+        $this->member->save();
+
+        $this->broadcastMember();
+        app(RecomputeNetworkStatus::class)->handle($network);
+    }
+
+    private function tearDown(): void
+    {
+        $network = $this->member->network;
+        $server = $this->member->server;
+
+        if ($network->type === NetworkType::WIREGUARD) {
+            $service = $server->service(WireGuard::type());
+            if ($service instanceof Service) {
+                /** @var WireGuard $handler */
+                $handler = $service->handler();
+                $handler->removeNetwork($network);
+            }
+
+            $this->maybeUninstallWireGuard($server);
+        }
+
+        $this->applyFirewall();
+
+        $projectId = $network->project_id;
+        $memberId = $this->member->id;
+        $this->member->delete();
+
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $projectId,
+            type: 'network-server.deleted',
+            data: ['id' => $memberId],
+        ));
+
+        app(RecomputeNetworkStatus::class)->handle($network);
+    }
+
+    private function applyFirewall(): void
+    {
+        app(MaterializeServerNetworkRules::class)->forServer($this->member->server);
+
+        $service = $this->member->server->firewall();
+        if (! $service instanceof Service) {
+            return;
+        }
+
+        /** @var Firewall $handler */
+        $handler = $service->handler();
+        $handler->applyRules();
+    }
+
+    private function maybeUninstallWireGuard(Server $server): void
+    {
+        $hasOther = NetworkServer::query()
+            ->where('server_id', $server->id)
+            ->where('id', '!=', $this->member->id)
+            ->whereHas('network', fn ($query) => $query->where('type', NetworkType::WIREGUARD))
+            ->exists();
+
+        if ($hasOther) {
+            return;
+        }
+
+        $service = $server->service(WireGuard::type());
+        if ($service instanceof Service) {
+            $service->handler()->uninstall();
+            $service->delete();
+        }
+    }
+
+    private function wireGuardService(): Service
+    {
+        $server = $this->member->server;
+        $service = $server->service(WireGuard::type());
+
+        if ($service instanceof Service && $service->status === ServiceStatus::READY) {
+            return $service;
+        }
+
+        if (! $service instanceof Service) {
+            /** @var Service $service */
+            $service = $server->services()->create([
+                'type' => WireGuard::type(),
+                'name' => WireGuard::id(),
+                'version' => 'latest',
+                'status' => ServiceStatus::INSTALLING,
+            ]);
+        }
+
+        $service->newLog();
+        $service->handler()->install();
+        $service->status = ServiceStatus::READY;
+        $service->installed_version = $service->handler()->version();
+        $service->save();
+
+        return $service;
+    }
+
+    private function broadcastMember(): void
+    {
+        $this->member->refresh()->load('server', 'serverIpAddress');
+
+        SocketEvent::dispatch(new SocketEventDTO(
+            projectId: $this->member->network->project_id,
+            type: 'network-server.updated',
+            data: new NetworkServerResource($this->member),
+        ));
+    }
+}
diff --git a/app/Jobs/Network/SyncProviderNetworksJob.php b/app/Jobs/Network/SyncProviderNetworksJob.php
new file mode 100644
index 000000000..3c9c9d38b
--- /dev/null
+++ b/app/Jobs/Network/SyncProviderNetworksJob.php
@@ -0,0 +1,98 @@
+<?php
+
+namespace App\Jobs\Network;
+
+use App\Actions\Network\SyncProviderNetworks;
+use App\Exceptions\PrivateNetworkPersistError;
+use App\Exceptions\PrivateNetworkSyncError;
+use App\Facades\Notifier;
+use App\Models\Network;
+use App\Models\Project;
+use App\Notifications\GenericNotification;
+use App\Traits\UniqueQueue;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Queue\Queueable;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+use Throwable;
+
+class SyncProviderNetworksJob implements ShouldQueue
+{
+    use Queueable;
+    use UniqueQueue;
+
+    /**
+     * The `default` Horizon supervisor runs a 90s timeout. A sweep across several
+     * connections and paginated pages exceeds that, and a SIGKILLed worker never runs
+     * `UniqueQueue`'s `finally`, so the lock would survive for its full duration and
+     * block every later sync. Declared here because Laravel prefers the job's own
+     * timeout over the supervisor's.
+     */
+    public int $timeout = 300;
+
+    public function __construct(
+        protected Project $project,
+        protected ?Network $network = null,
+    ) {}
+
+    /**
+     * `UniqueQueue` serialises rather than de-duplicates — a contended job releases and
+     * retries, so repeated clicks would each run a full provider sweep and invite 429s.
+     * De-duplication therefore has to happen before dispatch.
+     */
+    public static function dispatchUnlessRecent(Project $project, ?Network $network = null): bool
+    {
+        $scope = $network instanceof Network ? (string) $network->id : 'all';
+        $key = 'provider-networks:'.$project->id.':'.$scope;
+
+        if (! Cache::add($key, true, 30)) {
+            return false;
+        }
+
+        dispatch(new self($project, $network));
+
+        return true;
+    }
+
+    protected function lockSeconds(): int
+    {
+        return $this->timeout + 60;
+    }
+
+    public function handle(): void
+    {
+        $this->run("provider-networks-{$this->project->id}", function (): void {
+            app(SyncProviderNetworks::class)->forProject($this->project, $this->network);
+        });
+    }
+
+    /**
+     * The sweep is user-triggered from a button that only flashes "syncing", so a failure has
+     * to be surfaced somewhere the user will see it rather than only in the job log.
+     */
+    public function failed(Throwable $e): void
+    {
+        Log::warning('Provider network sync job failed.', [
+            'project_id' => $this->project->id,
+            'network_id' => $this->network?->id,
+            'exception' => $e::class,
+            'reason' => $this->safeReason($e),
+        ]);
+
+        Notifier::send($this->project, new GenericNotification(
+            __('Could not sync private networks from your cloud providers. Check the provider connection and its permissions.')
+        ));
+    }
+
+    /**
+     * Only the sweep's own exceptions are built to be credential-free. Anything else — a driver
+     * or HTTP client exception, say — can carry a token or a connection string in its message,
+     * and this log is written verbatim.
+     */
+    private function safeReason(Throwable $e): ?string
+    {
+        return $e instanceof PrivateNetworkSyncError || $e instanceof PrivateNetworkPersistError
+            ? $e->getMessage()
+            : null;
+    }
+}
diff --git a/app/Models/Network.php b/app/Models/Network.php
new file mode 100644
index 000000000..1c99e481b
--- /dev/null
+++ b/app/Models/Network.php
@@ -0,0 +1,119 @@
+<?php
+
+namespace App\Models;
+
+use App\Enums\NetworkAddressingPool;
+use App\Enums\NetworkStatus;
+use App\Enums\NetworkType;
+use Database\Factories\NetworkFactory;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Support\Carbon;
+
+/**
+ * @property int $id
+ * @property int $project_id
+ * @property string $name
+ * @property NetworkType $type
+ * @property NetworkStatus $status
+ * @property NetworkAddressingPool $addressing_pool
+ * @property ?string $cidr
+ * @property ?string $cidr_canonical
+ * @property ?int $port
+ * @property ?int $server_provider_id
+ * @property ?string $external_id
+ * @property ?string $region
+ * @property ?Carbon $last_synced_at
+ * @property Project $project
+ * @property ?ServerProvider $serverProvider
+ * @property Collection<int, NetworkServer> $servers
+ * @property Collection<int, NetworkFirewallRule> $firewallRules
+ * @property Collection<int, NetworkPeer> $peers
+ * @property Collection<int, ServerNetworkRule> $serverRules
+ * @property Collection<int, ServerLog> $serverLogs
+ */
+class Network extends AbstractModel
+{
+    /** @use HasFactory<NetworkFactory> */
+    use HasFactory;
+
+    protected $fillable = [
+        'project_id',
+        'name',
+        'type',
+        'status',
+        'addressing_pool',
+        'cidr',
+        'cidr_canonical',
+        'port',
+        'region',
+    ];
+
+    protected $casts = [
+        'project_id' => 'integer',
+        'port' => 'integer',
+        'server_provider_id' => 'integer',
+        'last_synced_at' => 'datetime',
+        'type' => NetworkType::class,
+        'status' => NetworkStatus::class,
+        'addressing_pool' => NetworkAddressingPool::class,
+    ];
+
+    /**
+     * @return BelongsTo<Project, covariant $this>
+     */
+    public function project(): BelongsTo
+    {
+        return $this->belongsTo(Project::class);
+    }
+
+    /**
+     * @return BelongsTo<ServerProvider, covariant $this>
+     */
+    public function serverProvider(): BelongsTo
+    {
+        return $this->belongsTo(ServerProvider::class);
+    }
+
+    /**
+     * @return HasMany<NetworkServer, covariant $this>
+     */
+    public function servers(): HasMany
+    {
+        return $this->hasMany(NetworkServer::class);
+    }
+
+    /**
+     * @return HasMany<NetworkFirewallRule, covariant $this>
+     */
+    public function firewallRules(): HasMany
+    {
+        return $this->hasMany(NetworkFirewallRule::class);
+    }
+
+    /**
+     * @return HasMany<ServerNetworkRule, covariant $this>
+     */
+    public function serverRules(): HasMany
+    {
+        return $this->hasMany(ServerNetworkRule::class);
+    }
+
+    /**
+     * @return HasMany<NetworkPeer, covariant $this>
+     */
+    public function peers(): HasMany
+    {
+        return $this->hasMany(NetworkPeer::class);
+    }
+
+    /**
+     * @return HasMany<ServerLog, covariant $this>
+     */
+    public function serverLogs(): HasMany
+    {
+        return $this->hasMany(ServerLog::class);
+    }
+}
diff --git a/app/Models/NetworkFirewallRule.php b/app/Models/NetworkFirewallRule.php
new file mode 100644
index 000000000..1b973053c
--- /dev/null
+++ b/app/Models/NetworkFirewallRule.php
@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Models;
+
+use App\Enums\FirewallRuleStatus;
+use Database\Factories\NetworkFirewallRuleFactory;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+/**
+ * @property int $id
+ * @property int $network_id
+ * @property string $name
+ * @property ?string $protocol
+ * @property ?string $port
+ * @property FirewallRuleStatus $status
+ * @property Network $network
+ * @property Collection<int, ServerNetworkRule> $serverRules
+ */
+class NetworkFirewallRule extends AbstractModel
+{
+    /** @use HasFactory<NetworkFirewallRuleFactory> */
+    use HasFactory;
+
+    protected $fillable = [
+        'network_id',
+        'name',
+        'protocol',
+        'port',
+        'status',
+    ];
+
+    protected $casts = [
+        'network_id' => 'integer',
+        'status' => FirewallRuleStatus::class,
+    ];
+
+    /**
+     * @return BelongsTo<Network, covariant $this>
+     */
+    public function network(): BelongsTo
+    {
+        return $this->belongsTo(Network::class);
+    }
+
+    /**
+     * @return HasMany<ServerNetworkRule, covariant $this>
+     */
+    public function serverRules(): HasMany
+    {
+        return $this->hasMany(ServerNetworkRule::class);
+    }
+}
diff --git a/app/Models/NetworkPeer.php b/app/Models/NetworkPeer.php
new file mode 100644
index 000000000..19aa91b4e
--- /dev/null
+++ b/app/Models/NetworkPeer.php
@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Models;
+
+use App\Enums\NetworkPeerStatus;
+use Database\Factories\NetworkPeerFactory;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Support\Carbon;
+
+/**
+ * @property int $id
+ * @property int $network_id
+ * @property string $name
+ * @property string $ip
+ * @property string $public_key
+ * @property ?string $private_key
+ * @property bool $byo
+ * @property NetworkPeerStatus $status
+ * @property ?Carbon $last_handshake_at
+ * @property int $sync_attempts
+ * @property Network $network
+ */
+class NetworkPeer extends AbstractModel
+{
+    /** @use HasFactory<NetworkPeerFactory> */
+    use HasFactory;
+
+    protected $fillable = [
+        'network_id',
+        'name',
+        'ip',
+        'public_key',
+        'private_key',
+        'byo',
+        'status',
+        'last_handshake_at',
+    ];
+
+    protected $casts = [
+        'network_id' => 'integer',
+        'status' => NetworkPeerStatus::class,
+        'private_key' => 'encrypted',
+        'byo' => 'boolean',
+        'last_handshake_at' => 'datetime',
+        'sync_attempts' => 'integer',
+    ];
+
+    protected $hidden = [
+        'private_key',
+    ];
+
+    /**
+     * Whether Vito still holds this peer's private key. False once the key has been revealed
+     * and concealed, and always false for peers that brought their own key.
+     */
+    public function hasPrivateKey(): bool
+    {
+        return ! $this->byo && $this->private_key !== null;
+    }
+
+    /**
+     * @return BelongsTo<Network, covariant $this>
+     */
+    public function network(): BelongsTo
+    {
+        return $this->belongsTo(Network::class);
+    }
+}
diff --git a/app/Models/NetworkServer.php b/app/Models/NetworkServer.php
new file mode 100644
index 000000000..1a8fad7f9
--- /dev/null
+++ b/app/Models/NetworkServer.php
@@ -0,0 +1,85 @@
+<?php
+
+namespace App\Models;
+
+use App\Enums\NetworkServerStatus;
+use Database\Factories\NetworkServerFactory;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+/**
+ * @property int $id
+ * @property int $network_id
+ * @property int $server_id
+ * @property ?int $server_ip_address_id
+ * @property ?string $ip
+ * @property ?string $public_key
+ * @property ?string $private_key
+ * @property NetworkServerStatus $status
+ * @property int $sync_attempts
+ * @property Network $network
+ * @property Server $server
+ * @property ?ServerIpAddress $serverIpAddress
+ */
+class NetworkServer extends AbstractModel
+{
+    /** @use HasFactory<NetworkServerFactory> */
+    use HasFactory;
+
+    protected $fillable = [
+        'network_id',
+        'server_id',
+        'server_ip_address_id',
+        'ip',
+        'public_key',
+        'private_key',
+        'status',
+        'sync_attempts',
+    ];
+
+    protected $casts = [
+        'network_id' => 'integer',
+        'server_id' => 'integer',
+        'server_ip_address_id' => 'integer',
+        'sync_attempts' => 'integer',
+        'status' => NetworkServerStatus::class,
+        'private_key' => 'encrypted',
+    ];
+
+    protected $hidden = [
+        'private_key',
+    ];
+
+    /**
+     * @return BelongsTo<Network, covariant $this>
+     */
+    public function network(): BelongsTo
+    {
+        return $this->belongsTo(Network::class);
+    }
+
+    /**
+     * @return BelongsTo<Server, covariant $this>
+     */
+    public function server(): BelongsTo
+    {
+        return $this->belongsTo(Server::class);
+    }
+
+    /**
+     * @return BelongsTo<ServerIpAddress, covariant $this>
+     */
+    public function serverIpAddress(): BelongsTo
+    {
+        return $this->belongsTo(ServerIpAddress::class);
+    }
+
+    /**
+     * @return HasMany<ServerNetworkRule, covariant $this>
+     */
+    public function rules(): HasMany
+    {
+        return $this->hasMany(ServerNetworkRule::class);
+    }
+}
diff --git a/app/Models/Project.php b/app/Models/Project.php
index e7058b6b3..ff623e363 100644
--- a/app/Models/Project.php
+++ b/app/Models/Project.php
@@ -27,6 +27,7 @@
  * @property Collection<int, User> $registeredUsers
  * @property Collection<int, Workflow> $workflows
  * @property Collection<int, Domain> $domains
+ * @property Collection<int, Network> $networks
  */
 class Project extends Model
 {
@@ -126,4 +127,12 @@ public function domains(): HasMany
     {
         return $this->hasMany(Domain::class);
     }
+
+    /**
+     * @return HasMany<Network, covariant $this>
+     */
+    public function networks(): HasMany
+    {
+        return $this->hasMany(Network::class);
+    }
 }
diff --git a/app/Models/Server.php b/app/Models/Server.php
index 7596fc5aa..c631bb0bc 100755
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Actions\Network\ResyncNetworkSiblings;
 use App\Actions\Server\CheckConnection;
 use App\Enums\OperatingSystem;
 use App\Enums\SecurityControlStatus;
@@ -124,10 +125,25 @@ class Server extends AbstractModel
 
     public bool $deleteFromProvider = true;
 
+    /**
+     * Carried between the two events because the membership rows are gone by the second.
+     *
+     * @var array{members: array<int, int>, networks: array<int, int>}
+     */
+    protected array $networkDeparture = ['members' => [], 'networks' => []];
+
     public static function boot(): void
     {
         parent::boot();
 
+        static::deleting(function (Server $server): void {
+            $server->networkDeparture = app(ResyncNetworkSiblings::class)->capture($server);
+        });
+
+        static::deleted(function (Server $server): void {
+            app(ResyncNetworkSiblings::class)->handle($server->networkDeparture);
+        });
+
         static::deleting(function (Server $server): void {
             DB::beginTransaction();
             try {
@@ -275,6 +291,14 @@ public function firewallRules(): HasMany
         return $this->hasMany(FirewallRule::class);
     }
 
+    /**
+     * @return HasMany<ServerNetworkRule, covariant $this>
+     */
+    public function networkRules(): HasMany
+    {
+        return $this->hasMany(ServerNetworkRule::class);
+    }
+
     /**
      * @return HasMany<ServerIpAddress, covariant $this>
      */
diff --git a/app/Models/ServerIpAddress.php b/app/Models/ServerIpAddress.php
index 372510fc5..f9d8fdb00 100644
--- a/app/Models/ServerIpAddress.php
+++ b/app/Models/ServerIpAddress.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Actions\Network\RemoveMembershipsForAddress;
 use App\Enums\IpAddressFamily;
 use App\Enums\IpAddressStatus;
 use App\Enums\IpAddressType;
@@ -45,6 +46,25 @@ class ServerIpAddress extends AbstractModel
         'status' => IpAddressStatus::class,
     ];
 
+    /**
+     * Carried between the two events because the foreign key is nullOnDelete, so by the second
+     * nothing records which memberships this address backed.
+     *
+     * @var array<int, int>
+     */
+    protected array $reapplyNetworkIds = [];
+
+    protected static function booted(): void
+    {
+        static::deleting(function (ServerIpAddress $address): void {
+            $address->reapplyNetworkIds = app(RemoveMembershipsForAddress::class)->capture($address);
+        });
+
+        static::deleted(function (ServerIpAddress $address): void {
+            app(RemoveMembershipsForAddress::class)->handle($address->server_id, $address->reapplyNetworkIds);
+        });
+    }
+
     /**
      * @return BelongsTo<Server, covariant $this>
      */
diff --git a/app/Models/ServerLog.php b/app/Models/ServerLog.php
index 3ac190b2d..fa21fa040 100755
--- a/app/Models/ServerLog.php
+++ b/app/Models/ServerLog.php
@@ -6,6 +6,7 @@
 use App\Events\SocketEvent;
 use App\Http\Resources\ServerLogResource;
 use App\SSH\OS\OS;
+use Closure;
 use Database\Factories\ServerLogFactory;
 use Exception;
 use Illuminate\Database\Eloquent\Builder;
@@ -21,21 +22,26 @@
 /**
  * @property int $server_id
  * @property ?int $site_id
+ * @property ?int $network_id
  * @property string $type
  * @property string $name
  * @property string $disk
  * @property bool $is_remote
  * @property Server $server
  * @property ?Site $site
+ * @property ?Network $network
  */
 class ServerLog extends AbstractModel
 {
     /** @use HasFactory<ServerLogFactory> */
     use HasFactory;
 
+    private static ?int $networkContext = null;
+
     protected $fillable = [
         'server_id',
         'site_id',
+        'network_id',
         'type',
         'name',
         'disk',
@@ -45,9 +51,32 @@ class ServerLog extends AbstractModel
     protected $casts = [
         'server_id' => 'integer',
         'site_id' => 'integer',
+        'network_id' => 'integer',
         'is_remote' => 'boolean',
     ];
 
+    /**
+     * Associate every ServerLog created inside $callback with $networkId. Lets
+     * logs produced deep in the SSH/Service layers during a network sync be
+     * tagged without threading the network through every call site.
+     *
+     * @template TReturn
+     *
+     * @param  Closure(): TReturn  $callback
+     * @return TReturn
+     */
+    public static function withNetwork(?int $networkId, Closure $callback): mixed
+    {
+        $previous = self::$networkContext;
+        self::$networkContext = $networkId;
+
+        try {
+            return $callback();
+        } finally {
+            self::$networkContext = $previous;
+        }
+    }
+
     public static function boot(): void
     {
         parent::boot();
@@ -98,6 +127,14 @@ public function site(): BelongsTo
         return $this->belongsTo(Site::class);
     }
 
+    /**
+     * @return BelongsTo<Network, $this>
+     */
+    public function network(): BelongsTo
+    {
+        return $this->belongsTo(Network::class);
+    }
+
     /**
      * @throws Throwable
      */
@@ -193,6 +230,7 @@ public static function log(Server $server, string $type, string $content, ?Site
         $log = new self([
             'server_id' => $server->id,
             'site_id' => $site?->id,
+            'network_id' => self::$networkContext,
             'name' => $server->id.'-'.strtotime('now').'-'.$type.'.log',
             'type' => $type,
             'disk' => config('core.logs_disk'),
@@ -207,6 +245,7 @@ public static function newLog(Server $server, string $type): ServerLog
     {
         return new self([
             'server_id' => $server->id,
+            'network_id' => self::$networkContext,
             'name' => $server->id.'-'.strtotime('now').'-'.$type.'.log',
             'type' => $type,
             'disk' => config('core.logs_disk'),
diff --git a/app/Models/ServerNetworkRule.php b/app/Models/ServerNetworkRule.php
new file mode 100644
index 000000000..3c1b7f117
--- /dev/null
+++ b/app/Models/ServerNetworkRule.php
@@ -0,0 +1,110 @@
+<?php
+
+namespace App\Models;
+
+use App\Enums\FirewallRuleStatus;
+use App\Enums\ServerNetworkRuleKind;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\Relation;
+use Illuminate\Database\Query\Builder as QueryBuilder;
+
+/**
+ * @property int $id
+ * @property int $server_id
+ * @property int $network_id
+ * @property int $network_server_id
+ * @property ?int $network_firewall_rule_id
+ * @property ServerNetworkRuleKind $kind
+ * @property string $name
+ * @property string $type
+ * @property ?string $protocol
+ * @property ?string $port
+ * @property ?string $source
+ * @property ?int $mask
+ * @property FirewallRuleStatus $status
+ * @property Server $server
+ * @property Network $network
+ * @property NetworkServer $networkServer
+ * @property ?NetworkFirewallRule $networkFirewallRule
+ */
+class ServerNetworkRule extends AbstractModel
+{
+    protected $fillable = [
+        'server_id',
+        'network_id',
+        'network_server_id',
+        'network_firewall_rule_id',
+        'kind',
+        'name',
+        'type',
+        'protocol',
+        'port',
+        'source',
+        'mask',
+        'status',
+    ];
+
+    protected $casts = [
+        'server_id' => 'integer',
+        'network_id' => 'integer',
+        'network_server_id' => 'integer',
+        'network_firewall_rule_id' => 'integer',
+        'mask' => 'integer',
+        'kind' => ServerNetworkRuleKind::class,
+        'status' => FirewallRuleStatus::class,
+    ];
+
+    /**
+     * Network rows first (handshakes, then rules by network), stable by id.
+     *
+     * @param  Builder<ServerNetworkRule>|QueryBuilder|Relation<ServerNetworkRule, covariant AbstractModel, *>  $query
+     */
+    public static function applyOrder(Builder|QueryBuilder|Relation $query): void
+    {
+        $query
+            ->orderByRaw('case when kind = ? then 0 else 1 end', [ServerNetworkRuleKind::HANDSHAKE->value])
+            ->orderBy('network_id')
+            ->orderBy('id');
+    }
+
+    /**
+     * @param  Builder<ServerNetworkRule>  $query
+     */
+    public function scopeOrdered(Builder $query): void
+    {
+        self::applyOrder($query);
+    }
+
+    /**
+     * @return BelongsTo<Server, covariant $this>
+     */
+    public function server(): BelongsTo
+    {
+        return $this->belongsTo(Server::class);
+    }
+
+    /**
+     * @return BelongsTo<Network, covariant $this>
+     */
+    public function network(): BelongsTo
+    {
+        return $this->belongsTo(Network::class);
+    }
+
+    /**
+     * @return BelongsTo<NetworkServer, covariant $this>
+     */
+    public function networkServer(): BelongsTo
+    {
+        return $this->belongsTo(NetworkServer::class);
+    }
+
+    /**
+     * @return BelongsTo<NetworkFirewallRule, covariant $this>
+     */
+    public function networkFirewallRule(): BelongsTo
+    {
+        return $this->belongsTo(NetworkFirewallRule::class);
+    }
+}
diff --git a/app/Policies/NetworkPolicy.php b/app/Policies/NetworkPolicy.php
new file mode 100644
index 000000000..7bed0bd6b
--- /dev/null
+++ b/app/Policies/NetworkPolicy.php
@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Policies;
+
+use App\Actions\Network\CheckNetworkStranding;
+use App\Enums\NetworkType;
+use App\Models\Network;
+use App\Models\Project;
+use App\Models\User;
+use App\Traits\HasRolePolicies;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class NetworkPolicy
+{
+    use HandlesAuthorization;
+    use HasRolePolicies;
+
+    public function viewAny(User $user, Project $project): bool
+    {
+        return $this->hasReadAccess($user, $project);
+    }
+
+    public function view(User $user, Network $network): bool
+    {
+        return $this->hasReadAccess($user, $network->project);
+    }
+
+    public function create(User $user, Project $project): bool
+    {
+        return $this->hasWriteAccess($user, $project);
+    }
+
+    public function update(User $user, Network $network): bool
+    {
+        return $this->hasWriteAccess($user, $network->project);
+    }
+
+    /**
+     * Provider-managed networks mirror the cloud provider and are removed by sync when the
+     * VPC disappears. One that sync can never reach again — its connection deleted, or no
+     * member still identifiable at the provider — stays deletable to avoid stranding the row.
+     */
+    public function delete(User $user, Network $network): bool
+    {
+        if ($network->type === NetworkType::PROVIDER
+            && $network->server_provider_id !== null
+            && ! app(CheckNetworkStranding::class)->handle($network)) {
+            return false;
+        }
+
+        return $this->hasWriteAccess($user, $network->project);
+    }
+}
diff --git a/app/Providers/ServiceTypeServiceProvider.php b/app/Providers/ServiceTypeServiceProvider.php
index c7b4ee96f..c7aefae5e 100644
--- a/app/Providers/ServiceTypeServiceProvider.php
+++ b/app/Providers/ServiceTypeServiceProvider.php
@@ -16,6 +16,7 @@
 use App\Services\ProcessManager\Supervisor;
 use App\Services\Redis\Redis;
 use App\Services\Valkey\Valkey;
+use App\Services\VPN\WireGuard;
 use App\Services\Webserver\Caddy;
 use App\Services\Webserver\Nginx;
 use Illuminate\Support\ServiceProvider;
@@ -36,6 +37,7 @@ public function boot(): void
         $this->logAnalysis();
         $this->php();
         $this->node();
+        $this->vpn();
     }
 
     private function webservers(): void
@@ -293,4 +295,13 @@ private function node(): void
             ])
             ->register();
     }
+
+    private function vpn(): void
+    {
+        RegisterServiceType::make(WireGuard::id())
+            ->type(WireGuard::type())
+            ->label('WireGuard')
+            ->handler(WireGuard::class)
+            ->register();
+    }
 }
diff --git a/app/ServerProviders/AWS.php b/app/ServerProviders/AWS.php
index 7c934138f..838920b6f 100755
--- a/app/ServerProviders/AWS.php
+++ b/app/ServerProviders/AWS.php
@@ -2,6 +2,8 @@
 
 namespace App\ServerProviders;
 
+use App\DTOs\PrivateNetworkDTO;
+use App\DTOs\PrivateNetworkMemberDTO;
 use App\Enums\OperatingSystem;
 use App\Exceptions\CouldNotConnectToProvider;
 use App\Facades\Notifier;
@@ -12,7 +14,7 @@
 use Illuminate\Support\Facades\Storage;
 use Throwable;
 
-class AWS extends AbstractProvider
+class AWS extends AbstractProvider implements ProvidesPrivateNetworks
 {
     protected Ec2Client $ec2Client;
 
@@ -21,6 +23,292 @@ public static function id(): string
         return 'aws';
     }
 
+    public function instanceIdKey(): string
+    {
+        return 'instance_id';
+    }
+
+    /**
+     * EC2 is queried per region, so a region that was never collected is never asked about. With
+     * no regions at all, or with a server whose region is unknown, the result is incomplete for
+     * want of asking rather than because the VPCs are gone — saying so keeps sync from pruning
+     * a network whose members live in a region this run could not reach.
+     *
+     * @param  array<int, string>  $regions
+     */
+    public function canDiscoverPrivateNetworks(array $regions, int $serversWithoutRegion): bool
+    {
+        return $regions !== [] && $serversWithoutRegion === 0;
+    }
+
+    /**
+     * EC2 is regional, so each region is queried with its own client. A region failure aborts
+     * the whole connection rather than returning partial results: the caller only skips
+     * pruning per connection, and returning a partial view would let it delete networks that
+     * live in the region that failed.
+     */
+    public function privateNetworks(array $instanceIds, array $regions): array
+    {
+        $result = [];
+
+        foreach ($regions as $region) {
+            try {
+                $client = $this->networkClient($region);
+
+                $reservations = $this->paginate($client, 'DescribeInstances', [
+                    'Filters' => [
+                        ['Name' => 'instance-id', 'Values' => array_values($instanceIds)],
+                    ],
+                ], 'Reservations');
+
+                $vpcIds = $this->vpcIdsFrom($reservations);
+
+                $vpcs = $vpcIds === [] ? [] : $this->paginate($client, 'DescribeVpcs', [
+                    'Filters' => [
+                        ['Name' => 'vpc-id', 'Values' => $vpcIds],
+                    ],
+                ], 'Vpcs');
+            } catch (Throwable) {
+                throw $this->syncError(null, $region);
+            }
+
+            foreach ($this->mapPrivateNetworks($reservations, $vpcs, $instanceIds, $region) as $network) {
+                $result[] = $network;
+            }
+        }
+
+        return $result;
+    }
+
+    /**
+     * Public so it can be exercised without an EC2 client — the SDK has no HTTP-level fake
+     * equivalent to `Http::fake()` in this codebase. Not part of the provider contract.
+     *
+     * @internal
+     *
+     * @param  array<int, array<string, mixed>>  $reservations
+     * @param  array<int, array<string, mixed>>  $vpcs
+     * @param  array<int, string>  $instanceIds
+     * @return array<int, PrivateNetworkDTO>
+     */
+    public function mapPrivateNetworks(array $reservations, array $vpcs, array $instanceIds, ?string $region = null): array
+    {
+        $wanted = array_flip($instanceIds);
+        $members = [];
+
+        foreach ($this->instancesFrom($reservations) as $instance) {
+            $instanceId = (string) ($instance['InstanceId'] ?? '');
+
+            if ($instanceId === '' || ! isset($wanted[$instanceId])) {
+                continue;
+            }
+
+            [$vpcId, $ip] = $this->placementOf($instance);
+
+            if ($vpcId === null) {
+                continue;
+            }
+
+            $members[$vpcId][] = new PrivateNetworkMemberDTO(instanceId: $instanceId, ip: $ip);
+        }
+
+        $result = [];
+
+        foreach ($vpcs as $vpc) {
+            $vpcId = (string) ($vpc['VpcId'] ?? '');
+
+            if (! isset($members[$vpcId])) {
+                continue;
+            }
+
+            $result[] = new PrivateNetworkDTO(
+                externalId: $vpcId,
+                name: $this->nameOf($vpc, $vpcId),
+                cidr: $this->cidrOf($vpc),
+                region: $region,
+                members: $members[$vpcId],
+            );
+        }
+
+        return $result;
+    }
+
+    /**
+     * Reads the primary network interface (device index 0), falling back to the first usable
+     * one and then to the instance's top-level fields, both of which are optional. On a
+     * multi-ENI instance the interfaces are not returned in a guaranteed order, so taking the
+     * first would risk reporting a secondary interface's address.
+     *
+     * @param  array<string, mixed>  $instance
+     * @return array{0: ?string, 1: ?string}
+     */
+    private function placementOf(array $instance): array
+    {
+        $interfaces = $instance['NetworkInterfaces'] ?? [];
+
+        $primary = null;
+
+        foreach ($interfaces as $interface) {
+            if ((int) ($interface['Attachment']['DeviceIndex'] ?? -1) === 0) {
+                $primary = $interface;
+
+                break;
+            }
+        }
+
+        foreach ($primary !== null ? [$primary] : $interfaces as $interface) {
+            $vpcId = $interface['VpcId'] ?? null;
+
+            if (is_string($vpcId) && $vpcId !== '') {
+                return [$vpcId, $this->addressOf($interface)];
+            }
+        }
+
+        $vpcId = $instance['VpcId'] ?? null;
+
+        return [
+            is_string($vpcId) && $vpcId !== '' ? $vpcId : null,
+            $this->addressOf($instance),
+        ];
+    }
+
+    /**
+     * A VPC always carries an IPv4 range unless it was created IPv6-only, in which case its
+     * range lives in the association set. A dual-stack VPC is recorded by its IPv4 range,
+     * since a network holds a single range.
+     *
+     * @param  array<string, mixed>  $vpc
+     */
+    private function cidrOf(array $vpc): ?string
+    {
+        $cidr = $vpc['CidrBlock'] ?? null;
+
+        if (is_string($cidr) && $cidr !== '') {
+            return $cidr;
+        }
+
+        foreach ($vpc['Ipv6CidrBlockAssociationSet'] ?? [] as $association) {
+            $cidr = $association['Ipv6CidrBlock'] ?? null;
+
+            if (is_string($cidr) && $cidr !== '') {
+                return $cidr;
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * An IPv6-only instance has no `PrivateIpAddress`, so its address has to be read from the
+     * IPv6 fields — without this it would join its network with no address at all.
+     *
+     * @param  array<string, mixed>  $source
+     */
+    private function addressOf(array $source): ?string
+    {
+        $ip = $source['PrivateIpAddress'] ?? null;
+
+        if (is_string($ip) && $ip !== '') {
+            return $ip;
+        }
+
+        foreach ($source['Ipv6Addresses'] ?? [] as $address) {
+            $ipv6 = $address['Ipv6Address'] ?? null;
+
+            if (is_string($ipv6) && $ipv6 !== '') {
+                return $ipv6;
+            }
+        }
+
+        $ipv6 = $source['Ipv6Address'] ?? null;
+
+        return is_string($ipv6) && $ipv6 !== '' ? $ipv6 : null;
+    }
+
+    /**
+     * @param  array<int, array<string, mixed>>  $reservations
+     * @return array<int, array<string, mixed>>
+     */
+    private function instancesFrom(array $reservations): array
+    {
+        $instances = [];
+
+        foreach ($reservations as $reservation) {
+            /** @var array<int, array<string, mixed>> $batch */
+            $batch = $reservation['Instances'] ?? [];
+            $instances = array_merge($instances, $batch);
+        }
+
+        return $instances;
+    }
+
+    /**
+     * @param  array<int, array<string, mixed>>  $reservations
+     * @return array<int, string>
+     */
+    private function vpcIdsFrom(array $reservations): array
+    {
+        $ids = [];
+
+        foreach ($this->instancesFrom($reservations) as $instance) {
+            [$vpcId] = $this->placementOf($instance);
+
+            if ($vpcId !== null && ! in_array($vpcId, $ids, true)) {
+                $ids[] = $vpcId;
+            }
+        }
+
+        return $ids;
+    }
+
+    /**
+     * @param  array<string, mixed>  $vpc
+     */
+    private function nameOf(array $vpc, string $fallback): string
+    {
+        foreach ($vpc['Tags'] ?? [] as $tag) {
+            if (($tag['Key'] ?? null) === 'Name' && is_string($tag['Value'] ?? null) && $tag['Value'] !== '') {
+                return $tag['Value'];
+            }
+        }
+
+        return $fallback;
+    }
+
+    /**
+     * EC2 list calls are paged. Reading only the first page would make instances beyond it look
+     * detached, and sync would then remove them from their network.
+     *
+     * @param  array<string, mixed>  $args
+     * @return array<int, array<string, mixed>>
+     */
+    private function paginate(Ec2Client $client, string $operation, array $args, string $key): array
+    {
+        $items = [];
+
+        foreach ($client->getPaginator($operation, $args) as $page) {
+            /** @var array<int, array<string, mixed>> $batch */
+            $batch = $page->get($key) ?? [];
+            $items = array_merge($items, $batch);
+        }
+
+        return $items;
+    }
+
+    private function networkClient(string $region): Ec2Client
+    {
+        $credentials = $this->serverProvider->getCredentials();
+
+        return new Ec2Client([
+            'region' => $region,
+            'version' => '2016-11-15',
+            'credentials' => [
+                'key' => $credentials['key'],
+                'secret' => $credentials['secret'],
+            ],
+        ]);
+    }
+
     public function createRules(array $input): array
     {
         return [
diff --git a/app/ServerProviders/AbstractProvider.php b/app/ServerProviders/AbstractProvider.php
index 3bdedf684..a3a628441 100755
--- a/app/ServerProviders/AbstractProvider.php
+++ b/app/ServerProviders/AbstractProvider.php
@@ -2,6 +2,7 @@
 
 namespace App\ServerProviders;
 
+use App\Exceptions\PrivateNetworkSyncError;
 use App\Models\Server;
 use App\Models\ServerProvider as Provider;
 use Illuminate\Filesystem\FilesystemAdapter;
@@ -22,6 +23,30 @@ public function availablePlans(?string $region): array
             ->all();
     }
 
+    /**
+     * @param  array<int, string>  $regions
+     */
+    public function canDiscoverPrivateNetworks(array $regions, int $serversWithoutRegion): bool
+    {
+        return true;
+    }
+
+    /**
+     * Convert any upstream failure into a credential-free exception. Upstream
+     * HTTP/SDK exceptions can carry tokens in their message or trace arguments,
+     * which the queue would persist into `failed_jobs.exception`.
+     */
+    protected function syncError(?int $status = null, ?string $region = null): PrivateNetworkSyncError
+    {
+        return new PrivateNetworkSyncError(
+            serverProviderId: $this->serverProvider->id,
+            provider: static::id(),
+            profile: $this->serverProvider->profile,
+            status: $status,
+            region: $region,
+        );
+    }
+
     public function generateKeyPair(): void
     {
         /** @var FilesystemAdapter $storageDisk */
diff --git a/app/ServerProviders/Custom.php b/app/ServerProviders/Custom.php
index 0aa085c3c..46698c3ac 100755
--- a/app/ServerProviders/Custom.php
+++ b/app/ServerProviders/Custom.php
@@ -22,6 +22,7 @@ public function createRules(array $input): array
         return [
             'ip' => [
                 'required',
+                'ip',
                 Rule::unique('servers', 'ip'),
                 new RestrictedIPAddressesRule,
             ],
diff --git a/app/ServerProviders/DigitalOcean.php b/app/ServerProviders/DigitalOcean.php
index ee1153895..aa96ca60a 100644
--- a/app/ServerProviders/DigitalOcean.php
+++ b/app/ServerProviders/DigitalOcean.php
@@ -2,8 +2,11 @@
 
 namespace App\ServerProviders;
 
+use App\DTOs\PrivateNetworkDTO;
+use App\DTOs\PrivateNetworkMemberDTO;
 use App\Enums\OperatingSystem;
 use App\Exceptions\CouldNotConnectToProvider;
+use App\Exceptions\PrivateNetworkSyncError;
 use App\Exceptions\ServerProviderError;
 use App\Facades\Notifier;
 use App\Notifications\FailedToDeleteServerFromProvider;
@@ -11,15 +14,137 @@
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
 
-class DigitalOcean extends AbstractProvider
+class DigitalOcean extends AbstractProvider implements ProvidesPrivateNetworks
 {
     protected string $apiUrl = 'https://api.digitalocean.com/v2';
 
+    private const MAX_PAGES = 100;
+
     public static function id(): string
     {
         return 'digitalocean';
     }
 
+    public function instanceIdKey(): string
+    {
+        return 'droplet_id';
+    }
+
+    public function privateNetworks(array $instanceIds, array $regions): array
+    {
+        return $this->mapPrivateNetworks(
+            $this->fetchAll('/vpcs', 'vpcs'),
+            $this->fetchAll('/droplets', 'droplets'),
+            $instanceIds,
+        );
+    }
+
+    /**
+     * Droplet objects carry `vpc_uuid` and their private `networks.v4` entry, so membership
+     * and addresses come from one list call. `/vpcs/{id}/members` returns URNs with no IP and
+     * would need a fetch per droplet.
+     *
+     * @param  array<int, array<string, mixed>>  $vpcs
+     * @param  array<int, array<string, mixed>>  $droplets
+     * @param  array<int, string>  $instanceIds
+     * @return array<int, PrivateNetworkDTO>
+     */
+    private function mapPrivateNetworks(array $vpcs, array $droplets, array $instanceIds): array
+    {
+        $wanted = array_flip($instanceIds);
+        $members = [];
+
+        foreach ($droplets as $droplet) {
+            $dropletId = (string) ($droplet['id'] ?? '');
+            $vpcId = $droplet['vpc_uuid'] ?? null;
+
+            if (! isset($wanted[$dropletId]) || ! is_string($vpcId) || $vpcId === '') {
+                continue;
+            }
+
+            $ip = null;
+
+            foreach ($droplet['networks']['v4'] ?? [] as $address) {
+                if (($address['type'] ?? null) === 'private' && isset($address['ip_address'])) {
+                    $ip = (string) $address['ip_address'];
+
+                    break;
+                }
+            }
+
+            $members[$vpcId][] = new PrivateNetworkMemberDTO(instanceId: $dropletId, ip: $ip);
+        }
+
+        $result = [];
+
+        foreach ($vpcs as $vpc) {
+            $vpcId = (string) ($vpc['id'] ?? '');
+
+            if (! isset($members[$vpcId])) {
+                continue;
+            }
+
+            $result[] = new PrivateNetworkDTO(
+                externalId: $vpcId,
+                name: (string) ($vpc['name'] ?? $vpcId),
+                cidr: isset($vpc['ip_range']) ? (string) $vpc['ip_range'] : null,
+                region: isset($vpc['region']) ? (string) $vpc['region'] : null,
+                members: $members[$vpcId],
+            );
+        }
+
+        return $result;
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     *
+     * @throws PrivateNetworkSyncError
+     */
+    private function fetchAll(string $path, string $key): array
+    {
+        $token = $this->serverProvider->getCredentials()['token'];
+        $items = [];
+        $page = 1;
+
+        do {
+            try {
+                $response = Http::withToken($token)->get($this->apiUrl.$path, [
+                    'per_page' => 200,
+                    'page' => $page,
+                ]);
+            } catch (Exception) {
+                throw $this->syncError();
+            }
+
+            if (! $response->ok()) {
+                throw $this->syncError($response->status());
+            }
+
+            $body = $response->json();
+
+            if (! is_array($body) || ! is_array($body[$key] ?? null)) {
+                throw $this->syncError($response->status());
+            }
+
+            /** @var array<int, array<string, mixed>> $batch */
+            $batch = $body[$key];
+            $items = array_merge($items, $batch);
+
+            if (! isset($body['links']['pages']['next'])) {
+                break;
+            }
+
+            if ($page >= self::MAX_PAGES) {
+                throw $this->syncError();
+            }
+
+            $page++;
+        } while (true);
+
+        return $items;
+    }
+
     public function createRules(array $input): array
     {
         return [
diff --git a/app/ServerProviders/Hetzner.php b/app/ServerProviders/Hetzner.php
index d5fec572d..ebb98e135 100644
--- a/app/ServerProviders/Hetzner.php
+++ b/app/ServerProviders/Hetzner.php
@@ -2,7 +2,10 @@
 
 namespace App\ServerProviders;
 
+use App\DTOs\PrivateNetworkDTO;
+use App\DTOs\PrivateNetworkMemberDTO;
 use App\Exceptions\CouldNotConnectToProvider;
+use App\Exceptions\PrivateNetworkSyncError;
 use App\Exceptions\ServerProviderError;
 use App\Facades\Notifier;
 use App\Notifications\FailedToDeleteServerFromProvider;
@@ -12,7 +15,7 @@
 use Illuminate\Http\Client\Response;
 use Illuminate\Support\Facades\Http;
 
-class Hetzner extends AbstractProvider
+class Hetzner extends AbstractProvider implements ProvidesPrivateNetworks
 {
     protected string $apiUrl = 'https://api.hetzner.cloud/v1';
 
@@ -21,6 +24,132 @@ public static function id(): string
         return 'hetzner';
     }
 
+    public function instanceIdKey(): string
+    {
+        return 'hetzner_id';
+    }
+
+    public function privateNetworks(array $instanceIds, array $regions): array
+    {
+        return $this->mapPrivateNetworks(
+            $this->fetchAll('/networks', 'networks'),
+            $this->fetchAll('/servers', 'servers'),
+            $instanceIds,
+        );
+    }
+
+    /**
+     * `/networks` already carries `servers[]` (attached ids), so membership needs no
+     * extra call; `/servers` is read only for the per-network private IPs.
+     *
+     * @param  array<int, array<string, mixed>>  $networks
+     * @param  array<int, array<string, mixed>>  $servers
+     * @param  array<int, string>  $instanceIds
+     * @return array<int, PrivateNetworkDTO>
+     */
+    private function mapPrivateNetworks(array $networks, array $servers, array $instanceIds): array
+    {
+        $wanted = array_flip($instanceIds);
+        $ips = [];
+
+        foreach ($servers as $server) {
+            $serverId = (string) ($server['id'] ?? '');
+
+            foreach ($server['private_net'] ?? [] as $attachment) {
+                if (isset($attachment['network'], $attachment['ip'])) {
+                    $ips[(string) $attachment['network']][$serverId] = (string) $attachment['ip'];
+                }
+            }
+        }
+
+        $result = [];
+
+        foreach ($networks as $network) {
+            $networkId = (string) ($network['id'] ?? '');
+            $members = [];
+
+            foreach ($network['servers'] ?? [] as $attachedId) {
+                $attachedId = (string) $attachedId;
+
+                if (! isset($wanted[$attachedId])) {
+                    continue;
+                }
+
+                $members[] = new PrivateNetworkMemberDTO(
+                    instanceId: $attachedId,
+                    ip: $ips[$networkId][$attachedId] ?? null,
+                );
+            }
+
+            if ($members === []) {
+                continue;
+            }
+
+            $result[] = new PrivateNetworkDTO(
+                externalId: $networkId,
+                name: (string) ($network['name'] ?? $networkId),
+                cidr: isset($network['ip_range']) ? (string) $network['ip_range'] : null,
+                region: isset($network['subnets'][0]['network_zone'])
+                    ? (string) $network['subnets'][0]['network_zone']
+                    : null,
+                members: $members,
+            );
+        }
+
+        return $result;
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     *
+     * @throws PrivateNetworkSyncError
+     */
+    private function fetchAll(string $path, string $key): array
+    {
+        $token = $this->serverProvider->getCredentials()['token'];
+        $items = [];
+        $page = 1;
+
+        do {
+            try {
+                $response = Http::withToken($token)->get($this->apiUrl.$path, [
+                    'per_page' => 50,
+                    'page' => $page,
+                ]);
+            } catch (Exception) {
+                throw $this->syncError();
+            }
+
+            if (! $response->ok()) {
+                throw $this->syncError($response->status());
+            }
+
+            $body = $response->json();
+
+            if (! is_array($body) || ! is_array($body[$key] ?? null)) {
+                throw $this->syncError($response->status());
+            }
+
+            /** @var array<int, array<string, mixed>> $batch */
+            $batch = $body[$key];
+            $items = array_merge($items, $batch);
+
+            $next = $body['meta']['pagination']['next_page'] ?? null;
+
+            if ($next === null) {
+                break;
+            }
+
+            if (! is_numeric($next) || (int) $next <= $page) {
+                throw $this->syncError();
+            }
+
+            $page = (int) $next;
+        } while (true);
+
+        return $items;
+    }
+
     public function createRules(array $input): array
     {
         return [
diff --git a/app/ServerProviders/Linode.php b/app/ServerProviders/Linode.php
index 4daf41469..51590bea1 100644
--- a/app/ServerProviders/Linode.php
+++ b/app/ServerProviders/Linode.php
@@ -2,7 +2,10 @@
 
 namespace App\ServerProviders;
 
+use App\DTOs\PrivateNetworkDTO;
+use App\DTOs\PrivateNetworkMemberDTO;
 use App\Exceptions\CouldNotConnectToProvider;
+use App\Exceptions\PrivateNetworkSyncError;
 use App\Exceptions\ServerProviderError;
 use App\Facades\Notifier;
 use App\Notifications\FailedToDeleteServerFromProvider;
@@ -10,15 +13,153 @@
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
 
-class Linode extends AbstractProvider
+class Linode extends AbstractProvider implements ProvidesPrivateNetworks
 {
     protected string $apiUrl = 'https://api.linode.com/v4';
 
+    private const MAX_PAGES = 100;
+
     public static function id(): string
     {
         return 'linode';
     }
 
+    public function instanceIdKey(): string
+    {
+        return 'linode_id';
+    }
+
+    public function privateNetworks(array $instanceIds, array $regions): array
+    {
+        return $this->mapPrivateNetworks(
+            $this->fetchAll('/vpcs'),
+            $this->fetchAll('/vpcs/ips'),
+            $instanceIds,
+        );
+    }
+
+    /**
+     * `/vpcs` carries `subnets[].linodes[]`, so membership needs no extra call; `/vpcs/ips`
+     * is the account-wide address list. A linode can hold several VPC addresses, and an entry
+     * may carry only `address_range`, so the first active entry with a plain address wins.
+     *
+     * @param  array<int, array<string, mixed>>  $vpcs
+     * @param  array<int, array<string, mixed>>  $addresses
+     * @param  array<int, string>  $instanceIds
+     * @return array<int, PrivateNetworkDTO>
+     */
+    private function mapPrivateNetworks(array $vpcs, array $addresses, array $instanceIds): array
+    {
+        $wanted = array_flip($instanceIds);
+        $ips = [];
+
+        foreach ($addresses as $entry) {
+            $linodeId = (string) ($entry['linode_id'] ?? '');
+            $vpcId = (string) ($entry['vpc_id'] ?? '');
+            $address = $entry['address'] ?? null;
+
+            if ($linodeId === '' || $vpcId === '' || ! is_string($address) || $address === '') {
+                continue;
+            }
+
+            if (($entry['active'] ?? true) === false) {
+                continue;
+            }
+
+            $ips[$vpcId][$linodeId] ??= $address;
+        }
+
+        $result = [];
+
+        foreach ($vpcs as $vpc) {
+            $vpcId = (string) ($vpc['id'] ?? '');
+            $members = [];
+            $cidrs = [];
+
+            foreach ($vpc['subnets'] ?? [] as $subnet) {
+                if (isset($subnet['ipv4'])) {
+                    $cidrs[] = (string) $subnet['ipv4'];
+                }
+
+                foreach ($subnet['linodes'] ?? [] as $linode) {
+                    $linodeId = (string) ($linode['id'] ?? '');
+
+                    if ($linodeId === '' || ! isset($wanted[$linodeId])) {
+                        continue;
+                    }
+
+                    $members[] = new PrivateNetworkMemberDTO(
+                        instanceId: $linodeId,
+                        ip: $ips[$vpcId][$linodeId] ?? null,
+                    );
+                }
+            }
+
+            if ($members === []) {
+                continue;
+            }
+
+            $result[] = new PrivateNetworkDTO(
+                externalId: $vpcId,
+                name: (string) ($vpc['label'] ?? $vpcId),
+                cidr: count($cidrs) === 1 ? $cidrs[0] : null,
+                region: isset($vpc['region']) ? (string) $vpc['region'] : null,
+                members: $members,
+            );
+        }
+
+        return $result;
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     *
+     * @throws PrivateNetworkSyncError
+     */
+    private function fetchAll(string $path): array
+    {
+        $token = $this->serverProvider->getCredentials()['token'];
+        $items = [];
+        $page = 1;
+
+        do {
+            try {
+                $response = Http::withToken($token)->get($this->apiUrl.$path, [
+                    'page_size' => 500,
+                    'page' => $page,
+                ]);
+            } catch (Exception) {
+                throw $this->syncError();
+            }
+
+            if (! $response->ok()) {
+                throw $this->syncError($response->status());
+            }
+
+            $body = $response->json();
+
+            if (! is_array($body) || ! is_array($body['data'] ?? null)) {
+                throw $this->syncError($response->status());
+            }
+
+            /** @var array<int, array<string, mixed>> $batch */
+            $batch = $body['data'];
+            $items = array_merge($items, $batch);
+
+            if ($page >= (int) ($body['pages'] ?? 1)) {
+                break;
+            }
+
+            if ($page >= self::MAX_PAGES) {
+                throw $this->syncError();
+            }
+
+            $page++;
+        } while (true);
+
+        return $items;
+    }
+
     public function createRules(array $input): array
     {
         return [
diff --git a/app/ServerProviders/ProvidesPrivateNetworks.php b/app/ServerProviders/ProvidesPrivateNetworks.php
new file mode 100644
index 000000000..d56b3b990
--- /dev/null
+++ b/app/ServerProviders/ProvidesPrivateNetworks.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace App\ServerProviders;
+
+use App\DTOs\PrivateNetworkDTO;
+use App\Exceptions\PrivateNetworkSyncError;
+
+/**
+ * Opt-in capability. Providers implementing this can be asked, at connection level,
+ * which private networks a set of instances belong to.
+ *
+ * Implementations are resolved via `ServerProvider::provider()`, which constructs
+ * with an empty `Server`. They must therefore read credentials from
+ * `$this->serverProvider->getCredentials()` and never touch `$this->server`.
+ */
+interface ProvidesPrivateNetworks
+{
+    /**
+     * The `servers.provider_data` key holding this provider's instance identifier.
+     */
+    public function instanceIdKey(): string;
+
+    /**
+     * Whether a complete query is possible with the given regions. A provider that returns
+     * false cannot be asked, so an empty result must not be read as "these networks are gone".
+     *
+     * `$serversWithoutRegion` counts the connection's servers that carry an instance id but no
+     * region, whose networks a regional provider would therefore never see.
+     *
+     * @param  array<int, string>  $regions
+     */
+    public function canDiscoverPrivateNetworks(array $regions, int $serversWithoutRegion): bool;
+
+    /**
+     * Private networks that at least one of $instanceIds is attached to. Members are
+     * restricted to $instanceIds — instances the caller did not ask about are omitted.
+     *
+     * @param  array<int, string>  $instanceIds
+     * @param  array<int, string>  $regions  regions to query; ignored by global providers
+     * @return array<int, PrivateNetworkDTO>
+     *
+     * @throws PrivateNetworkSyncError
+     */
+    public function privateNetworks(array $instanceIds, array $regions): array;
+}
diff --git a/app/ServerProviders/Vultr.php b/app/ServerProviders/Vultr.php
index 89084deb1..bc157a988 100644
--- a/app/ServerProviders/Vultr.php
+++ b/app/ServerProviders/Vultr.php
@@ -2,8 +2,11 @@
 
 namespace App\ServerProviders;
 
+use App\DTOs\PrivateNetworkDTO;
+use App\DTOs\PrivateNetworkMemberDTO;
 use App\Enums\OperatingSystem;
 use App\Exceptions\CouldNotConnectToProvider;
+use App\Exceptions\PrivateNetworkSyncError;
 use App\Exceptions\ServerProviderError;
 use App\Facades\Notifier;
 use App\Notifications\FailedToDeleteServerFromProvider;
@@ -13,7 +16,7 @@
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Storage;
 
-class Vultr extends AbstractProvider
+class Vultr extends AbstractProvider implements ProvidesPrivateNetworks
 {
     protected string $apiUrl = 'https://api.vultr.com/v2';
 
@@ -22,6 +25,140 @@ public static function id(): string
         return 'vultr';
     }
 
+    public function instanceIdKey(): string
+    {
+        return 'instance_id';
+    }
+
+    /**
+     * A server deleted upstream leaves a stale instance id behind, so a 404 for one instance is
+     * skipped rather than allowed to abort the connection's whole sync — which would also
+     * suppress pruning for every other network on it.
+     */
+    public function privateNetworks(array $instanceIds, array $regions): array
+    {
+        $attachments = [];
+
+        foreach ($instanceIds as $instanceId) {
+            try {
+                $attached = $this->fetchAll('/instances/'.$instanceId.'/vpcs', 'vpcs');
+            } catch (PrivateNetworkSyncError $e) {
+                if ($e->status === 404) {
+                    continue;
+                }
+
+                throw $e;
+            }
+
+            foreach ($attached as $attachment) {
+                $vpcId = (string) ($attachment['id'] ?? '');
+
+                if ($vpcId === '') {
+                    continue;
+                }
+
+                $attachments[$vpcId][] = new PrivateNetworkMemberDTO(
+                    instanceId: (string) $instanceId,
+                    ip: isset($attachment['ip_address']) ? (string) $attachment['ip_address'] : null,
+                );
+            }
+        }
+
+        if ($attachments === []) {
+            return [];
+        }
+
+        return $this->mapPrivateNetworks($this->fetchAll('/vpcs', 'vpcs'), $attachments);
+    }
+
+    /**
+     * Only `/v2/vpcs` is used. `/v2/vpc2` is deprecated, and its metadata shape differs
+     * (`ip_block`/`prefix_length` rather than `v4_subnet`/`v4_subnet_mask`).
+     *
+     * The per-instance attachment lookup is bounded by the servers Vito manages rather than
+     * by the size of the account.
+     *
+     * @param  array<int, array<string, mixed>>  $vpcs
+     * @param  array<string, array<int, PrivateNetworkMemberDTO>>  $attachments
+     * @return array<int, PrivateNetworkDTO>
+     */
+    private function mapPrivateNetworks(array $vpcs, array $attachments): array
+    {
+        $result = [];
+
+        foreach ($vpcs as $vpc) {
+            $vpcId = (string) ($vpc['id'] ?? '');
+
+            if (! isset($attachments[$vpcId])) {
+                continue;
+            }
+
+            $subnet = $vpc['v4_subnet'] ?? null;
+            $mask = $vpc['v4_subnet_mask'] ?? null;
+
+            $result[] = new PrivateNetworkDTO(
+                externalId: $vpcId,
+                name: (string) ($vpc['description'] ?? $vpcId),
+                cidr: is_string($subnet) && $subnet !== '' && is_numeric($mask) ? $subnet.'/'.(int) $mask : null,
+                region: isset($vpc['region']) ? (string) $vpc['region'] : null,
+                members: $attachments[$vpcId],
+            );
+        }
+
+        return $result;
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     *
+     * @throws PrivateNetworkSyncError
+     */
+    private function fetchAll(string $path, string $key): array
+    {
+        $token = $this->serverProvider->getCredentials()['token'];
+        $items = [];
+        $cursor = null;
+
+        do {
+            try {
+                $response = Http::withToken($token)->get($this->apiUrl.$path, array_filter([
+                    'per_page' => 500,
+                    'cursor' => $cursor,
+                ]));
+            } catch (Exception) {
+                throw $this->syncError();
+            }
+
+            if (! $response->ok()) {
+                throw $this->syncError($response->status());
+            }
+
+            $body = $response->json();
+
+            if (! is_array($body) || ! is_array($body[$key] ?? null)) {
+                throw $this->syncError($response->status());
+            }
+
+            /** @var array<int, array<string, mixed>> $batch */
+            $batch = $body[$key];
+            $items = array_merge($items, $batch);
+
+            $next = $body['meta']['links']['next'] ?? null;
+
+            if (! is_string($next) || $next === '') {
+                break;
+            }
+
+            if ($next === $cursor) {
+                throw $this->syncError();
+            }
+
+            $cursor = $next;
+        } while (true);
+
+        return $items;
+    }
+
     public function createRules(array $input): array
     {
         return [
diff --git a/app/Services/Firewall/Ufw.php b/app/Services/Firewall/Ufw.php
index adc2125f5..a8f64e1a4 100755
--- a/app/Services/Firewall/Ufw.php
+++ b/app/Services/Firewall/Ufw.php
@@ -2,6 +2,7 @@
 
 namespace App\Services\Firewall;
 
+use App\Actions\Network\FinalizeServerNetworkRules;
 use App\DTOs\ServiceLog;
 use App\Enums\FirewallRuleStatus;
 use App\Exceptions\SSHError;
@@ -39,6 +40,9 @@ public function install(): void
                 ]),
                 'install-ufw'
             );
+
+        $this->applyRules();
+
         event('service.installed', $this->service);
         $this->service->server->os()->cleanup();
     }
@@ -53,15 +57,37 @@ public function uninstall(): void
      */
     public function applyRules(): void
     {
-        $rules = $this->service->server
-            ->firewallRules()
+        $server = $this->service->server;
+
+        $networkRules = $server->networkRules()
             ->where('status', '!=', FirewallRuleStatus::DELETING)
+            ->ordered()
             ->get();
 
-        $this->service->server->ssh()->exec(
-            view('ssh.services.firewall.ufw.apply-rules', ['rules' => $rules]),
-            'apply-rules'
-        );
+        $emittedIds = $networkRules->pluck('id')->all();
+        $deletingIds = $server->networkRules()->where('status', FirewallRuleStatus::DELETING)->pluck('id')->all();
+
+        $serverRules = $server->firewallRules()
+            ->where('status', '!=', FirewallRuleStatus::DELETING)
+            ->orderBy('id')
+            ->get();
+
+        $rules = $networkRules->concat($serverRules);
+
+        $finalize = app(FinalizeServerNetworkRules::class);
+
+        try {
+            $server->ssh()->exec(
+                view('ssh.services.firewall.ufw.apply-rules', ['rules' => $rules]),
+                'apply-rules'
+            );
+        } catch (SSHError $e) {
+            $finalize->failure($server, $emittedIds);
+
+            throw $e;
+        }
+
+        $finalize->success($server, $emittedIds, $deletingIds);
     }
 
     public function version(): string
diff --git a/app/Services/VPN/VPN.php b/app/Services/VPN/VPN.php
new file mode 100644
index 000000000..c93f440f7
--- /dev/null
+++ b/app/Services/VPN/VPN.php
@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Services\VPN;
+
+use App\Models\Network;
+use App\Models\NetworkServer;
+use App\Services\ServiceInterface;
+
+interface VPN extends ServiceInterface
+{
+    public function configureNetwork(NetworkServer $membership): void;
+
+    public function removeNetwork(Network $network): void;
+}
diff --git a/app/Services/VPN/WireGuard.php b/app/Services/VPN/WireGuard.php
new file mode 100644
index 000000000..1c50a8e59
--- /dev/null
+++ b/app/Services/VPN/WireGuard.php
@@ -0,0 +1,253 @@
+<?php
+
+namespace App\Services\VPN;
+
+use App\Enums\NetworkPeerStatus;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkType;
+use App\Exceptions\SSHError;
+use App\Helpers\SSH;
+use App\Models\Network;
+use App\Models\NetworkPeer;
+use App\Models\NetworkServer;
+use App\Models\ServerLog;
+use App\Services\AbstractService;
+use App\Support\Cidr;
+use App\Support\Testing\SSHFake;
+use Closure;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+use RuntimeException;
+
+class WireGuard extends AbstractService implements VPN
+{
+    public static function id(): string
+    {
+        return 'wireguard';
+    }
+
+    public static function type(): string
+    {
+        return 'vpn';
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function deletionRules(): array
+    {
+        return [
+            'service' => [
+                function (string $attribute, mixed $value, Closure $fail): void {
+                    $isMember = NetworkServer::query()
+                        ->where('server_id', $this->service->server->id)
+                        ->where('status', '!=', NetworkServerStatus::LEAVING)
+                        ->whereHas('network', fn ($query) => $query->where('type', NetworkType::WIREGUARD))
+                        ->exists();
+
+                    if ($isMember) {
+                        $fail(__('This server is a member of one or more WireGuard networks. Remove it from those networks before uninstalling WireGuard.'));
+                    }
+                },
+            ],
+        ];
+    }
+
+    public function unit(): string
+    {
+        return '';
+    }
+
+    /**
+     * @throws SSHError
+     */
+    public function install(): void
+    {
+        $this->service->server->ssh()
+            ->setLog($this->service->log)
+            ->exec(
+                view('ssh.services.wireguard.install'),
+                'install-wireguard'
+            );
+        event('service.installed', $this->service);
+        $this->service->server->os()->cleanup();
+    }
+
+    /**
+     * @throws SSHError
+     */
+    public function uninstall(): void
+    {
+        $this->service->server->ssh()->exec(
+            view('ssh.services.wireguard.uninstall'),
+            'uninstall-wireguard'
+        );
+        event('service.uninstalled', $this->service);
+    }
+
+    /**
+     * @throws SSHError
+     */
+    public function version(): string
+    {
+        $version = $this->service->server->ssh()->exec(
+            'wg --version | grep -oE \'v[0-9]+\.[0-9]+\.[0-9]+\' | head -n1'
+        );
+
+        return trim($version);
+    }
+
+    /**
+     * @throws SSHError
+     */
+    public function configureNetwork(NetworkServer $membership): void
+    {
+        $network = $membership->network;
+
+        $content = view('ssh.services.wireguard.conf', [
+            'address' => $membership->ip,
+            'prefix' => $this->prefix($network),
+            'listenPort' => $network->port,
+            'privateKey' => $membership->private_key,
+            'peers' => $this->peers($membership),
+        ])->render();
+
+        $log = ServerLog::newLog($this->service->server, "configure-wireguard-{$network->id}");
+        $log->save();
+
+        $ssh = $this->service->server->ssh()->setLog($log);
+        $ssh->exec('sudo mkdir -p /etc/wireguard && sudo chmod 700 /etc/wireguard', 'configure-wireguard');
+        $this->uploadConf($ssh, $this->confPath($network).'.tmp', $content);
+
+        $ssh->exec(
+            view('ssh.services.wireguard.configure', [
+                'networkId' => $network->id,
+                'keepNetworkIds' => $this->managedNetworkIds($membership),
+            ]),
+            'configure-wireguard'
+        );
+    }
+
+    /**
+     * Every WireGuard network this server still belongs to. Any other wg-vito interface on the
+     * box is a leftover — a teardown that could not complete while the server was unreachable,
+     * for instance — and the configure pass removes it.
+     *
+     * @return array<int, int>
+     */
+    private function managedNetworkIds(NetworkServer $membership): array
+    {
+        return NetworkServer::query()
+            ->where('server_id', $membership->server_id)
+            ->where('status', '!=', NetworkServerStatus::LEAVING)
+            ->whereHas('network', fn ($query) => $query->where('type', NetworkType::WIREGUARD))
+            ->pluck('network_id')
+            ->push($membership->network_id)
+            ->unique()
+            ->values()
+            ->all();
+    }
+
+    /**
+     * @throws SSHError
+     */
+    public function removeNetwork(Network $network): void
+    {
+        $this->service->server->ssh()->exec(
+            view('ssh.services.wireguard.remove-network', ['networkId' => $network->id]),
+            'remove-wireguard-network'
+        );
+    }
+
+    private function confPath(Network $network): string
+    {
+        return "/etc/wireguard/wg-vito-{$network->id}.conf";
+    }
+
+    private function prefix(Network $network): int
+    {
+        return Cidr::prefix((string) $network->cidr);
+    }
+
+    /**
+     * @return array<int, array{public_key: string, allowed_ips: string, endpoint: ?string}>
+     */
+    private function peers(NetworkServer $membership): array
+    {
+        $network = $membership->network;
+
+        $servers = $network->servers()
+            ->where('id', '!=', $membership->id)
+            ->where('status', '!=', NetworkServerStatus::LEAVING)
+            ->whereNotNull('public_key')
+            ->whereNotNull('ip')
+            ->with('server')
+            ->get()
+            ->filter(fn (NetworkServer $peer): bool => Cidr::isValidAddress((string) $peer->server->ip))
+            ->map(fn (NetworkServer $peer): array => [
+                'public_key' => (string) $peer->public_key,
+                'allowed_ips' => $peer->ip.'/'.Cidr::hostPrefix((string) $peer->ip),
+                'endpoint' => Cidr::endpoint((string) $peer->server->ip, (int) $network->port),
+            ]);
+
+        $devices = $network->peers()
+            ->where('status', '!=', NetworkPeerStatus::DISABLED)
+            ->get()
+            ->map(fn (NetworkPeer $peer): array => [
+                'public_key' => $peer->public_key,
+                'allowed_ips' => $peer->ip.'/'.Cidr::hostPrefix($peer->ip),
+                'endpoint' => null,
+            ]);
+
+        return $servers->concat($devices)->values()->all();
+    }
+
+    /**
+     * @return array<string, int>
+     *
+     * @throws SSHError
+     */
+    public function latestHandshakes(Network $network): array
+    {
+        $output = $this->service->server->ssh()->exec(
+            view('ssh.services.wireguard.latest-handshakes', ['networkId' => $network->id]),
+            'wireguard-latest-handshakes'
+        );
+
+        $handshakes = [];
+
+        foreach (preg_split('/\r?\n/', trim($output)) ?: [] as $line) {
+            $parts = preg_split('/\s+/', trim($line));
+
+            if ($parts === false || count($parts) < 2 || $parts[0] === '') {
+                continue;
+            }
+
+            $handshakes[$parts[0]] = (int) $parts[1];
+        }
+
+        return $handshakes;
+    }
+
+    private function uploadConf(SSH|SSHFake $ssh, string $remote, string $content): void
+    {
+        $tmpName = 'wg-'.Str::random(20);
+        $disk = Storage::disk('local');
+
+        try {
+            if (! $disk->put($tmpName, '')) {
+                throw new RuntimeException('Could not create the temporary WireGuard configuration file.');
+            }
+
+            $path = $disk->path($tmpName);
+
+            if (! chmod($path, 0600) || ! $disk->put($tmpName, $content)) {
+                throw new RuntimeException('Could not write the temporary WireGuard configuration file.');
+            }
+
+            $ssh->upload($path, $remote, 'root');
+        } finally {
+            $disk->delete($tmpName);
+        }
+    }
+}
diff --git a/app/Support/Cidr.php b/app/Support/Cidr.php
new file mode 100644
index 000000000..ccabf6076
--- /dev/null
+++ b/app/Support/Cidr.php
@@ -0,0 +1,282 @@
+<?php
+
+namespace App\Support;
+
+/**
+ * Address maths for both families. Addresses are handled as raw `inet_pton` byte
+ * strings — 4 bytes for IPv4, 16 for IPv6 — so the same masking and comparison
+ * code serves both without needing 128-bit integers.
+ *
+ * WireGuard overlay blocks are still allocated from IPv4 pools (see
+ * `NetworkAddressingPool`); the IPv6 support here is for addresses Vito is given
+ * rather than ones it hands out — server endpoints, custom-network member
+ * addresses and provider-reported ranges.
+ */
+class Cidr
+{
+    public const V4_BITS = 32;
+
+    public const V6_BITS = 128;
+
+    /**
+     * Bit width of the address family, derived from the address itself. Accepts a
+     * bare address or a CIDR.
+     */
+    public static function bits(string $ipOrCidr): int
+    {
+        $bytes = self::toBytes(self::address($ipOrCidr));
+
+        return $bytes !== null && strlen($bytes) === 16 ? self::V6_BITS : self::V4_BITS;
+    }
+
+    public static function isV6(string $ipOrCidr): bool
+    {
+        return self::bits($ipOrCidr) === self::V6_BITS;
+    }
+
+    /**
+     * The prefix length that addresses exactly one host in this address's family.
+     */
+    public static function hostPrefix(string $ipOrCidr): int
+    {
+        return self::bits($ipOrCidr);
+    }
+
+    public static function isValidAddress(string $ip): bool
+    {
+        return filter_var($ip, FILTER_VALIDATE_IP) !== false;
+    }
+
+    /**
+     * A well-formed CIDR: a valid address, an explicit numeric prefix, and a prefix
+     * within the family's range.
+     */
+    public static function isValid(string $cidr): bool
+    {
+        $parts = explode('/', $cidr);
+
+        if (count($parts) !== 2 || ! ctype_digit($parts[1]) || ! self::isValidAddress($parts[0])) {
+            return false;
+        }
+
+        return (int) $parts[1] <= self::bits($parts[0]);
+    }
+
+    /**
+     * @return array{0: string, 1: int}
+     */
+    public static function split(string $cidr): array
+    {
+        $parts = explode('/', $cidr);
+        $address = $parts[0];
+        $prefix = $parts[1] ?? '';
+        $bits = self::bits($address);
+
+        return [$address, ctype_digit($prefix) ? min($bits, (int) $prefix) : $bits];
+    }
+
+    public static function prefix(string $cidr): int
+    {
+        return self::split($cidr)[1];
+    }
+
+    public static function address(string $ipOrCidr): string
+    {
+        return explode('/', $ipOrCidr)[0];
+    }
+
+    /**
+     * The network address of the block, as a string.
+     */
+    public static function network(string $cidr): string
+    {
+        [$address, $prefix] = self::split($cidr);
+        $bytes = self::toBytes($address);
+
+        if ($bytes === null) {
+            return $address;
+        }
+
+        return self::fromBytes(self::mask($bytes, $prefix));
+    }
+
+    public static function canonical(string $cidr): string
+    {
+        return self::network($cidr).'/'.self::prefix($cidr);
+    }
+
+    public static function contains(string $cidr, string $ip): bool
+    {
+        [$address, $prefix] = self::split($cidr);
+
+        $network = self::toBytes($address);
+        $candidate = self::toBytes($ip);
+
+        if ($network === null || $candidate === null || strlen($network) !== strlen($candidate)) {
+            return false;
+        }
+
+        return self::mask($candidate, $prefix) === self::mask($network, $prefix);
+    }
+
+    /**
+     * Whether $inner sits entirely inside $outer. A range can only be contained by one at least
+     * as wide, so the prefix is compared before the network address.
+     */
+    public static function containsRange(string $outer, string $inner): bool
+    {
+        if (self::bits($outer) !== self::bits($inner)) {
+            return false;
+        }
+
+        return self::prefix($inner) >= self::prefix($outer)
+            && self::contains($outer, self::network($inner));
+    }
+
+    public static function overlaps(string $a, string $b): bool
+    {
+        if (self::bits($a) !== self::bits($b)) {
+            return false;
+        }
+
+        return self::contains($a, self::network($b)) || self::contains($b, self::network($a));
+    }
+
+    /**
+     * First usable host (index 2), skipping the network address and the reserved
+     * gateway (.1), avoiding any already-used address and — for IPv4 — the
+     * broadcast address. Returns null when the block is exhausted.
+     *
+     * @param  array<int, string>  $used
+     */
+    public static function nextHost(string $cidr, array $used): ?string
+    {
+        [$address, $prefix] = self::split($cidr);
+        $bytes = self::toBytes($address);
+
+        if ($bytes === null) {
+            return null;
+        }
+
+        $network = self::mask($bytes, $prefix);
+        $used = array_flip($used);
+
+        for ($index = 2; ; $index++) {
+            $candidate = self::add($network, $index);
+
+            if ($candidate === null || self::mask($candidate, $prefix) !== $network) {
+                return null;
+            }
+
+            if (strlen($candidate) === 4 && self::isAllOnes($candidate, $prefix)) {
+                return null;
+            }
+
+            $host = self::fromBytes($candidate);
+
+            if (! isset($used[$host])) {
+                return $host;
+            }
+        }
+    }
+
+    /**
+     * `host:port` for IPv4, `[host]:port` for IPv6 — WireGuard's `Endpoint` and most
+     * socket syntax require the brackets to disambiguate the port.
+     */
+    public static function endpoint(string $ip, int|string $port): string
+    {
+        return self::isV6($ip) ? '['.$ip.']:'.$port : $ip.':'.$port;
+    }
+
+    /**
+     * Number of addresses in an IPv4 block. IPv6 blocks are far too large to count,
+     * so callers that need to enumerate must use `nextHost()` instead.
+     */
+    public static function size(int $prefix): int
+    {
+        return 2 ** (self::V4_BITS - $prefix);
+    }
+
+    /**
+     * IPv4 address as an unsigned integer, for the overlay block allocator.
+     */
+    public static function toLong(string $ip): int
+    {
+        return (int) sprintf('%u', ip2long($ip));
+    }
+
+    private static function toBytes(string $ip): ?string
+    {
+        $bytes = @inet_pton($ip);
+
+        return $bytes === false ? null : $bytes;
+    }
+
+    private static function fromBytes(string $bytes): string
+    {
+        $ip = @inet_ntop($bytes);
+
+        return $ip === false ? '' : $ip;
+    }
+
+    /**
+     * Zero every bit below the prefix.
+     */
+    private static function mask(string $bytes, int $prefix): string
+    {
+        $length = strlen($bytes);
+
+        for ($i = 0; $i < $length; $i++) {
+            $keep = $prefix - ($i * 8);
+
+            if ($keep >= 8) {
+                continue;
+            }
+
+            $bytes[$i] = $keep <= 0
+                ? "\0"
+                : chr(ord($bytes[$i]) & ((0xFF << (8 - $keep)) & 0xFF));
+        }
+
+        return $bytes;
+    }
+
+    /**
+     * Whether every host bit below the prefix is set — the IPv4 broadcast address.
+     */
+    private static function isAllOnes(string $bytes, int $prefix): bool
+    {
+        $length = strlen($bytes);
+
+        for ($i = 0; $i < $length; $i++) {
+            $keep = $prefix - ($i * 8);
+
+            if ($keep >= 8) {
+                continue;
+            }
+
+            $hostMask = $keep <= 0 ? 0xFF : (~(0xFF << (8 - $keep))) & 0xFF;
+
+            if ((ord($bytes[$i]) & $hostMask) !== $hostMask) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Add an offset to a big-endian byte string, returning null on overflow.
+     */
+    private static function add(string $bytes, int $offset): ?string
+    {
+        for ($i = strlen($bytes) - 1; $i >= 0 && $offset > 0; $i--) {
+            $sum = ord($bytes[$i]) + ($offset & 0xFF);
+            $bytes[$i] = chr($sum & 0xFF);
+            $offset = ($offset >> 8) + ($sum >> 8);
+        }
+
+        return $offset > 0 ? null : $bytes;
+    }
+}
diff --git a/app/Support/Testing/SSHFake.php b/app/Support/Testing/SSHFake.php
index 7f9bc4384..cbe1a151e 100644
--- a/app/Support/Testing/SSHFake.php
+++ b/app/Support/Testing/SSHFake.php
@@ -56,14 +56,12 @@ public function connect(bool $sftp = false): void
     public function exec(string|View $command, string $log = '', ?int $siteId = null, ?bool $stream = false, ?callable $streamCallback = null, int $timeout = 0): string
     {
         if (! $this->log instanceof ServerLog && $log) {
-            /** @var ServerLog $log */
-            $log = $this->server->logs()->create([
-                'site_id' => $siteId,
-                'name' => $this->server->id.'-'.strtotime('now').'-'.$log.'.log',
-                'type' => $log,
-                'disk' => config('core.logs_disk'),
-            ]);
-            $this->log = $log;
+            $serverLog = ServerLog::newLog($this->server, $log);
+            if ($siteId !== null && $siteId !== 0) {
+                $serverLog->forSite($siteId);
+            }
+            $serverLog->save();
+            $this->log = $serverLog;
         }
 
         $this->commands[] = $command;
diff --git a/app/Tables/NetworkTable.php b/app/Tables/NetworkTable.php
new file mode 100644
index 000000000..c41fbe968
--- /dev/null
+++ b/app/Tables/NetworkTable.php
@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Tables;
+
+use App\Models\Network;
+use Forjed\InertiaTable\Column;
+use Forjed\InertiaTable\Columns\ActionsColumn;
+use Forjed\InertiaTable\Columns\EnumColumn;
+use Forjed\InertiaTable\Columns\TextColumn;
+use Forjed\InertiaTable\Table;
+
+class NetworkTable extends Table
+{
+    protected array $tableSettings = ['realtime' => 'network'];
+
+    protected function query(): void
+    {
+        $this->perPage = config('web.pagination_size');
+        $this->query->with('serverProvider')->withCount('servers')->latest();
+    }
+
+    protected function columns(): array
+    {
+        return [
+            TextColumn::make('name', 'Name')->sortable(),
+            EnumColumn::make('type', 'Type'),
+            Column::make('provider', 'Provider')
+                ->value(fn (Network $network): string => $network->server_provider_id !== null
+                    ? $network->serverProvider->provider
+                    : '-'),
+            TextColumn::make('cidr', 'CIDR'),
+            TextColumn::make('port', 'Port')->fallback('-'),
+            TextColumn::make('servers_count', 'Servers'),
+            EnumColumn::make('status', 'Status')->sortable(),
+            Column::data('id'),
+            ActionsColumn::make(),
+        ];
+    }
+
+    protected function searchable(): array
+    {
+        return ['name'];
+    }
+}
diff --git a/app/Tables/Networks/NetworkFirewallRuleTable.php b/app/Tables/Networks/NetworkFirewallRuleTable.php
new file mode 100644
index 000000000..d9863d200
--- /dev/null
+++ b/app/Tables/Networks/NetworkFirewallRuleTable.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Tables\Networks;
+
+use Forjed\InertiaTable\Column;
+use Forjed\InertiaTable\Columns\ActionsColumn;
+use Forjed\InertiaTable\Columns\EnumColumn;
+use Forjed\InertiaTable\Columns\TextColumn;
+use Forjed\InertiaTable\Table;
+
+class NetworkFirewallRuleTable extends Table
+{
+    protected array $tableSettings = ['realtime' => 'network-firewall-rule'];
+
+    protected function query(): void
+    {
+        $this->perPage = config('web.pagination_size');
+        $this->query->orderBy('id');
+    }
+
+    protected function columns(): array
+    {
+        return [
+            TextColumn::make('name', 'Name')->sortable(),
+            Column::make('_protocol', 'Protocol')->accessor('protocol')->text()->fallback('*'),
+            Column::make('_port', 'Port')->accessor('port')->text()->fallback('*'),
+            EnumColumn::make('status', 'Status'),
+            Column::data('id'),
+            Column::data('protocol'),
+            Column::data('port'),
+            ActionsColumn::make(),
+        ];
+    }
+}
diff --git a/app/Tables/Networks/NetworkPeerTable.php b/app/Tables/Networks/NetworkPeerTable.php
new file mode 100644
index 000000000..4d8210509
--- /dev/null
+++ b/app/Tables/Networks/NetworkPeerTable.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Tables\Networks;
+
+use App\Models\NetworkPeer;
+use Forjed\InertiaTable\Column;
+use Forjed\InertiaTable\Columns\ActionsColumn;
+use Forjed\InertiaTable\Columns\CopyableColumn;
+use Forjed\InertiaTable\Columns\EnumColumn;
+use Forjed\InertiaTable\Columns\TextColumn;
+use Forjed\InertiaTable\Table;
+
+class NetworkPeerTable extends Table
+{
+    protected array $tableSettings = ['realtime' => 'network-peer'];
+
+    protected function query(): void
+    {
+        $this->perPage = config('web.pagination_size');
+        $this->query->orderBy('id');
+    }
+
+    protected function columns(): array
+    {
+        return [
+            TextColumn::make('name', 'Name')->sortable(),
+            TextColumn::make('ip', 'IP address'),
+            CopyableColumn::make('public_key', 'Public key'),
+            EnumColumn::make('status', 'Status'),
+            Column::make('last_handshake', 'Last handshake')
+                ->value(fn (NetworkPeer $peer): string => $peer->last_handshake_at?->diffForHumans() ?? 'Never')
+                ->badge(colorField: '_connected_color'),
+            Column::data('_connected_color', fn (NetworkPeer $peer): string => $this->connected($peer) ? 'success' : 'gray'),
+            Column::data('id'),
+            Column::data('byo'),
+            Column::data('has_private_key', fn (NetworkPeer $peer): bool => $peer->hasPrivateKey()),
+            ActionsColumn::make(),
+        ];
+    }
+
+    private function connected(NetworkPeer $peer): bool
+    {
+        return $peer->last_handshake_at !== null && $peer->last_handshake_at->greaterThan(now()->subMinutes(10));
+    }
+}
diff --git a/app/Tables/Networks/NetworkServerTable.php b/app/Tables/Networks/NetworkServerTable.php
new file mode 100644
index 000000000..f3b7fefb0
--- /dev/null
+++ b/app/Tables/Networks/NetworkServerTable.php
@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Tables\Networks;
+
+use App\Models\NetworkServer;
+use App\Models\Service;
+use Forjed\InertiaTable\Column;
+use Forjed\InertiaTable\Columns\ActionsColumn;
+use Forjed\InertiaTable\Columns\EnumColumn;
+use Forjed\InertiaTable\Columns\LinkColumn;
+use Forjed\InertiaTable\Columns\TextColumn;
+use Forjed\InertiaTable\Table;
+
+class NetworkServerTable extends Table
+{
+    protected array $tableSettings = ['realtime' => 'network-server'];
+
+    protected function query(): void
+    {
+        $this->perPage = config('web.pagination_size');
+        $this->query->with(['server.services', 'serverIpAddress'])->orderBy('id');
+    }
+
+    protected function columns(): array
+    {
+        return [
+            LinkColumn::make('server.name', 'Server')->sortable()->route('servers.show', ['server' => ':server_id']),
+            TextColumn::make('ip', 'IP address')
+                ->value(fn (NetworkServer $member) => $member->ip ?? $member->serverIpAddress?->ip)
+                ->fallback('-'),
+            Column::make('firewall', 'Firewall')
+                ->value(fn (NetworkServer $member): string => $this->hasFirewall($member) ? 'Yes' : 'No')
+                ->badge(colorField: '_firewall_color'),
+            Column::data('_firewall_color', fn (NetworkServer $member): string => $this->hasFirewall($member) ? 'success' : 'danger'),
+            EnumColumn::make('status', 'Status'),
+            Column::data('id'),
+            Column::data('server_id'),
+            ActionsColumn::make(),
+        ];
+    }
+
+    private function hasFirewall(NetworkServer $member): bool
+    {
+        return $member->server->services->contains(fn (Service $service): bool => $service->type === 'firewall');
+    }
+}
diff --git a/app/Tables/Servers/ServerNetworkRuleTable.php b/app/Tables/Servers/ServerNetworkRuleTable.php
new file mode 100644
index 000000000..cb5878b0c
--- /dev/null
+++ b/app/Tables/Servers/ServerNetworkRuleTable.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Tables\Servers;
+
+use App\Enums\NetworkServerStatus;
+use App\Models\ServerNetworkRule;
+use Forjed\InertiaTable\Column;
+use Forjed\InertiaTable\Columns\EnumColumn;
+use Forjed\InertiaTable\Columns\LinkColumn;
+use Forjed\InertiaTable\Columns\TextColumn;
+use Forjed\InertiaTable\Table;
+
+class ServerNetworkRuleTable extends Table
+{
+    protected array $tableSettings = ['realtime' => 'server-network-rule'];
+
+    protected function query(): void
+    {
+        $this->perPage = config('web.pagination_size');
+        $this->query
+            ->whereHas('networkServer', fn ($query) => $query->where('status', '!=', NetworkServerStatus::LEAVING))
+            ->with('network');
+
+        ServerNetworkRule::applyOrder($this->query);
+    }
+
+    protected function columns(): array
+    {
+        return [
+            LinkColumn::make('network.name', 'Network')->route('networks.show', ['network' => ':network_id']),
+            TextColumn::make('name', 'Name'),
+            TextColumn::make('type', 'Type')->uppercase(),
+            Column::make('source', 'Source')
+                ->value(fn (ServerNetworkRule $rule): string => $this->sourceLabel($rule))
+                ->text(),
+            TextColumn::make('protocol', 'Protocol')->fallback('*'),
+            TextColumn::make('port', 'Port')->fallback('*'),
+            EnumColumn::make('status', 'Status'),
+            Column::data('network_id'),
+        ];
+    }
+
+    private function sourceLabel(ServerNetworkRule $rule): string
+    {
+        if ($rule->source === null) {
+            return '*';
+        }
+
+        return $rule->mask !== null && $rule->mask !== 32 ? $rule->source.'/'.$rule->mask : $rule->source;
+    }
+}
diff --git a/app/Traits/UniqueQueue.php b/app/Traits/UniqueQueue.php
index 891c2fb5e..456fa7085 100644
--- a/app/Traits/UniqueQueue.php
+++ b/app/Traits/UniqueQueue.php
@@ -3,11 +3,14 @@
 namespace App\Traits;
 
 use Closure;
+use Illuminate\Database\DetectsConcurrencyErrors;
 use Illuminate\Support\Facades\Cache;
 use Throwable;
 
 trait UniqueQueue
 {
+    use DetectsConcurrencyErrors;
+
     public $tries = 120;
 
     public function retryUntil(): \DateTime
@@ -30,7 +33,12 @@ public function run(string $key, Closure $callback): void
             try {
                 $callback();
             } catch (Throwable $e) {
-                $lock->release();
+                if ($this->isTransientDatabaseError($e) && $this->attempts() < $this->tries) {
+                    $this->release(min(30, $this->attempts() * 2));
+
+                    return;
+                }
+
                 $this->fail($e);
             } finally {
                 $lock->release();
@@ -39,4 +47,9 @@ public function run(string $key, Closure $callback): void
             $this->release(30);
         }
     }
+
+    protected function isTransientDatabaseError(Throwable $e): bool
+    {
+        return $this->causedByConcurrencyError($e);
+    }
 }
diff --git a/app/ValidationRules/CidrRule.php b/app/ValidationRules/CidrRule.php
new file mode 100644
index 000000000..c090d2aec
--- /dev/null
+++ b/app/ValidationRules/CidrRule.php
@@ -0,0 +1,21 @@
+<?php
+
+namespace App\ValidationRules;
+
+use App\Support\Cidr;
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+
+class CidrRule implements ValidationRule
+{
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        if ($value === null || $value === '') {
+            return;
+        }
+
+        if (! is_string($value) || ! Cidr::isValid($value)) {
+            $fail('The :attribute must be a valid IPv4 or IPv6 CIDR, for example 10.0.0.0/24 or fd00::/64.')->translate();
+        }
+    }
+}
diff --git a/app/ValidationRules/PortOrPortRangeRule.php b/app/ValidationRules/PortOrPortRangeRule.php
index 7fb57efe0..e5d80ff98 100644
--- a/app/ValidationRules/PortOrPortRangeRule.php
+++ b/app/ValidationRules/PortOrPortRangeRule.php
@@ -10,7 +10,7 @@ class PortOrPortRangeRule implements ValidationRule
     public function validate(string $attribute, mixed $value, Closure $fail): void
     {
         if (! is_string($value) || preg_match('/^[1-9]\d{0,4}(:[1-9]\d{0,4})?$/', $value) !== 1) {
-            $fail('The :attribute must be a port (e.g. 8080) or a range (e.g. 3000:3010).');
+            $fail('The :attribute must be a port (e.g. 8080) or a range (e.g. 3000:3010).')->translate();
 
             return;
         }
@@ -18,14 +18,14 @@ public function validate(string $attribute, mixed $value, Closure $fail): void
         $parts = array_map('intval', explode(':', $value));
         foreach ($parts as $p) {
             if ($p < 1 || $p > 65535) {
-                $fail('The :attribute must be between 1 and 65535.');
+                $fail('The :attribute must be between 1 and 65535.')->translate();
 
                 return;
             }
         }
 
         if (count($parts) === 2 && $parts[0] >= $parts[1]) {
-            $fail('The :attribute range start must be lower than the range end.');
+            $fail('The :attribute range start must be lower than the range end.')->translate();
         }
     }
 }
diff --git a/app/ValidationRules/PrivateRangeRule.php b/app/ValidationRules/PrivateRangeRule.php
new file mode 100644
index 000000000..436124281
--- /dev/null
+++ b/app/ValidationRules/PrivateRangeRule.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\ValidationRules;
+
+use App\Support\Cidr;
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+
+/**
+ * A network's declared range is what its firewall rules are scoped to, so a range wider than
+ * private address space would emit `allow from 0.0.0.0/0` on every member — opening the ports
+ * to the internet on servers that were default-deny.
+ */
+class PrivateRangeRule implements ValidationRule
+{
+    private const BLOCKS = [
+        '10.0.0.0/8',
+        '172.16.0.0/12',
+        '192.168.0.0/16',
+        '100.64.0.0/10',
+        'fc00::/7',
+    ];
+
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        if (! is_string($value) || $value === '' || ! Cidr::isValid($value)) {
+            return;
+        }
+
+        foreach (self::BLOCKS as $block) {
+            if (Cidr::containsRange($block, $value)) {
+                return;
+            }
+        }
+
+        $fail('The :attribute must be a private range inside 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10 or fc00::/7.')->translate();
+    }
+}
diff --git a/app/ValidationRules/WireGuardPublicKeyRule.php b/app/ValidationRules/WireGuardPublicKeyRule.php
new file mode 100644
index 000000000..19abdae2d
--- /dev/null
+++ b/app/ValidationRules/WireGuardPublicKeyRule.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace App\ValidationRules;
+
+use App\Models\Network;
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+
+class WireGuardPublicKeyRule implements ValidationRule
+{
+    public function __construct(private Network $network, private ?int $ignorePeerId = null) {}
+
+    /**
+     * `base64_decode()` skips whitespace even in strict mode, so a key carrying an
+     * embedded newline still decodes to 32 bytes and would reach the WireGuard
+     * config template as extra directives. Match the exact 44-character wire form.
+     */
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        if (! is_string($value)
+            || preg_match('/^[A-Za-z0-9+\/]{43}=$/', $value) !== 1
+            || strlen((string) base64_decode($value, true)) !== 32) {
+            $fail('The :attribute must be a valid WireGuard public key.')->translate();
+
+            return;
+        }
+
+        $collidesWithServer = $this->network->servers()
+            ->where('public_key', $value)
+            ->exists();
+
+        $collidesWithPeer = $this->network->peers()
+            ->where('public_key', $value)
+            ->when($this->ignorePeerId !== null, fn ($query) => $query->whereKeyNot($this->ignorePeerId))
+            ->exists();
+
+        if ($collidesWithServer || $collidesWithPeer) {
+            $fail('The :attribute is already in use on this network.')->translate();
+        }
+    }
+}
diff --git a/app/ValidationRules/WithinCidrRule.php b/app/ValidationRules/WithinCidrRule.php
new file mode 100644
index 000000000..4c2c289eb
--- /dev/null
+++ b/app/ValidationRules/WithinCidrRule.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\ValidationRules;
+
+use App\Models\ServerIpAddress;
+use App\Support\Cidr;
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+
+/**
+ * A custom network's declared range is what its firewall rules are built from, so a member
+ * addressed outside that range gets no working rule while the declared range is opened
+ * regardless. The value under validation is a `server_ip_addresses` id.
+ */
+class WithinCidrRule implements ValidationRule
+{
+    public function __construct(private ?string $cidr) {}
+
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        if ($this->cidr === null || $this->cidr === '' || ! Cidr::isValid($this->cidr)) {
+            return;
+        }
+
+        $ip = ServerIpAddress::query()->whereKey($value)->value('ip');
+
+        if (! is_string($ip)) {
+            return;
+        }
+
+        if (! Cidr::contains($this->cidr, $ip)) {
+            $fail('The selected address :ip is outside the network range :cidr.')->translate([
+                'ip' => $ip,
+                'cidr' => $this->cidr,
+            ]);
+        }
+    }
+}
diff --git a/database/factories/NetworkFactory.php b/database/factories/NetworkFactory.php
new file mode 100644
index 000000000..b95acc34e
--- /dev/null
+++ b/database/factories/NetworkFactory.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Enums\NetworkAddressingPool;
+use App\Enums\NetworkStatus;
+use App\Enums\NetworkType;
+use App\Models\Network;
+use App\Models\Project;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+/**
+ * @extends Factory<Network>
+ */
+class NetworkFactory extends Factory
+{
+    protected $model = Network::class;
+
+    public function definition(): array
+    {
+        $cidr = $this->block();
+
+        return [
+            'project_id' => Project::factory(),
+            'name' => $this->faker->unique()->word(),
+            'type' => NetworkType::WIREGUARD,
+            'status' => NetworkStatus::ACTIVE,
+            'addressing_pool' => NetworkAddressingPool::CGNAT,
+            'cidr' => $cidr,
+            'cidr_canonical' => $cidr,
+            'port' => 51820,
+        ];
+    }
+
+    /**
+     * One unique number feeds both variable octets, so the pool spans every /24 in
+     * 100.64.0.0/10 rather than the 256 a single-octet unique() would allow.
+     */
+    private function block(): string
+    {
+        $block = $this->faker->unique()->numberBetween(0, 16383);
+
+        return '100.'.(64 + intdiv($block, 256)).'.'.($block % 256).'.0/24';
+    }
+}
diff --git a/database/factories/NetworkFirewallRuleFactory.php b/database/factories/NetworkFirewallRuleFactory.php
new file mode 100644
index 000000000..4f4eddca3
--- /dev/null
+++ b/database/factories/NetworkFirewallRuleFactory.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Enums\FirewallRuleStatus;
+use App\Models\Network;
+use App\Models\NetworkFirewallRule;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+/**
+ * @extends Factory<NetworkFirewallRule>
+ */
+class NetworkFirewallRuleFactory extends Factory
+{
+    protected $model = NetworkFirewallRule::class;
+
+    public function definition(): array
+    {
+        return [
+            'network_id' => Network::factory(),
+            'name' => $this->faker->word(),
+            'protocol' => 'tcp',
+            'port' => (string) $this->faker->numberBetween(1, 65535),
+            'status' => FirewallRuleStatus::READY,
+        ];
+    }
+}
diff --git a/database/factories/NetworkPeerFactory.php b/database/factories/NetworkPeerFactory.php
new file mode 100644
index 000000000..5a863b40f
--- /dev/null
+++ b/database/factories/NetworkPeerFactory.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Enums\NetworkPeerStatus;
+use App\Models\Network;
+use App\Models\NetworkPeer;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+/**
+ * @extends Factory<NetworkPeer>
+ */
+class NetworkPeerFactory extends Factory
+{
+    protected $model = NetworkPeer::class;
+
+    public function definition(): array
+    {
+        return [
+            'network_id' => Network::factory(),
+            'name' => $this->faker->unique()->word(),
+            'ip' => $this->faker->unique()->numerify('100.64.0.##'),
+            'public_key' => base64_encode(random_bytes(32)),
+            'private_key' => base64_encode(random_bytes(32)),
+            'byo' => false,
+            'status' => NetworkPeerStatus::ACTIVE,
+            'last_handshake_at' => null,
+            'sync_attempts' => 0,
+        ];
+    }
+}
diff --git a/database/factories/NetworkServerFactory.php b/database/factories/NetworkServerFactory.php
new file mode 100644
index 000000000..aa5fc6eb0
--- /dev/null
+++ b/database/factories/NetworkServerFactory.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Actions\Network\GenerateWireGuardKeys;
+use App\Enums\NetworkServerStatus;
+use App\Models\Network;
+use App\Models\NetworkServer;
+use App\Models\Server;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+/**
+ * @extends Factory<NetworkServer>
+ */
+class NetworkServerFactory extends Factory
+{
+    protected $model = NetworkServer::class;
+
+    public function definition(): array
+    {
+        $keys = app(GenerateWireGuardKeys::class)->generate();
+
+        return [
+            'network_id' => Network::factory(),
+            'server_id' => Server::factory(),
+            'server_ip_address_id' => null,
+            'ip' => $this->hostAddress(),
+            'public_key' => $keys['public_key'],
+            'private_key' => $keys['private_key'],
+            'status' => NetworkServerStatus::ACTIVE,
+            'sync_attempts' => 0,
+        ];
+    }
+
+    /**
+     * A two-digit host pattern gives faker's unique() only 100 values, which it can exhaust
+     * across a long-running process and then throw. This spans the whole 100.64.0.0/16.
+     */
+    private function hostAddress(): string
+    {
+        $host = $this->faker->unique()->numberBetween(1, 64516);
+
+        return '100.64.'.intdiv($host - 1, 254).'.'.(($host - 1) % 254 + 1);
+    }
+}
diff --git a/database/migrations/2026_07_24_195720_create_networks_table.php b/database/migrations/2026_07_24_195720_create_networks_table.php
new file mode 100644
index 000000000..8936dd447
--- /dev/null
+++ b/database/migrations/2026_07_24_195720_create_networks_table.php
@@ -0,0 +1,38 @@
+<?php
+
+use App\Enums\NetworkAddressingPool;
+use App\Enums\NetworkStatus;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('networks', function (Blueprint $table): void {
+            $table->id();
+            $table->foreignId('project_id')->constrained()->cascadeOnDelete();
+            $table->foreignId('server_provider_id')->nullable()->constrained()->nullOnDelete();
+            $table->string('name');
+            $table->string('type');
+            $table->string('status')->default(NetworkStatus::CREATING->value);
+            $table->string('addressing_pool')->default(NetworkAddressingPool::CGNAT->value);
+            $table->string('cidr')->nullable();
+            $table->string('cidr_canonical')->nullable();
+            $table->unsignedInteger('port')->nullable();
+            $table->string('external_id')->nullable();
+            $table->string('region')->nullable();
+            $table->timestamp('last_synced_at')->nullable();
+            $table->timestamps();
+
+            $table->unique(['project_id', 'name']);
+            $table->unique(['project_id', 'server_provider_id', 'external_id'], 'networks_project_external_unique');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('networks');
+    }
+};
diff --git a/database/migrations/2026_07_24_195721_create_network_servers_table.php b/database/migrations/2026_07_24_195721_create_network_servers_table.php
new file mode 100644
index 000000000..0f192a14c
--- /dev/null
+++ b/database/migrations/2026_07_24_195721_create_network_servers_table.php
@@ -0,0 +1,35 @@
+<?php
+
+use App\Enums\NetworkServerStatus;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('network_servers', function (Blueprint $table): void {
+            $table->id();
+            $table->foreignId('network_id')->constrained()->cascadeOnDelete();
+            $table->foreignId('server_id')->constrained()->cascadeOnDelete();
+            $table->foreignId('server_ip_address_id')->nullable()->constrained()->nullOnDelete();
+            $table->string('ip')->nullable();
+            $table->text('public_key')->nullable();
+            $table->text('private_key')->nullable();
+            $table->string('status')->default(NetworkServerStatus::PENDING->value);
+            $table->unsignedInteger('sync_attempts')->default(0);
+            $table->timestamps();
+
+            $table->unique(['network_id', 'server_id']);
+            $table->unique(['network_id', 'ip']);
+            $table->unique('server_ip_address_id');
+            $table->index(['status', 'updated_at']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('network_servers');
+    }
+};
diff --git a/database/migrations/2026_07_24_195722_create_network_firewall_rules_table.php b/database/migrations/2026_07_24_195722_create_network_firewall_rules_table.php
new file mode 100644
index 000000000..1874f68b6
--- /dev/null
+++ b/database/migrations/2026_07_24_195722_create_network_firewall_rules_table.php
@@ -0,0 +1,27 @@
+<?php
+
+use App\Enums\FirewallRuleStatus;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('network_firewall_rules', function (Blueprint $table): void {
+            $table->id();
+            $table->foreignId('network_id')->constrained()->cascadeOnDelete();
+            $table->string('name');
+            $table->string('protocol')->nullable();
+            $table->string('port')->nullable();
+            $table->string('status')->default(FirewallRuleStatus::CREATING->value);
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('network_firewall_rules');
+    }
+};
diff --git a/database/migrations/2026_07_24_195723_create_server_network_rules_table.php b/database/migrations/2026_07_24_195723_create_server_network_rules_table.php
new file mode 100644
index 000000000..04e69e412
--- /dev/null
+++ b/database/migrations/2026_07_24_195723_create_server_network_rules_table.php
@@ -0,0 +1,39 @@
+<?php
+
+use App\Enums\FirewallRuleStatus;
+use App\Enums\ServerNetworkRuleKind;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('server_network_rules', function (Blueprint $table): void {
+            $table->id();
+            $table->foreignId('server_id')->constrained()->cascadeOnDelete();
+            $table->foreignId('network_id')->constrained()->cascadeOnDelete();
+            $table->foreignId('network_server_id')->constrained()->cascadeOnDelete();
+            $table->foreignId('network_firewall_rule_id')->nullable()->constrained()->cascadeOnDelete();
+            $table->string('kind')->default(ServerNetworkRuleKind::RULE->value);
+            $table->string('name');
+            $table->string('type')->default('allow');
+            $table->string('protocol')->nullable();
+            $table->string('port')->nullable();
+            $table->string('source')->nullable();
+            $table->unsignedTinyInteger('mask')->nullable();
+            $table->string('status')->default(FirewallRuleStatus::CREATING->value);
+            $table->timestamps();
+
+            $table->index(['server_id', 'status']);
+            $table->index('network_server_id');
+            $table->index('network_firewall_rule_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('server_network_rules');
+    }
+};
diff --git a/database/migrations/2026_07_24_195724_create_network_peers_table.php b/database/migrations/2026_07_24_195724_create_network_peers_table.php
new file mode 100644
index 000000000..6a53ef964
--- /dev/null
+++ b/database/migrations/2026_07_24_195724_create_network_peers_table.php
@@ -0,0 +1,36 @@
+<?php
+
+use App\Enums\NetworkPeerStatus;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('network_peers', function (Blueprint $table): void {
+            $table->id();
+            $table->foreignId('network_id')->constrained()->cascadeOnDelete();
+            $table->string('name');
+            $table->string('ip');
+            $table->string('public_key');
+            $table->text('private_key')->nullable();
+            $table->boolean('byo')->default(false);
+            $table->string('status')->default(NetworkPeerStatus::PENDING->value);
+            $table->timestamp('last_handshake_at')->nullable();
+            $table->unsignedInteger('sync_attempts')->default(0);
+            $table->timestamps();
+
+            $table->unique(['network_id', 'name']);
+            $table->unique(['network_id', 'ip']);
+            $table->unique(['network_id', 'public_key']);
+            $table->index('status');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('network_peers');
+    }
+};
diff --git a/database/migrations/2026_07_24_195725_add_network_id_to_server_logs.php b/database/migrations/2026_07_24_195725_add_network_id_to_server_logs.php
new file mode 100644
index 000000000..40e191bae
--- /dev/null
+++ b/database/migrations/2026_07_24_195725_add_network_id_to_server_logs.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('server_logs', function (Blueprint $table): void {
+            $table->foreignId('network_id')->nullable()->after('site_id')->constrained()->nullOnDelete();
+            $table->index('network_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('server_logs', function (Blueprint $table): void {
+            $table->dropConstrainedForeignId('network_id');
+        });
+    }
+};
diff --git a/docs/4.x/README.md b/docs/4.x/README.md
index c56f73256..ace8e8539 100644
--- a/docs/4.x/README.md
+++ b/docs/4.x/README.md
@@ -24,6 +24,17 @@ databases, deploy sites, and more — all from a clean dashboard.
 | [Configuration](getting-started/configuration.md) | Configure your Vito instance |
 | [Update](getting-started/update.md) | Keep your instance up to date |
 
+## Networks
+
+| Page | What's in it |
+| --- | --- |
+| [Overview](networks/overview.md) | Private networking between your servers |
+| [Creating a Network](networks/create.md) | Create a WireGuard or custom network |
+| [Provider Networks](networks/provider-networks.md) | Discover and sync VPCs from your cloud provider |
+| [Network Servers](networks/servers.md) | Manage the servers in a network |
+| [Peers](networks/peers.md) | Connect laptops and other devices |
+| [Network Firewall](networks/firewall.md) | Control traffic between members |
+
 ## Servers
 
 | Page | What's in it |
diff --git a/docs/4.x/automation.md b/docs/4.x/automation.md
index 6418e05d7..1501ce51a 100644
--- a/docs/4.x/automation.md
+++ b/docs/4.x/automation.md
@@ -20,8 +20,13 @@ These tasks are driven by Vito's own scheduler, which runs on your Vito instance
 | Wildcard SSL renewal | Daily | Renews wildcard Let's Encrypt [certificates](./servers/ssl.md) within 30 days of expiry. |
 | SSL expiry check | Daily | Flags certificates that are expiring soon and notifies you. |
 | GitHub App sync | Every 4 hours | Syncs [GitHub App](./admin/github-app.md) installations as a fallback to webhooks. |
+| Network reconciliation | Every 3 minutes | Re-applies [network](./networks/overview.md) configuration to servers that are pending or failed, and checks peer connectivity. |
 | Database maintenance | Daily | Vacuums Vito's own database to keep it fast. |
 
+:::info
+[Provider networks](./networks/provider-networks.md) are **not** on this list. Vito only queries your cloud provider for private networks when you click **Sync**, so it never calls provider APIs in the background.
+:::
+
 ## Per-Server Automatic Updates
 
 Automatic OS package updates are opt-in per server. Enable them from the server's [Security](./servers/security.md#automatic-updates) page and set the schedule. You'll get a notification when an update completes.
diff --git a/docs/4.x/networks/create.md b/docs/4.x/networks/create.md
new file mode 100644
index 000000000..a3e815cf0
--- /dev/null
+++ b/docs/4.x/networks/create.md
@@ -0,0 +1,87 @@
+# Creating a Network
+
+## Introduction
+
+Click **Create** on the Networks page to create a network. You can create **WireGuard** and **Custom** networks by hand.
+
+**Provider** networks cannot be created here — they appear automatically when Vito discovers them at your cloud provider. See [Provider Networks](provider-networks.md).
+
+## Creating a WireGuard Network
+
+Choose **WireGuard** as the type and fill in the following fields.
+
+### Name
+
+A name for the network, unique within the project.
+
+### Address Pool
+
+The range Vito allocates the network's address block from:
+
+- **CGNAT (100.64.0.0/10)** — the default. This range is reserved for carrier-grade NAT and is almost never used on a server's own interfaces, so it very rarely collides with anything.
+- **Private (RFC1918)** — allocates from `10.0.0.0/8` or `192.168.0.0/16`.
+
+:::info
+The RFC1918 option deliberately avoids `172.16.0.0/12`, because Docker and several cloud providers use it by default. Vito also skips ranges already used by your servers and a blocklist of common provider ranges.
+:::
+
+### Block Size
+
+The prefix length of the block to allocate, between `/16` and `/28`. The default `/24` gives you 253 usable addresses for servers and peers combined.
+
+### Primary Server
+
+The first server to join the network. You can add more from the [Servers](servers.md) tab once the network exists.
+
+### Listen Port
+
+The UDP port WireGuard listens on, `51820` by default. If a selected server is already in another WireGuard network using that port, Vito picks the next free one. This also applies later: adding such a server from the [Servers](servers.md) tab moves the network to a free port. Members follow automatically, but [peers](peers.md) must download their configuration again.
+
+Vito opens this port in the server's firewall automatically, restricted to the other members of the network.
+
+## Creating a Custom Network
+
+Choose **Custom** as the type. Custom networks describe connectivity that already exists, so Vito does not configure anything on the servers.
+
+### CIDR
+
+Optional. The address range of the existing private network — IPv4 or IPv6, for example `10.0.0.0/24` or `fd00:1::/64`.
+
+If you provide it, [firewall rules](firewall.md) are scoped to the whole range. If you leave it empty, rules are scoped to each member's individual address instead, which is tighter.
+
+:::warning
+Every member's address must fall inside the range you declare. Vito rejects a member whose address sits outside it, because the rules derived from the range would not cover that member while still opening the whole range.
+:::
+
+### Primary Server and Private IP
+
+Select the first server, then choose which of its private IP addresses belongs to this network.
+
+The list contains the private addresses Vito has discovered for that server. If the address you need is missing, click the refresh action to re-detect the server's addresses, or add it from the server's [Network](../servers/network.md) page.
+
+:::warning
+Each private IP address can belong to only one network member across your whole instance. If an address is already used by another network, pick a different one.
+:::
+
+## After Creation
+
+Vito creates the network and starts configuring it:
+
+- **WireGuard networks** — WireGuard is installed on each server if needed, keys are generated, and the tunnel is brought up. The network moves to `active` once every server is configured.
+- **Custom networks** — members are marked active immediately, and the network's firewall rules are applied.
+
+Every new network is seeded with a single **Allow all** firewall rule so members can reach each other on any port. Tighten this from the [Firewall](firewall.md) tab.
+
+:::info
+If a server is offline when you create the network, its member stays `pending` and Vito configures it automatically once the server is reachable again.
+:::
+
+## IPv6
+
+Vito handles IPv6 wherever an address is given to it:
+
+- A server reachable only over IPv6 works as a WireGuard endpoint — the address is bracketed as `[2001:db8::1]:51820` in every generated config, and the handshake firewall rule uses a `/128` host prefix.
+- **Custom** networks can be built from IPv6 private addresses and can declare an IPv6 range.
+- **Provider** networks with IPv6 ranges are discovered and synced like IPv4 ones, and a member whose only address is IPv6 joins with that address. A network holds a single range, so a dual-stack VPC is recorded by its IPv4 range.
+
+The address block a **WireGuard** network hands out to its own members and peers is always IPv4, from the CGNAT or RFC1918 pool above. That is the address space inside the tunnel; it is independent of whether the servers reach each other over IPv4 or IPv6.
diff --git a/docs/4.x/networks/firewall.md b/docs/4.x/networks/firewall.md
new file mode 100644
index 000000000..be0b617c1
--- /dev/null
+++ b/docs/4.x/networks/firewall.md
@@ -0,0 +1,69 @@
+# Network Firewall
+
+## Introduction
+
+A network's **Firewall** tab controls what traffic is allowed between its members. Vito turns each rule into real firewall rules on every server in the network, using the server's own [UFW firewall](../servers/firewall.md).
+
+This is the main reason to define a network even when the private connectivity already exists: you describe the rule once, for the network, and Vito keeps it applied on every member.
+
+## The Default Rule
+
+Every new network starts with a single **Allow all** rule, which lets members reach each other on any port and protocol. Delete it and add narrower rules when you want to lock things down.
+
+## Creating a Rule
+
+Click **Create** and provide:
+
+### Name
+
+A label for the rule, for example `mysql` or `redis`.
+
+### Protocol
+
+The protocol to allow — TCP or UDP. Leave it empty to allow any protocol.
+
+### Port
+
+The port to allow, for example `3306`, or a range such as `3000:3010`. Leave it empty to allow any port.
+
+Protocol and port are independent — all four combinations are valid:
+
+| Protocol | Port | Allows |
+| --- | --- | --- |
+| TCP | `3306` | TCP on port 3306 |
+| empty | `3306` | any protocol on port 3306 |
+| UDP | empty | UDP on any port |
+| empty | empty | all traffic from the network |
+
+:::info
+A port **range** must name a protocol — UFW rejects a multi-port rule that doesn't. A single port works with or without one.
+:::
+
+## How Rules Are Applied
+
+Vito translates each network rule into a rule on every member's firewall, scoped to the other members of that network:
+
+- On **WireGuard** networks, and on **custom** networks that have a CIDR, rules are scoped to the network's address range.
+- On **custom** networks without a CIDR, and on all **provider** networks, rules are scoped to each member's individual address instead. This is tighter — the port is opened only to the specific servers in the network, not to everything sharing the range.
+
+WireGuard networks also get an automatic rule opening the tunnel's listen port to the other members, so the tunnel can be established. This rule is managed by Vito and is not affected when you delete the **Allow all** rule.
+
+Adding a [peer](peers.md) widens that rule to any source, because a laptop or CI runner connects from an address Vito can't know in advance. Only the tunnel's UDP listen port is opened; traffic still has to authenticate with a known peer key before it reaches anything. Remove every peer and the rule narrows back to the other members.
+
+:::info
+Network rules appear on each server's own [Firewall](../servers/firewall.md) page as managed rules. They're shown there for visibility but are edited from the network, so they stay consistent across every member.
+:::
+
+## Servers Without a Firewall
+
+A server with no firewall service installed still shows in the network, but nothing is enforced on it — the Servers tab shows whether each member has a firewall.
+
+If you install UFW on a server later, Vito applies the network's rules as part of the installation.
+
+## Deleting a Rule
+
+Deleting a rule removes it from every member's firewall.
+
+:::warning
+Deleting the **Allow all** rule locks the network down to only the ports you've explicitly allowed. Make sure the services your servers rely on — a database port, for example — have their own rules first.
+:::
diff --git a/docs/4.x/networks/overview.md b/docs/4.x/networks/overview.md
new file mode 100644
index 000000000..2012fe06c
--- /dev/null
+++ b/docs/4.x/networks/overview.md
@@ -0,0 +1,72 @@
+# Networks
+
+## Introduction
+
+**Networks** let your servers talk to each other over private addresses instead of the public internet. A network belongs to a project, and every server in it can reach the others on an address that is never exposed publicly.
+
+This is useful when you want a web server to reach a database server, or a group of application servers to share a cache, without opening those services to the world.
+
+Networks live at the top of the sidebar, above **Servers**.
+
+## Network Types
+
+Vito supports three kinds of network. The type is chosen when the network is created and cannot be changed afterwards.
+
+| Type | Membership | Addresses | Best for |
+| --- | --- | --- | --- |
+| **WireGuard** | You choose the servers | Allocated by Vito | Servers spread across different providers or regions |
+| **Custom** | You choose the servers and their IPs | You pick an existing private IP per server | A private network you set up yourself |
+| **Provider** | Synced from your cloud provider | Reported by the provider | Mirroring a VPC you already run at a cloud provider |
+
+### WireGuard
+
+Vito builds an encrypted [WireGuard](https://www.wireguard.com/) tunnel between the servers you select. It installs WireGuard, generates a key pair per server, allocates an address block, and writes the configuration to each machine.
+
+Because the tunnel is encrypted and routed over the public internet, a WireGuard network works even when the servers are at different providers, in different regions, or behind NAT. It is the only type that supports [Peers](peers.md).
+
+See [Creating a Network](create.md) to set one up.
+
+### Custom
+
+A custom network describes private connectivity that already exists — for example two servers at the same provider that can already reach each other on a private interface. Vito does not configure anything on the machines; you tell it which servers are in the network and which of their private IP addresses to use.
+
+Vito still manages the [firewall rules](firewall.md) for the network, which is the main reason to define one.
+
+### Provider
+
+A provider network mirrors a private network (a VPC) that exists at your cloud provider. Vito discovers it by querying the provider's API, and keeps the membership in step with reality.
+
+Provider networks are **read-only**: you cannot add, edit, or remove servers by hand, and you cannot delete the network while its provider connection still exists. See [Provider Networks](provider-networks.md).
+
+## Statuses
+
+A network shows one of the following statuses, derived from the state of its servers:
+
+| Status | Meaning |
+| --- | --- |
+| `creating` | The network has no servers. A network created with servers moves straight to `syncing`. |
+| `syncing` | At least one server is still being configured. |
+| `active` | Every server is configured and in sync. |
+| `failed` | At least one server failed to configure. Vito retries automatically. |
+| `deleting` | The network is being torn down. |
+
+Each server in the network carries its own status — `pending`, `updating`, `active`, `failed`, or `leaving` — which you can see on the [Servers](servers.md) tab.
+
+:::info
+Vito re-checks networks every three minutes and retries any server that is pending or failed, so a server that was offline when a change was made will pick it up once it is reachable again. See [Automation & Scheduled Tasks](../automation.md).
+:::
+
+## Network Pages
+
+Once you open a network you'll find these tabs:
+
+| Tab | What's in it |
+| --- | --- |
+| **Overview** | Status, address range, and counts for servers, peers, and firewall rules |
+| **Servers** | The servers in the network and their addresses |
+| **Peers** | Devices such as laptops or CI runners (WireGuard only) |
+| **Firewall** | Rules controlling what traffic is allowed inside the network |
+| **Logs** | Activity recorded against the network and the servers it runs on |
+| **Settings** | Rename the network, review its details, and delete it |
+
+The **Peers** tab is only available on WireGuard networks. On custom and provider networks the peer count on the Overview shows `N/A`.
diff --git a/docs/4.x/networks/peers.md b/docs/4.x/networks/peers.md
new file mode 100644
index 000000000..0fc40e544
--- /dev/null
+++ b/docs/4.x/networks/peers.md
@@ -0,0 +1,122 @@
+# Peers
+
+## Introduction
+
+**Peers** are devices that join a network without being a server Vito manages — a laptop, a CI runner, or an office router. A peer gets an address inside the network and can reach its servers privately.
+
+Peers are only available on **WireGuard** networks. On custom and provider networks the tab is disabled, since Vito doesn't control the tunnel.
+
+## Adding a Peer
+
+Click **Add peer** and give it a name. Vito allocates the next free address from the network's block and adds the peer to every member's configuration.
+
+You have two options for keys:
+
+- **Let Vito generate the keys.** The simplest option. Vito creates the key pair and can show you a ready-to-use configuration file.
+- **Bring your own public key.** Provide a public key you generated yourself. Vito never sees the private key, which means the device's key material never leaves it.
+
+## Getting the Configuration
+
+Use **Show config** to display the WireGuard configuration for a peer. Drop it into the WireGuard client on the device.
+
+For peers where you supplied your own public key, Vito cannot know the private key, so the configuration contains `REPLACE_WITH_YOUR_PRIVATE_KEY` on the `PrivateKey` line. Substitute the key that stays on the device.
+
+:::warning
+A peer's configuration contains the key material that grants access to your private network. Treat it like a password.
+:::
+
+## Connecting from macOS
+
+Here's the full path from adding a peer to reaching your servers from a Mac.
+
+### 1. Install the WireGuard App
+
+Install **WireGuard** from the [Mac App Store](https://apps.apple.com/us/app/wireguard/id1451685025). It's the official client and is free.
+
+If you prefer the command line, `brew install wireguard-tools` gives you `wg` and `wg-quick` instead. The steps below use the app.
+
+### 2. Add the Peer in Vito
+
+On the network's **Peers** tab, click **Add peer** and give it a name such as `macbook`. Let Vito generate the keys — this is the simplest route and means the configuration you get is complete and ready to use.
+
+### 3. Copy the Configuration
+
+Use **Show config** on the peer you just created. You'll get a WireGuard configuration that looks roughly like this:
+
+```ini
+[Interface]
+Address = 100.64.0.5/32
+PrivateKey = <your peer's private key>
+
+[Peer]
+PublicKey = <the first server's public key>
+AllowedIPs = 100.64.0.0/24
+Endpoint = 203.0.113.10:51820
+PersistentKeepalive = 25
+
+[Peer]
+PublicKey = <another server's public key>
+AllowedIPs = 100.64.0.3/32
+Endpoint = 203.0.113.11:51820
+PersistentKeepalive = 25
+```
+
+There is one `[Peer]` block per server in the network. The first one carries the whole network range in `AllowedIPs` so traffic for the network is routed through the tunnel; the rest are scoped to their own address.
+
+### 4. Create the Tunnel
+
+In the WireGuard app, click the **+** button in the bottom-left and choose **Add empty tunnel…**, then paste the configuration over the placeholder contents. Give the tunnel a name and click **Save**.
+
+macOS will ask for permission to add VPN configurations the first time — approve it.
+
+:::info
+You can also save the configuration as a file ending in `.conf` and use **Import tunnel(s) from file…** instead. The file name becomes the tunnel name.
+:::
+
+### 5. Activate and Test
+
+Select the tunnel and click **Activate**. The status changes to *Active* once the handshake succeeds.
+
+To confirm it's working, ping a server on its network address — you'll find it on the network's [Servers](servers.md) tab:
+
+```shell
+ping 100.64.0.2
+```
+
+Back in Vito, the peer's row on the **Peers** tab shows its last handshake once it has connected.
+
+### Bringing Your Own Key
+
+If you'd rather your private key never leave your Mac, generate a key pair first:
+
+```shell
+wg genkey | tee privatekey | wg pubkey > publickey
+```
+
+Give Vito the contents of `publickey` when adding the peer, then paste the contents of `privatekey` into the `PrivateKey` line of the configuration Vito shows you.
+
+### Troubleshooting
+
+- **The tunnel activates but nothing is reachable.** Check that the servers you want to reach are `active` on the network's [Servers](servers.md) tab, and that the network's [firewall rules](firewall.md) allow the port you're using.
+- **No handshake at all.** The peer needs to reach the server's `Endpoint` address and UDP port from wherever you are. Some restrictive networks block outbound UDP.
+- **It worked and then stopped.** If the peer's keys were regenerated in Vito, the old configuration is dead — copy the new one. The same applies if the network's listen port moved: adding a server that already uses the port for another network shifts this one to the next free port, and the `Endpoint` line in an already-imported configuration still points at the old one. Vito warns when this happens; download the configuration again.
+
+For anything deeper — split tunnelling, routing all traffic through the network, or running WireGuard from the command line — see the [official WireGuard documentation](https://www.wireguard.com/quickstart/).
+
+## Regenerating Keys
+
+**Regenerate keys** issues a new key pair for a peer. The old configuration stops working immediately, so the device must be reconfigured with the new one. Use this if a device is lost or its key may have been exposed.
+
+## Disabling a Peer
+
+**Disable** removes the peer from every member's configuration without deleting it. Its address stays reserved, so enabling it again restores access on the same address.
+
+This is a quick way to cut off a device temporarily without having to reissue its configuration afterwards.
+
+## Removing a Peer
+
+**Remove** deletes the peer and takes it out of every member's configuration. Its address is released back into the pool.
+
+## Connection Status
+
+Vito periodically asks one of the network's members for its last handshake with every peer, so the peers list shows whether a device is currently connected and when it was last seen. A peer keeps its tunnel alive with every member, so any one of them can answer for it.
diff --git a/docs/4.x/networks/provider-networks.md b/docs/4.x/networks/provider-networks.md
new file mode 100644
index 000000000..8bdf9fcde
--- /dev/null
+++ b/docs/4.x/networks/provider-networks.md
@@ -0,0 +1,98 @@
+# Provider Networks
+
+## Introduction
+
+If your servers already sit inside a private network at your cloud provider — a VPC — Vito can discover it and mirror it as a **provider network**. You get the same [firewall management](firewall.md) and visibility as any other network, without describing the topology by hand.
+
+Provider networks are created, updated, and removed entirely by syncing. They are read-only in the dashboard.
+
+## Supported Providers
+
+Vito reads private networks from the following [server provider](../settings/server-providers.md) connections:
+
+| Provider | Product |
+| --- | --- |
+| AWS | VPC |
+| DigitalOcean | VPC |
+| Hetzner | Cloud Networks |
+| Linode | VPC |
+| Vultr | VPC |
+
+Custom servers — those you added by IP address rather than through a provider connection — have no API to query and are skipped.
+
+:::info
+Vito only reads. It never creates, changes, or deletes a network at your provider.
+:::
+
+## Syncing
+
+### Syncing Every Network
+
+Click **Sync** on the Networks page. Vito looks at every server in the current project, groups them by the provider connection that created them, and asks each provider which private networks those servers belong to.
+
+For every network it finds, Vito will:
+
+- **Create** a provider network if it isn't in Vito yet.
+- **Add or remove servers** so membership matches the provider.
+- **Update addresses** when a server's private IP has changed.
+- **Delete** the network if it no longer exists at the provider.
+
+Syncing runs in the background. The networks list updates as it progresses.
+
+### Syncing One Network
+
+Open a provider network and click **Sync** on its **Servers** tab to reconcile just that network. If the network no longer exists at the provider, it is removed from Vito.
+
+### Sync Is Manual
+
+Vito does not sync provider networks on a schedule — it only happens when you click **Sync**. Changes you make directly in your provider's console will not appear in Vito until you do.
+
+## What Gets Imported
+
+Vito is deliberately conservative about what it pulls in.
+
+- **Only networks containing your servers.** A VPC is imported only if at least one of its instances is a server Vito manages in the current project. Unrelated VPCs in your cloud account are ignored.
+- **Only servers Vito manages.** Instances that Vito doesn't know about are ignored — they get no entry on the Servers tab and are not covered by the network's firewall rules.
+- **Only the current project.** Syncing affects the project you're viewing, using the provider connections its servers were created with.
+
+:::warning
+Because instances Vito doesn't manage are ignored, a provider network's firewall rules only cover the members you can see. Other machines in the same VPC are unaffected by them.
+:::
+
+## What You Can and Can't Change
+
+Membership belongs to the provider, so Vito won't let you edit it:
+
+| Action | Provider network |
+| --- | --- |
+| Add a server | Not available — attach the instance at your provider, then sync |
+| Change a server's IP | Not available — the provider reports it |
+| Remove a server | Not available — detach the instance at your provider, then sync |
+| Manage firewall rules | **Available** |
+| Rename the network | **Available** |
+| Delete the network | Not available while Vito can still sync it |
+
+Renaming is safe: Vito sets the name once, when the network is first imported, and never overwrites it afterwards. If you rename the VPC at your provider, your name in Vito stays.
+
+## Deleting
+
+You cannot delete a provider network while the connection it came from still exists — it would simply be re-imported on the next sync. Delete the network at your provider and sync instead.
+
+The exception is a network Vito can no longer sync, which becomes deletable so it isn't stranded. Its Settings page shows a notice explaining which case applies:
+
+- **Orphaned** — you deleted the [server provider connection](../settings/server-providers.md) it came from.
+- **Cannot be synced** — none of its servers still carries the identifier the provider knows them by, so Vito has no way to ask the provider about the network. This is rare; it usually means a server's provider details were changed outside Vito.
+
+## Addresses and Firewall Rules
+
+Provider networks use the private addresses reported by the provider. Their [firewall rules](firewall.md) are scoped to each member's individual address rather than the whole VPC range, so a rule only ever opens a port to the specific servers Vito manages.
+
+## Troubleshooting
+
+**Nothing was imported.** Check that your servers were created through a provider connection, and that at least one of them is attached to a network at the provider.
+
+**A network didn't sync.** If Vito can't reach a provider — an invalid token, a permissions error, or a rate limit — it skips that connection and leaves its networks untouched rather than risk deleting them. Try again, and check the connection under [Server Providers](../settings/server-providers.md).
+
+**Permission errors.** Reading private networks needs a token with permission to list networks and instances. Some providers scope this separately from the permissions Vito needed when the connection was first made — for example DigitalOcean requires the `vpc:read` scope. A connection that works for creating servers may still need its token updated.
+
+**A duplicate-looking network appeared.** If a discovered network's name clashes with an existing one in the project, Vito appends a suffix (for example `default-2`) rather than failing.
diff --git a/docs/4.x/networks/servers.md b/docs/4.x/networks/servers.md
new file mode 100644
index 000000000..7064547b2
--- /dev/null
+++ b/docs/4.x/networks/servers.md
@@ -0,0 +1,59 @@
+# Network Servers
+
+## Introduction
+
+The **Servers** tab lists the servers that belong to a network, the address each one uses inside it, and whether the server has a firewall installed.
+
+## Adding a Server
+
+Click **Add server** and choose a server from the project.
+
+On a **WireGuard** network, Vito allocates the next free address from the network's block, generates a key pair, installs WireGuard if needed, and updates every other member so they know about the new one.
+
+On a **Custom** network, you also choose which of the server's private IP addresses to use.
+
+Adding a server is not available on [provider networks](provider-networks.md) — attach the instance at your cloud provider and sync instead.
+
+:::info
+A server can belong to several networks at once. On WireGuard networks, each one gets its own interface and its own listen port.
+:::
+
+## Server Status
+
+Each member shows its own status:
+
+| Status | Meaning |
+| --- | --- |
+| `pending` | Waiting to be configured — usually because the server is offline |
+| `updating` | Vito is applying the configuration now |
+| `active` | Configured and in sync |
+| `failed` | Configuration failed; Vito retries automatically |
+| `leaving` | Being removed from the network |
+
+Vito re-checks pending and failed members every three minutes, so a server that was unreachable is picked up once it is back. That interval is how often a retry is attempted, not a deadline - a member that keeps failing is retried across several passes before it converges. After several consecutive failures the member drops to an hourly retry instead, so a server that stays broken for a long time no longer costs a sync attempt every three minutes, and still recovers on its own once it is fixed. **Sync** on the member forces an immediate attempt at any point.
+
+## Changing a Server's IP
+
+On a **Custom** network, use **Edit** to change which private IP address the server uses in this network. Vito re-applies the network's firewall rules with the new address.
+
+This is not available on WireGuard networks, where Vito owns the addressing, or on provider networks, where the provider does.
+
+## Regenerating Configuration
+
+On a **WireGuard** network, **Regenerate** re-applies the network configuration to a single server. Use it if a server's tunnel has drifted or you want to force a rewrite.
+
+## Syncing the Whole Network
+
+**Sync** re-applies the configuration to every server in the network. On a [provider network](provider-networks.md) it does something different: it queries your cloud provider and reconciles membership.
+
+## Removing a Server
+
+**Remove** takes the server out of the network. Vito tears the configuration down on that machine, removes the network's firewall rules from it, and updates the remaining members so they stop routing to it.
+
+If the server is unreachable — for example it has already been destroyed — Vito retries for a few minutes and then removes the membership anyway so the network can settle.
+
+Removing a server is not available on provider networks.
+
+:::warning
+Removing a server drops its private connectivity immediately. Make sure nothing is relying on that address first.
+:::
diff --git a/docs/4.x/servers/firewall.md b/docs/4.x/servers/firewall.md
index 0194a9176..2f70cb274 100644
--- a/docs/4.x/servers/firewall.md
+++ b/docs/4.x/servers/firewall.md
@@ -23,6 +23,10 @@ These rules are applied in the server level, Your server provider might have add
 Do not remove the SSH rule, This will cause Vito to lose connection to your server.
 :::
 
+## Network Rules
+
+If the server belongs to a [network](../networks/overview.md), the rules for that network also appear on this page as managed rules. They are listed here for visibility, but you edit them from the network's [Firewall](../networks/firewall.md) tab so they stay consistent across every server in the network.
+
 ## Create new Rule
 
 You can easily create firewall rules and deploy them to your server.
diff --git a/docs/4.x/servers/network.md b/docs/4.x/servers/network.md
index ddbf53cb2..2b44c3910 100644
--- a/docs/4.x/servers/network.md
+++ b/docs/4.x/servers/network.md
@@ -4,6 +4,10 @@
 
 The **Network** section of a server lets you view and manage the server's IP addresses. Vito detects the addresses configured on the server and lets you add or remove additional ones.
 
+:::info
+This page is about the addresses on a single server. To connect several servers together privately, see [Networks](../networks/overview.md). A [custom network](../networks/create.md) is built from the private addresses listed here.
+:::
+
 ## Viewing IP Addresses
 
 The Network page lists every IP address Vito knows about for the server, including:
diff --git a/docs/4.x/settings/server-providers.md b/docs/4.x/settings/server-providers.md
index 714a0510e..2692a627c 100644
--- a/docs/4.x/settings/server-providers.md
+++ b/docs/4.x/settings/server-providers.md
@@ -6,6 +6,8 @@ Vito provides integration with multiple server providers to deploy your servers
 
 When creating new servers, You can select the provider you've connected and deploy your servers with a few clicks.
 
+A connected provider is also used to discover the private networks your servers already belong to — see [Provider Networks](../networks/provider-networks.md).
+
 ## Supported Providers
 
 - AWS
diff --git a/eslint.config.js b/eslint.config.js
index e3d7b1934..7452ea534 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -37,7 +37,7 @@ export default [
     },
   },
   {
-    ignores: ['vendor', 'node_modules', 'public', 'bootstrap/ssr', 'tailwind.config.js'],
+    ignores: ['vendor', 'node_modules', 'public', 'storage', 'bootstrap/ssr', 'tailwind.config.js'],
   },
   prettier, // Turn off all rules that might conflict with Prettier
 ];
diff --git a/resources/js/components/app-sidebar-nested.tsx b/resources/js/components/app-sidebar-nested.tsx
index a20c92c1b..659598a35 100644
--- a/resources/js/components/app-sidebar-nested.tsx
+++ b/resources/js/components/app-sidebar-nested.tsx
@@ -1,4 +1,5 @@
 import { NavUser } from '@/components/nav-user';
+import { currentPath } from '@/lib/utils';
 import {
   Sidebar,
   SidebarContent,
@@ -237,7 +238,7 @@ export function AppSidebar() {
 
   const getMenuItems = (items: NavItem[]) => {
     return items.map((item) => {
-      const isActive = item.onlyActivePath ? window.location.href === item.href : window.location.href.startsWith(item.href);
+      const isActive = item.onlyActivePath ? currentPath() === item.href : window.location.href.startsWith(item.href);
 
       if (item.children && item.children.length > 0) {
         return (
diff --git a/resources/js/components/app-sidebar.tsx b/resources/js/components/app-sidebar.tsx
index 1d5ad064e..d53cc84da 100644
--- a/resources/js/components/app-sidebar.tsx
+++ b/resources/js/components/app-sidebar.tsx
@@ -1,4 +1,5 @@
 import { NavUser } from '@/components/nav-user';
+import { currentPath } from '@/lib/utils';
 import {
   Sidebar,
   SidebarContent,
@@ -24,6 +25,7 @@ import {
   ListEndIcon,
   LogsIcon,
   MousePointerClickIcon,
+  NetworkIcon,
   ServerIcon,
   Settings2Icon,
   WorkflowIcon,
@@ -38,6 +40,11 @@ export function AppSidebar({ secondNavItems, secondNavTitle }: { secondNavItems?
   const page = usePage<SharedData>();
 
   const mainNavItems: NavItem[] = [
+    {
+      title: 'Networks',
+      href: route('networks'),
+      icon: NetworkIcon,
+    },
     {
       title: 'Servers',
       href: route('servers'),
@@ -136,7 +143,7 @@ export function AppSidebar({ secondNavItems, secondNavTitle }: { secondNavItems?
                   <SidebarMenuItem key={`${item.title}-${item.href}`}>
                     <SidebarMenuButton
                       asChild
-                      isActive={item.onlyActivePath ? window.location.href === item.href : window.location.href.startsWith(item.href)}
+                      isActive={item.onlyActivePath ? currentPath() === item.href : window.location.href.startsWith(item.href)}
                       tooltip={{ children: item.title, hidden: false }}
                       hidden={item.hidden}
                     >
@@ -190,7 +197,7 @@ export function AppSidebar({ secondNavItems, secondNavTitle }: { secondNavItems?
               <SidebarGroupContent>
                 <SidebarMenu>
                   {secondNavItems.map((item) => {
-                    const isActive = item.onlyActivePath ? window.location.href === item.href : window.location.href.startsWith(item.href);
+                    const isActive = item.onlyActivePath ? currentPath() === item.href : window.location.href.startsWith(item.href);
 
                     if (item.children && item.children.length > 0) {
                       const groupActive =
@@ -199,7 +206,7 @@ export function AppSidebar({ secondNavItems, secondNavTitle }: { secondNavItems?
                           childItem.hidden
                             ? false
                             : childItem.onlyActivePath
-                              ? window.location.href === childItem.onlyActivePath
+                              ? currentPath() === childItem.href
                               : window.location.href.startsWith(childItem.href),
                         );
 
@@ -220,9 +227,7 @@ export function AppSidebar({ secondNavItems, secondNavTitle }: { secondNavItems?
                                     <SidebarMenuButton
                                       asChild
                                       isActive={
-                                        childItem.onlyActivePath
-                                          ? window.location.href === childItem.href
-                                          : window.location.href.startsWith(childItem.href)
+                                        childItem.onlyActivePath ? currentPath() === childItem.href : window.location.href.startsWith(childItem.href)
                                       }
                                     >
                                       {childItem.external ? (
diff --git a/resources/js/components/dialogs/registry.ts b/resources/js/components/dialogs/registry.ts
index 8b55c67d8..17df21db9 100644
--- a/resources/js/components/dialogs/registry.ts
+++ b/resources/js/components/dialogs/registry.ts
@@ -33,6 +33,12 @@ import SiteFeatureAction from '@/pages/site-features/components/feature-action';
 import ServerFeatureAction from '@/pages/server-features/components/feature-action';
 import Fail2banForm from '@/pages/security/components/fail2ban-form';
 import PhpSettingsDialog from '@/pages/site-settings/components/php-settings-dialog';
+import CreateNetwork from '@/pages/networks/components/create-network';
+import AddNetworkServer from '@/pages/networks/components/add-server';
+import EditNetworkServer from '@/pages/networks/components/edit-network-server';
+import NetworkFirewallRuleForm from '@/pages/networks/components/firewall-rule-form';
+import AddNetworkPeer from '@/pages/networks/components/add-peer';
+import PeerConfigDialog from '@/pages/networks/components/peer-config';
 
 export type DialogControlProps = { open: boolean; onOpenChange: (open: boolean) => void };
 
@@ -83,6 +89,12 @@ export const dialogs = {
   serverFeatureAction: ServerFeatureAction,
   fail2banForm: Fail2banForm,
   phpSettings: PhpSettingsDialog,
+  networkCreate: CreateNetwork,
+  networkAddServer: AddNetworkServer,
+  networkEditServer: EditNetworkServer,
+  networkFirewallForm: NetworkFirewallRuleForm,
+  networkAddPeer: AddNetworkPeer,
+  networkPeerConfig: PeerConfigDialog,
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
 } as const satisfies Record<string, ComponentType<any>>;
 
diff --git a/resources/js/components/ui/combobox.tsx b/resources/js/components/ui/combobox.tsx
index e6214ee77..946f30e4a 100644
--- a/resources/js/components/ui/combobox.tsx
+++ b/resources/js/components/ui/combobox.tsx
@@ -15,7 +15,7 @@ export function Combobox({
   placeholder = '',
   onValueChange,
 }: {
-  items: { value: string; label: string }[];
+  items: { value: string; label: string; keywords?: string[] }[];
   value: string;
   id?: string;
   searchText?: string;
@@ -45,6 +45,7 @@ export function Combobox({
                   <CommandItem
                     key={item.value}
                     value={item.value}
+                    keywords={item.keywords}
                     onSelect={(currentValue) => {
                       value = currentValue;
                       onValueChange(value);
diff --git a/resources/js/hooks/use-server-with-private-ip.ts b/resources/js/hooks/use-server-with-private-ip.ts
new file mode 100644
index 000000000..519e72342
--- /dev/null
+++ b/resources/js/hooks/use-server-with-private-ip.ts
@@ -0,0 +1,39 @@
+import { useState } from 'react';
+import { InertiaFormProps } from '@inertiajs/react';
+import { NetworkServerOption } from '@/types/network';
+import { PrivateIp } from '@/pages/networks/components/private-ip-select';
+
+export type ServerWithPrivateIpForm = {
+  servers: number[];
+  ip_addresses: Record<number, number>;
+};
+
+export function useServerWithPrivateIp<T extends ServerWithPrivateIpForm>(form: InertiaFormProps<T>, initialServers: NetworkServerOption[]) {
+  const [servers, setServers] = useState<NetworkServerOption[]>(initialServers);
+
+  const selectedServerId = form.data.servers[0] ?? null;
+  const selectedServer = selectedServerId ? (servers.find((s) => s.id === selectedServerId) ?? null) : null;
+
+  const selectServer = (id: number) => {
+    form.setData((prev) => ({ ...prev, servers: [id], ip_addresses: {} }));
+  };
+
+  const selectIp = (ipId: number) => {
+    form.setData((prev) => ({ ...prev, ip_addresses: selectedServerId ? { [selectedServerId]: ipId } : {} }));
+  };
+
+  const applyRefreshedIps = (serverId: number, ips: PrivateIp[]) => {
+    setServers((prev) => prev.map((s) => (s.id === serverId ? { ...s, private_ips: ips } : s)));
+  };
+
+  return {
+    servers,
+    selectedServerId,
+    selectedServer,
+    selectServer,
+    selectIp,
+    applyRefreshedIps,
+    selectedIp: selectedServerId ? form.data.ip_addresses[selectedServerId] : undefined,
+    ipError: selectedServerId ? (form.errors[`ip_addresses.${selectedServerId}` as keyof typeof form.errors] as string | undefined) : undefined,
+  };
+}
diff --git a/resources/js/layouts/database/layout.tsx b/resources/js/layouts/database/layout.tsx
index 74f7c8647..aa8c2a80b 100644
--- a/resources/js/layouts/database/layout.tsx
+++ b/resources/js/layouts/database/layout.tsx
@@ -1,4 +1,5 @@
 import { Server } from '@/types/server';
+import { currentPath } from '@/lib/utils';
 import { ReactNode } from 'react';
 import ServerLayout from '@/layouts/server/layout';
 import Container from '@/components/container';
@@ -36,9 +37,7 @@ export default function DatabaseLayout({ server, children }: { server: Server; c
                 <NavigationMenuLink
                   key={item.title}
                   asChild
-                  className={
-                    (item.onlyActivePath ? window.location.href === item.href : window.location.href.startsWith(item.href)) ? 'bg-muted' : ''
-                  }
+                  className={(item.onlyActivePath ? currentPath() === item.href : window.location.href.startsWith(item.href)) ? 'bg-muted' : ''}
                 >
                   <Link href={item.href}>
                     <div className="flex items-center gap-2">
diff --git a/resources/js/layouts/network/layout.tsx b/resources/js/layouts/network/layout.tsx
new file mode 100644
index 000000000..31b1521e7
--- /dev/null
+++ b/resources/js/layouts/network/layout.tsx
@@ -0,0 +1,57 @@
+import { type NavItem } from '@/types';
+import { FlameIcon, HomeIcon, LaptopIcon, LogsIcon, ServerIcon, Settings2Icon } from 'lucide-react';
+import { ReactNode } from 'react';
+import { Network } from '@/types/network';
+import Layout from '@/layouts/app/layout';
+import { usePage } from '@inertiajs/react';
+import { useRealtimeRecord } from '@/hooks/use-socket-events';
+
+export default function NetworkLayout({ children }: { children: ReactNode }) {
+  const page = usePage<{ network: Network }>();
+  const network = useRealtimeRecord<Network>(page.props.network, 'network')!;
+
+  if (typeof window === 'undefined') {
+    return null;
+  }
+
+  const sidebarNavItems: NavItem[] = [
+    {
+      title: 'Overview',
+      href: route('networks.show', { network: network.id }),
+      onlyActivePath: route('networks.show', { network: network.id }),
+      icon: HomeIcon,
+    },
+    {
+      title: 'Servers',
+      href: route('networks.servers', { network: network.id }),
+      icon: ServerIcon,
+    },
+    {
+      title: 'Peers',
+      href: route('networks.peers', { network: network.id }),
+      icon: LaptopIcon,
+      isDisabled: network.type_value !== 'wireguard',
+    },
+    {
+      title: 'Firewall',
+      href: route('networks.firewall', { network: network.id }),
+      icon: FlameIcon,
+    },
+    {
+      title: 'Logs',
+      href: route('networks.logs', { network: network.id }),
+      icon: LogsIcon,
+    },
+    {
+      title: 'Settings',
+      href: route('networks.settings', { network: network.id }),
+      icon: Settings2Icon,
+    },
+  ];
+
+  return (
+    <Layout secondNavItems={sidebarNavItems} secondNavTitle={network.name}>
+      <div>{children}</div>
+    </Layout>
+  );
+}
diff --git a/resources/js/lib/utils.ts b/resources/js/lib/utils.ts
index 358305c17..8efbd9345 100644
--- a/resources/js/lib/utils.ts
+++ b/resources/js/lib/utils.ts
@@ -5,6 +5,11 @@ export function cn(...inputs: ClassValue[]) {
   return twMerge(clsx(inputs));
 }
 
+// current absolute URL without its query string or hash, for exact nav-active matching
+export function currentPath(): string {
+  return window.location.href.split(/[?#]/)[0];
+}
+
 // convert kb to gb
 export function kbToGb(kb: number | string): number {
   if (typeof kb === 'string') {
@@ -30,6 +35,10 @@ export function formatBytes(bytes: number, decimals = 1): string {
   return `${(bytes / Math.pow(1024, i)).toFixed(i ? decimals : 0)} ${units[i]}`;
 }
 
+export function truncate(value: string, limit: number): string {
+  return value.length > limit ? `${value.slice(0, limit)}...` : value;
+}
+
 export function formatDateString(dateString: string | Date): string {
   const date = new Date(dateString);
 
diff --git a/resources/js/pages/backups/components/restore-backup.tsx b/resources/js/pages/backups/components/restore-backup.tsx
index e8c9e9319..93fa8340b 100644
--- a/resources/js/pages/backups/components/restore-backup.tsx
+++ b/resources/js/pages/backups/components/restore-backup.tsx
@@ -64,7 +64,7 @@ export default function RestoreBackup({
                 <div className="text-muted-foreground text-sm">
                   {file.database_engine
                     ? `Source: ${file.database_engine} ${file.database_version ?? ''}`.trim()
-                    : 'Source database engine/version unknown — this file can only be restored to its original server.'}
+                    : 'Source database engine/version unknown - this file can only be restored to its original server.'}
                 </div>
                 <FormField>
                   <Label htmlFor="target-server">To server</Label>
diff --git a/resources/js/pages/backups/files.tsx b/resources/js/pages/backups/files.tsx
index c71a47cec..bb52e86ff 100644
--- a/resources/js/pages/backups/files.tsx
+++ b/resources/js/pages/backups/files.tsx
@@ -26,7 +26,9 @@ export default function Files() {
 
   const visibleColumns = useMemo(
     () =>
-      page.props.backup.type === 'file' ? columns.filter((column) => !('accessorKey' in column && column.accessorKey === 'database_engine')) : columns,
+      page.props.backup.type === 'file'
+        ? columns.filter((column) => !('accessorKey' in column && column.accessorKey === 'database_engine'))
+        : columns,
     [page.props.backup.type],
   );
 
diff --git a/resources/js/pages/backups/index.tsx b/resources/js/pages/backups/index.tsx
index b368d2e9c..90c38a193 100644
--- a/resources/js/pages/backups/index.tsx
+++ b/resources/js/pages/backups/index.tsx
@@ -46,7 +46,10 @@ export default function Backups() {
           </div>
         </HeaderContainer>
 
-        <VitoTable tableData={page.props.backups} actions={(row: Row) => <BackupActions backup={asRow<{ resource: Backup }>(row, ['resource']).resource} />} />
+        <VitoTable
+          tableData={page.props.backups}
+          actions={(row: Row) => <BackupActions backup={asRow<{ resource: Backup }>(row, ['resource']).resource} />}
+        />
       </Container>
     </Comp>
   );
diff --git a/resources/js/pages/firewall/components/form.tsx b/resources/js/pages/firewall/components/form.tsx
index 4decd028f..77b6cced1 100644
--- a/resources/js/pages/firewall/components/form.tsx
+++ b/resources/js/pages/firewall/components/form.tsx
@@ -41,6 +41,16 @@ export default function RuleForm({
     mask: firewallRule?.mask?.toString() || '32',
   });
 
+  const changeSource = (source: string) => {
+    const hostMask = source.includes(':') ? '128' : '32';
+
+    form.setData((prev) => ({
+      ...prev,
+      source,
+      mask: prev.mask === '' || prev.mask === '32' || prev.mask === '128' ? hostMask : prev.mask,
+    }));
+  };
+
   const submit = (e: FormEvent) => {
     e.preventDefault();
     if (firewallRule) {
@@ -127,7 +137,7 @@ export default function RuleForm({
               <>
                 <FormField>
                   <Label htmlFor="source">Source</Label>
-                  <Input type="text" id="source" value={form.data.source} onChange={(e) => form.setData('source', e.target.value)} />
+                  <Input type="text" id="source" value={form.data.source} onChange={(e) => changeSource(e.target.value)} />
                   <InputError message={form.errors.source} />
                 </FormField>
 
@@ -138,8 +148,9 @@ export default function RuleForm({
                     <InfoIcon />
                     <AlertDescription>
                       <p>
-                        The mask sets how many IP addresses this rule covers. Use <code>32</code> for just this one IP, <code>24</code> for its whole
-                        local network (256 addresses), and smaller numbers to cover even more. Lower number = wider range.
+                        The mask sets how many IP addresses this rule covers. Use <code>{form.data.source.includes(':') ? '128' : '32'}</code> for
+                        just this one IP, <code>{form.data.source.includes(':') ? '64' : '24'}</code> for its whole local network, and smaller numbers
+                        to cover even more. Lower number = wider range.
                       </p>
                     </AlertDescription>
                   </Alert>
diff --git a/resources/js/pages/firewall/index.tsx b/resources/js/pages/firewall/index.tsx
index 5064542a2..732476a48 100644
--- a/resources/js/pages/firewall/index.tsx
+++ b/resources/js/pages/firewall/index.tsx
@@ -20,8 +20,10 @@ export default function Firewall() {
   const page = usePage<{
     server: Server;
     rules: InertiaTableData;
+    networkRules: InertiaTableData;
   }>();
   const dialog = useDialog();
+  const hasNetworkRules = (page.props.networkRules?.data?.length ?? 0) > 0;
 
   return (
     <ServerLayout>
@@ -70,6 +72,18 @@ export default function Firewall() {
             );
           }}
         />
+
+        {hasNetworkRules && (
+          <div className="flex flex-col gap-4">
+            <div>
+              <h2 className="text-base font-medium">Private network rules</h2>
+              <p className="text-muted-foreground text-sm">
+                These rules are applied by the private networks this server belongs to. They are read-only here &mdash; edit them from the network.
+              </p>
+            </div>
+            <VitoTable tableData={page.props.networkRules} />
+          </div>
+        )}
       </Container>
     </ServerLayout>
   );
diff --git a/resources/js/pages/networks/components/add-peer.tsx b/resources/js/pages/networks/components/add-peer.tsx
new file mode 100644
index 000000000..63e859a2f
--- /dev/null
+++ b/resources/js/pages/networks/components/add-peer.tsx
@@ -0,0 +1,89 @@
+import { Dialog, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { FormEvent, useState } from 'react';
+import { Form, FormField, FormFields } from '@/components/ui/form';
+import { Button } from '@/components/ui/button';
+import { useForm } from '@inertiajs/react';
+import { LoaderCircleIcon } from 'lucide-react';
+import { Label } from '@/components/ui/label';
+import { Input } from '@/components/ui/input';
+import { Textarea } from '@/components/ui/textarea';
+import { Checkbox } from '@/components/ui/checkbox';
+import InputError from '@/components/ui/input-error';
+
+export default function AddNetworkPeer({
+  open,
+  onOpenChange,
+  networkId,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  networkId: number;
+}) {
+  const [byo, setByo] = useState(false);
+  const form = useForm<{ name: string; public_key: string }>({
+    name: '',
+    public_key: '',
+  });
+
+  const submit = (e: FormEvent) => {
+    e.preventDefault();
+    form.transform((data) => ({ name: data.name, public_key: byo ? data.public_key : '' }));
+    form.post(route('networks.peers.store', { network: networkId }), {
+      onSuccess: () => {
+        form.reset();
+        setByo(false);
+        onOpenChange(false);
+      },
+    });
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-lg" onCloseAutoFocus={(e) => e.preventDefault()}>
+        <DialogHeader>
+          <DialogTitle>Add peer</DialogTitle>
+          <DialogDescription className="sr-only">Add a device to this network</DialogDescription>
+        </DialogHeader>
+        <Form id="add-network-peer-form" onSubmit={submit} className="p-4">
+          <FormFields>
+            <FormField>
+              <Label htmlFor="name">Name</Label>
+              <Input id="name" value={form.data.name} onChange={(e) => form.setData('name', e.target.value)} placeholder="e.g. my-laptop" />
+              <InputError message={form.errors.name} />
+            </FormField>
+
+            <FormField>
+              <div className="flex items-center gap-2">
+                <Checkbox id="byo" checked={byo} onCheckedChange={(checked) => setByo(checked === true)} />
+                <Label htmlFor="byo">I'll provide my own public key</Label>
+              </div>
+            </FormField>
+
+            {byo && (
+              <FormField>
+                <Label htmlFor="public_key">Public key</Label>
+                <Textarea
+                  id="public_key"
+                  value={form.data.public_key}
+                  onChange={(e) => form.setData('public_key', e.target.value)}
+                  placeholder="Base64-encoded WireGuard public key"
+                />
+                <p className="text-muted-foreground text-xs">Vito will never hold this peer's private key. The device keeps it.</p>
+                <InputError message={form.errors.public_key} />
+              </FormField>
+            )}
+          </FormFields>
+        </Form>
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button variant="outline">Close</Button>
+          </DialogClose>
+          <Button form="add-network-peer-form" type="submit" disabled={form.processing}>
+            {form.processing && <LoaderCircleIcon className="animate-spin" />}
+            Add peer
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/resources/js/pages/networks/components/add-server.tsx b/resources/js/pages/networks/components/add-server.tsx
new file mode 100644
index 000000000..8ead8661e
--- /dev/null
+++ b/resources/js/pages/networks/components/add-server.tsx
@@ -0,0 +1,106 @@
+import { Dialog, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { FormEvent } from 'react';
+import { Form, FormField, FormFields } from '@/components/ui/form';
+import { Button } from '@/components/ui/button';
+import { useForm } from '@inertiajs/react';
+import { LoaderCircleIcon } from 'lucide-react';
+import { Label } from '@/components/ui/label';
+import InputError from '@/components/ui/input-error';
+import { Combobox } from '@/components/ui/combobox';
+import { NetworkServerOption } from '@/types/network';
+import PrivateIpSelect from './private-ip-select';
+import { useServerWithPrivateIp } from '@/hooks/use-server-with-private-ip';
+
+type AddServerForm = {
+  servers: number[];
+  ip_addresses: Record<number, number>;
+};
+
+export default function AddServer({
+  open,
+  onOpenChange,
+  networkId,
+  isCustom,
+  servers: initialServers,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  networkId: number;
+  isCustom: boolean;
+  servers: NetworkServerOption[];
+}) {
+  const form = useForm<AddServerForm>({
+    servers: [],
+    ip_addresses: {},
+  });
+
+  const { servers, selectedServerId, selectedServer, selectServer, selectIp, applyRefreshedIps, selectedIp, ipError } = useServerWithPrivateIp(
+    form,
+    initialServers,
+  );
+
+  const submit = (e: FormEvent) => {
+    e.preventDefault();
+    form.post(route('networks.servers.store', { network: networkId }), {
+      onSuccess: () => {
+        onOpenChange(false);
+        form.reset();
+      },
+    });
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-lg" onCloseAutoFocus={(e) => e.preventDefault()}>
+        <DialogHeader>
+          <DialogTitle>Add server</DialogTitle>
+          <DialogDescription className="sr-only">Add a server to the network</DialogDescription>
+        </DialogHeader>
+        <Form id="add-server-form" onSubmit={submit} className="max-h-[70vh] overflow-y-auto p-4">
+          <FormFields>
+            <FormField>
+              <Label htmlFor="add-server">Server</Label>
+              <Combobox
+                id="add-server"
+                items={servers.map((server) => ({
+                  value: String(server.id),
+                  label: server.is_ready ? server.name : `${server.name} (not ready)`,
+                  keywords: [server.name],
+                }))}
+                value={selectedServerId ? String(selectedServerId) : ''}
+                placeholder="Select a server"
+                searchText="Filter servers..."
+                noneFoundText="No eligible servers available."
+                onValueChange={(value) => selectServer(Number(value))}
+              />
+              <InputError message={form.errors.servers} />
+            </FormField>
+
+            {isCustom && (
+              <FormField>
+                <Label htmlFor="add-server-ip">Private IP</Label>
+                <PrivateIpSelect
+                  serverId={selectedServerId}
+                  ips={selectedServer?.private_ips ?? []}
+                  value={selectedIp}
+                  onValueChange={selectIp}
+                  onRefreshed={applyRefreshedIps}
+                />
+                <InputError message={ipError} />
+              </FormField>
+            )}
+          </FormFields>
+        </Form>
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button variant="outline">Close</Button>
+          </DialogClose>
+          <Button form="add-server-form" type="submit" disabled={form.processing}>
+            {form.processing && <LoaderCircleIcon className="animate-spin" />}
+            Add
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/resources/js/pages/networks/components/create-network.tsx b/resources/js/pages/networks/components/create-network.tsx
new file mode 100644
index 000000000..c49283cd2
--- /dev/null
+++ b/resources/js/pages/networks/components/create-network.tsx
@@ -0,0 +1,198 @@
+import { Dialog, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { FormEvent } from 'react';
+import { Form, FormField, FormFields } from '@/components/ui/form';
+import { Button } from '@/components/ui/button';
+import { useForm } from '@inertiajs/react';
+import { LoaderCircleIcon } from 'lucide-react';
+import { Label } from '@/components/ui/label';
+import { Input } from '@/components/ui/input';
+import InputError from '@/components/ui/input-error';
+import { Select, SelectContent, SelectGroup, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Combobox } from '@/components/ui/combobox';
+import { NetworkServerOption } from '@/types/network';
+import PrivateIpSelect from './private-ip-select';
+import { useServerWithPrivateIp } from '@/hooks/use-server-with-private-ip';
+
+type CreateNetworkForm = {
+  name: string;
+  type: string;
+  servers: number[];
+  addressing_pool: string;
+  prefix: string;
+  port: string;
+  cidr: string;
+  ip_addresses: Record<number, number>;
+};
+
+export default function CreateNetwork({
+  open,
+  onOpenChange,
+  servers: initialServers,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  servers: NetworkServerOption[];
+}) {
+  const form = useForm<CreateNetworkForm>({
+    name: '',
+    type: 'wireguard',
+    servers: [],
+    addressing_pool: 'cgnat',
+    prefix: '24',
+    port: '51820',
+    cidr: '',
+    ip_addresses: {},
+  });
+
+  const isCustom = form.data.type === 'custom';
+
+  const {
+    servers,
+    selectedServerId: primaryServerId,
+    selectedServer: primaryServer,
+    selectServer: selectPrimaryServer,
+    selectIp,
+    applyRefreshedIps,
+    selectedIp,
+    ipError,
+  } = useServerWithPrivateIp(form, initialServers);
+
+  const submit = (e: FormEvent) => {
+    e.preventDefault();
+    form.post(route('networks.store'), {
+      onSuccess: () => {
+        onOpenChange(false);
+        form.reset();
+      },
+    });
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-lg" onCloseAutoFocus={(e) => e.preventDefault()}>
+        <DialogHeader>
+          <DialogTitle>Create network</DialogTitle>
+          <DialogDescription className="sr-only">Create a new private network</DialogDescription>
+        </DialogHeader>
+        <Form id="create-network-form" onSubmit={submit} className="max-h-[70vh] overflow-y-auto p-4">
+          <FormFields>
+            <FormField>
+              <Label htmlFor="name">Name</Label>
+              <Input id="name" value={form.data.name} onChange={(e) => form.setData('name', e.target.value)} />
+              <InputError message={form.errors.name} />
+            </FormField>
+
+            <FormField>
+              <Label htmlFor="type">Type</Label>
+              <Select
+                value={form.data.type}
+                onValueChange={(value) => form.setData((prev) => ({ ...prev, type: value, servers: [], ip_addresses: {} }))}
+              >
+                <SelectTrigger className="w-full">
+                  <SelectValue placeholder="Select type" />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectGroup>
+                    <SelectItem value="wireguard">WireGuard</SelectItem>
+                    <SelectItem value="custom">Custom</SelectItem>
+                  </SelectGroup>
+                </SelectContent>
+              </Select>
+              <InputError message={form.errors.type} />
+            </FormField>
+
+            {!isCustom && (
+              <>
+                <FormField>
+                  <Label htmlFor="addressing_pool">Address pool</Label>
+                  <Select value={form.data.addressing_pool} onValueChange={(value) => form.setData('addressing_pool', value)}>
+                    <SelectTrigger className="w-full">
+                      <SelectValue placeholder="Select pool" />
+                    </SelectTrigger>
+                    <SelectContent>
+                      <SelectGroup>
+                        <SelectItem value="cgnat">CGNAT (100.64.0.0/10)</SelectItem>
+                        <SelectItem value="rfc1918">Private (RFC1918)</SelectItem>
+                      </SelectGroup>
+                    </SelectContent>
+                  </Select>
+                  <InputError message={form.errors.addressing_pool} />
+                </FormField>
+
+                <FormField>
+                  <Label htmlFor="prefix">Block size (/prefix)</Label>
+                  <Input id="prefix" value={form.data.prefix} onChange={(e) => form.setData('prefix', e.target.value)} />
+                  <InputError message={form.errors.prefix} />
+                </FormField>
+
+                <FormField>
+                  <Label htmlFor="port">Listen port</Label>
+                  <Input id="port" value={form.data.port} onChange={(e) => form.setData('port', e.target.value)} />
+                  <p className="text-muted-foreground text-xs">
+                    The UDP port the tunnel listens on. Vito moves to the next free port if a selected server already uses this one for another
+                    network.
+                  </p>
+                  <InputError message={form.errors.port} />
+                </FormField>
+              </>
+            )}
+
+            {isCustom && (
+              <FormField>
+                <Label htmlFor="cidr">CIDR (optional)</Label>
+                <Input
+                  id="cidr"
+                  placeholder="e.g. 10.0.0.0/24 or fd00:1::/64"
+                  value={form.data.cidr}
+                  onChange={(e) => form.setData('cidr', e.target.value)}
+                />
+                <InputError message={form.errors.cidr} />
+              </FormField>
+            )}
+
+            <FormField>
+              <Label htmlFor="primary-server">Primary server</Label>
+              <Combobox
+                id="primary-server"
+                items={servers.map((server) => ({
+                  value: String(server.id),
+                  label: server.is_ready ? server.name : `${server.name} (not ready)`,
+                  keywords: [server.name],
+                }))}
+                value={primaryServerId ? String(primaryServerId) : ''}
+                placeholder="Select a server"
+                searchText="Filter servers..."
+                noneFoundText="No servers found."
+                onValueChange={(value) => selectPrimaryServer(Number(value))}
+              />
+              <InputError message={form.errors.servers} />
+            </FormField>
+
+            {isCustom && (
+              <FormField>
+                <Label htmlFor="primary-server-ip">Private IP</Label>
+                <PrivateIpSelect
+                  serverId={primaryServerId}
+                  ips={primaryServer?.private_ips ?? []}
+                  value={selectedIp}
+                  onValueChange={selectIp}
+                  onRefreshed={applyRefreshedIps}
+                />
+                <InputError message={ipError} />
+              </FormField>
+            )}
+          </FormFields>
+        </Form>
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button variant="outline">Close</Button>
+          </DialogClose>
+          <Button form="create-network-form" type="submit" disabled={form.processing}>
+            {form.processing && <LoaderCircleIcon className="animate-spin" />}
+            Create
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/resources/js/pages/networks/components/edit-network-server.tsx b/resources/js/pages/networks/components/edit-network-server.tsx
new file mode 100644
index 000000000..0c2e48096
--- /dev/null
+++ b/resources/js/pages/networks/components/edit-network-server.tsx
@@ -0,0 +1,76 @@
+import { Dialog, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { FormEvent, useState } from 'react';
+import { Form, FormField, FormFields } from '@/components/ui/form';
+import { Button } from '@/components/ui/button';
+import { useForm } from '@inertiajs/react';
+import { LoaderCircleIcon } from 'lucide-react';
+import { Label } from '@/components/ui/label';
+import InputError from '@/components/ui/input-error';
+import { NetworkMemberIp } from '@/types/network';
+import PrivateIpSelect, { PrivateIp } from './private-ip-select';
+
+export default function EditNetworkServer({
+  open,
+  onOpenChange,
+  networkId,
+  member,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  networkId: number;
+  member: NetworkMemberIp;
+}) {
+  const [ips, setIps] = useState<PrivateIp[]>(member.private_ips);
+
+  const form = useForm<{ server_ip_address_id: number | null }>({
+    server_ip_address_id: member.ip_address_id,
+  });
+
+  const submit = (e: FormEvent) => {
+    e.preventDefault();
+    form.put(route('networks.servers.update', { network: networkId, networkServer: member.id }), {
+      preserveScroll: true,
+      onSuccess: () => onOpenChange(false),
+    });
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-lg" onCloseAutoFocus={(e) => e.preventDefault()}>
+        <DialogHeader>
+          <DialogTitle>Edit {member.server_name}</DialogTitle>
+          <DialogDescription className="sr-only">Change the private IP this server uses on the network</DialogDescription>
+        </DialogHeader>
+        <Form id="edit-network-server-form" onSubmit={submit} className="p-4">
+          <FormFields>
+            <FormField>
+              <Label htmlFor="server_ip_address_id">Private IP</Label>
+              <PrivateIpSelect
+                serverId={member.server_id}
+                ips={ips}
+                value={form.data.server_ip_address_id ?? undefined}
+                onValueChange={(id) => form.setData('server_ip_address_id', id)}
+                onRefreshed={(_serverId, refreshed) => setIps(refreshed)}
+                refreshSource={{
+                  only: ['memberIps', 'flash'],
+                  resolve: (props, serverId) =>
+                    (props.memberIps as NetworkMemberIp[] | undefined)?.find((m) => m.server_id === serverId)?.private_ips,
+                }}
+              />
+              <InputError message={form.errors.server_ip_address_id} />
+            </FormField>
+          </FormFields>
+        </Form>
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button variant="outline">Close</Button>
+          </DialogClose>
+          <Button form="edit-network-server-form" type="submit" disabled={form.processing}>
+            {form.processing && <LoaderCircleIcon className="animate-spin" />}
+            Save
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/resources/js/pages/networks/components/firewall-rule-form.tsx b/resources/js/pages/networks/components/firewall-rule-form.tsx
new file mode 100644
index 000000000..c71af719c
--- /dev/null
+++ b/resources/js/pages/networks/components/firewall-rule-form.tsx
@@ -0,0 +1,109 @@
+import { Dialog, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { FormEvent } from 'react';
+import { Form, FormField, FormFields } from '@/components/ui/form';
+import { Button } from '@/components/ui/button';
+import { useForm } from '@inertiajs/react';
+import { LoaderCircleIcon } from 'lucide-react';
+import { Label } from '@/components/ui/label';
+import { Input } from '@/components/ui/input';
+import InputError from '@/components/ui/input-error';
+import { Select, SelectContent, SelectGroup, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { NetworkFirewallRule } from '@/types/network';
+
+export default function NetworkFirewallRuleForm({
+  open,
+  onOpenChange,
+  networkId,
+  rule,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  networkId: number;
+  rule?: NetworkFirewallRule;
+}) {
+  const form = useForm<{
+    name: string;
+    protocol: string;
+    port: string;
+  }>({
+    name: rule?.name || '',
+    protocol: rule?.protocol || '',
+    port: rule?.port || '',
+  });
+
+  const submit = (e: FormEvent) => {
+    e.preventDefault();
+    if (rule) {
+      form.put(route('networks.firewall.update', { network: networkId, networkFirewallRule: rule.id }), {
+        onSuccess: () => onOpenChange(false),
+      });
+      return;
+    }
+    form.post(route('networks.firewall.store', { network: networkId }), {
+      onSuccess: () => onOpenChange(false),
+    });
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-lg" onCloseAutoFocus={(e) => e.preventDefault()}>
+        <DialogHeader>
+          <DialogTitle>{rule ? 'Edit' : 'Create'} firewall rule</DialogTitle>
+          <DialogDescription className="sr-only">{rule ? 'Edit' : 'Create new'} network firewall rule</DialogDescription>
+        </DialogHeader>
+        <Form id="network-firewall-rule-form" onSubmit={submit} className="p-4">
+          <FormFields>
+            <FormField>
+              <Label htmlFor="name">Name</Label>
+              <Input id="name" value={form.data.name} onChange={(e) => form.setData('name', e.target.value)} />
+              <InputError message={form.errors.name} />
+            </FormField>
+
+            <FormField>
+              <Label htmlFor="protocol">Protocol</Label>
+              <Select
+                value={form.data.protocol === '' ? 'all' : form.data.protocol}
+                onValueChange={(value) => form.setData('protocol', value === 'all' ? '' : value)}
+              >
+                <SelectTrigger className="w-full">
+                  <SelectValue placeholder="All protocols" />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectGroup>
+                    <SelectItem value="all">All protocols</SelectItem>
+                    <SelectItem value="tcp">TCP</SelectItem>
+                    <SelectItem value="udp">UDP</SelectItem>
+                  </SelectGroup>
+                </SelectContent>
+              </Select>
+              <InputError message={form.errors.protocol} />
+            </FormField>
+
+            <FormField>
+              <Label htmlFor="port">Port</Label>
+              <Input
+                id="port"
+                placeholder="e.g. 3306 or 3000:3010 (leave empty for all)"
+                value={form.data.port}
+                onChange={(e) => form.setData('port', e.target.value)}
+              />
+              <p className="text-muted-foreground text-xs">
+                Protocol and port are independent — leave either empty to match all of it, or both to match all traffic from the network.
+              </p>
+              <InputError message={form.errors.port} />
+            </FormField>
+          </FormFields>
+        </Form>
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button variant="outline">Close</Button>
+          </DialogClose>
+          <Button form="network-firewall-rule-form" type="submit" disabled={form.processing}>
+            {form.processing && <LoaderCircleIcon className="animate-spin" />}
+            Save
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/resources/js/pages/networks/components/log-columns.tsx b/resources/js/pages/networks/components/log-columns.tsx
new file mode 100644
index 000000000..70940655e
--- /dev/null
+++ b/resources/js/pages/networks/components/log-columns.tsx
@@ -0,0 +1,23 @@
+import { Link } from '@inertiajs/react';
+import { ColumnDef } from '@tanstack/react-table';
+import { columns } from '@/pages/server-logs/components/columns';
+import { ServerLog } from '@/types/server-log';
+import { truncate } from '@/lib/utils';
+
+const SERVER_NAME_LIMIT = 30;
+
+const serverColumn: ColumnDef<ServerLog> = {
+  accessorKey: 'server_name',
+  header: 'Server',
+  cell: ({ row }) => {
+    const name = row.original.server_name ?? `#${row.original.server_id}`;
+
+    return (
+      <Link href={route('servers.show', { server: row.original.server_id })} className="text-foreground" prefetch>
+        <span title={name}>{truncate(name, SERVER_NAME_LIMIT)}</span>
+      </Link>
+    );
+  },
+};
+
+export const networkLogColumns: ColumnDef<ServerLog>[] = [serverColumn, ...columns];
diff --git a/resources/js/pages/networks/components/peer-config.tsx b/resources/js/pages/networks/components/peer-config.tsx
new file mode 100644
index 000000000..0fe55e45f
--- /dev/null
+++ b/resources/js/pages/networks/components/peer-config.tsx
@@ -0,0 +1,197 @@
+import { Dialog, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { useCallback, useEffect, useState } from 'react';
+import { Button } from '@/components/ui/button';
+import { router } from '@inertiajs/react';
+import { CheckIcon, CopyIcon, DownloadIcon, LoaderCircleIcon, TriangleAlertIcon } from 'lucide-react';
+import { Alert, AlertDescription } from '@/components/ui/alert';
+import { toast } from 'sonner';
+import axios from 'axios';
+
+function SectionHeader({ title, hint, children }: { title: string; hint: string; children?: React.ReactNode }) {
+  return (
+    <div className="flex items-start justify-between gap-4">
+      <div className="space-y-0.5">
+        <p className="text-sm leading-none font-medium">{title}</p>
+        <p className="text-muted-foreground text-xs">{hint}</p>
+      </div>
+      {children && <div className="flex shrink-0 items-center gap-1">{children}</div>}
+    </div>
+  );
+}
+
+export default function PeerConfigDialog({
+  open,
+  onOpenChange,
+  networkId,
+  peerId,
+  byo,
+  name,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  networkId: number;
+  peerId: number;
+  byo: boolean;
+  name: string;
+}) {
+  const [config, setConfig] = useState<string>('');
+  const [privateKey, setPrivateKey] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string>('');
+  const [concealing, setConcealing] = useState(false);
+  const [copied, setCopied] = useState<string>('');
+
+  const load = useCallback(
+    (signal?: AbortSignal) => {
+      setLoading(true);
+      setError('');
+
+      return axios
+        .get(route('networks.peers.config', { network: networkId, networkPeer: peerId }), { signal })
+        .then((response) => {
+          setConfig(response.data.config);
+          setPrivateKey(response.data.private_key ?? null);
+        })
+        .catch((e) => {
+          if (axios.isCancel(e)) return;
+          setError('Could not load the peer configuration.');
+        })
+        .finally(() => setLoading(false));
+    },
+    [networkId, peerId],
+  );
+
+  useEffect(() => {
+    if (!open) return;
+
+    const controller = new AbortController();
+    load(controller.signal);
+
+    return () => controller.abort();
+  }, [open, load]);
+
+  const copy = (value: string, key: string, label: string) => {
+    navigator.clipboard
+      .writeText(value)
+      .then(() => {
+        setCopied(key);
+        toast.success(`${label} copied`);
+        setTimeout(() => setCopied(''), 2000);
+      })
+      .catch(() => toast.error('Could not copy to clipboard'));
+  };
+
+  const download = () => {
+    const blob = new Blob([config], { type: 'text/plain' });
+    const url = URL.createObjectURL(blob);
+    const link = document.createElement('a');
+    link.href = url;
+    link.download = `${name}.conf`;
+    document.body.appendChild(link);
+    link.click();
+    link.remove();
+    URL.revokeObjectURL(url);
+  };
+
+  const conceal = () => {
+    setConcealing(true);
+    router.post(
+      route('networks.peers.conceal', { network: networkId, networkPeer: peerId }),
+      {},
+      {
+        preserveScroll: true,
+        // Reload rather than close: the configuration stays available, so show the user
+        // what it looks like now that the private key is gone.
+        onSuccess: () => load(),
+        onError: () => toast.error('Could not conceal the private key'),
+        onFinish: () => setConcealing(false),
+      },
+    );
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-xl" onCloseAutoFocus={(e) => e.preventDefault()}>
+        <DialogHeader>
+          <DialogTitle>Peer configuration</DialogTitle>
+          <DialogDescription>Import this into the WireGuard client on {name}.</DialogDescription>
+        </DialogHeader>
+
+        <div className="max-h-[65vh] space-y-6 overflow-y-auto p-4">
+          {loading && (
+            <div className="text-muted-foreground flex items-center gap-2 py-6 text-sm">
+              <LoaderCircleIcon className="size-4 animate-spin" />
+              Loading configuration…
+            </div>
+          )}
+
+          {!loading && error && (
+            <Alert variant="destructive">
+              <TriangleAlertIcon />
+              <AlertDescription>
+                <p>{error}</p>
+              </AlertDescription>
+            </Alert>
+          )}
+
+          {!loading && !error && (
+            <>
+              {privateKey && (
+                <section className="space-y-2">
+                  <SectionHeader title="Private key" hint="Shown once - Vito deletes it when you confirm below.">
+                    <Button type="button" variant="outline" size="sm" onClick={() => copy(privateKey, 'key', 'Private key')}>
+                      {copied === 'key' ? <CheckIcon /> : <CopyIcon />}
+                      Copy
+                    </Button>
+                  </SectionHeader>
+                  <pre className="bg-muted/50 overflow-x-auto rounded-md border p-3 font-mono text-xs">{privateKey}</pre>
+                </section>
+              )}
+
+              {!privateKey && (
+                <Alert>
+                  <TriangleAlertIcon />
+                  <AlertDescription>
+                    <p>
+                      {byo
+                        ? 'This peer uses a key you provided, so Vito never had its private key.'
+                        : 'This private key was concealed and cannot be shown again.'}{' '}
+                      Set the <span className="font-mono">PrivateKey</span> line below to the peer's own private key
+                      {byo ? '.' : ', or regenerate the peer keys to issue a new one.'}
+                    </p>
+                  </AlertDescription>
+                </Alert>
+              )}
+
+              <section className="space-y-2">
+                <SectionHeader title="Configuration" hint="Updates as servers join or leave - reopen this any time.">
+                  <Button type="button" variant="outline" size="sm" onClick={() => copy(config, 'config', 'Configuration')}>
+                    {copied === 'config' ? <CheckIcon /> : <CopyIcon />}
+                    Copy
+                  </Button>
+                  <Button type="button" variant="outline" size="sm" onClick={download}>
+                    <DownloadIcon />
+                    .conf
+                  </Button>
+                </SectionHeader>
+                <pre className="bg-muted/50 max-h-64 overflow-auto rounded-md border p-3 font-mono text-xs leading-relaxed">{config}</pre>
+              </section>
+            </>
+          )}
+        </div>
+
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button variant="outline">Close</Button>
+          </DialogClose>
+          {privateKey && !error && (
+            <Button disabled={loading || concealing} onClick={conceal}>
+              {concealing && <LoaderCircleIcon className="animate-spin" />}
+              I've saved the private key
+            </Button>
+          )}
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/resources/js/pages/networks/components/private-ip-select.tsx b/resources/js/pages/networks/components/private-ip-select.tsx
new file mode 100644
index 000000000..5336dc392
--- /dev/null
+++ b/resources/js/pages/networks/components/private-ip-select.tsx
@@ -0,0 +1,105 @@
+import { useState } from 'react';
+import { router } from '@inertiajs/react';
+import { RefreshCw, TriangleAlertIcon } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { Select, SelectContent, SelectGroup, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Alert, AlertDescription } from '@/components/ui/alert';
+import { NetworkServerOption } from '@/types/network';
+
+export type PrivateIp = NetworkServerOption['private_ips'][number];
+
+type RefreshSource = {
+  only: string[];
+  resolve: (props: Record<string, unknown>, serverId: number) => PrivateIp[] | undefined;
+};
+
+const defaultRefreshSource: RefreshSource = {
+  only: ['servers', 'flash'],
+  resolve: (props, serverId) => {
+    const servers = props.servers;
+    if (!Array.isArray(servers)) {
+      return undefined;
+    }
+    return (servers as NetworkServerOption[]).find((s) => s.id === serverId)?.private_ips;
+  },
+};
+
+export default function PrivateIpSelect({
+  serverId,
+  ips,
+  value,
+  onValueChange,
+  onRefreshed,
+  disabled = false,
+  refreshSource = defaultRefreshSource,
+}: {
+  serverId: number | null;
+  ips: PrivateIp[];
+  value?: number;
+  onValueChange: (id: number) => void;
+  onRefreshed: (serverId: number, ips: PrivateIp[]) => void;
+  disabled?: boolean;
+  refreshSource?: RefreshSource;
+}) {
+  const [refreshing, setRefreshing] = useState(false);
+
+  const refresh = () => {
+    if (!serverId) {
+      return;
+    }
+    setRefreshing(true);
+    router.post(
+      route('servers.network.refresh', { server: serverId }),
+      {},
+      {
+        preserveScroll: true,
+        preserveState: true,
+        only: refreshSource.only,
+        onSuccess: (page) => {
+          const refreshed = refreshSource.resolve(page.props as Record<string, unknown>, serverId);
+          if (refreshed) {
+            onRefreshed(serverId, refreshed);
+          }
+        },
+        onFinish: () => setRefreshing(false),
+      },
+    );
+  };
+
+  const primaryChosen = ips.find((ip) => ip.id === value)?.is_primary;
+
+  return (
+    <div className="flex flex-col gap-2">
+      <div className="flex items-center gap-2">
+        <Select value={value ? String(value) : ''} onValueChange={(v) => onValueChange(Number(v))} disabled={disabled || !serverId}>
+          <SelectTrigger className="flex-1">
+            <SelectValue placeholder={serverId ? 'Select a private IP' : 'Select a server first'} />
+          </SelectTrigger>
+          <SelectContent>
+            {ips.length === 0 ? (
+              <div className="text-muted-foreground px-2 py-1.5 text-sm">No private IPs available</div>
+            ) : (
+              <SelectGroup>
+                {ips.map((ip) => (
+                  <SelectItem key={ip.id} value={String(ip.id)}>
+                    {ip.ip}
+                    {ip.is_primary ? ' (primary)' : ''}
+                  </SelectItem>
+                ))}
+              </SelectGroup>
+            )}
+          </SelectContent>
+        </Select>
+        <Button variant="outline" type="button" aria-label="Refresh" disabled={disabled || refreshing || !serverId} onClick={refresh}>
+          <RefreshCw className={refreshing ? 'animate-spin' : ''} />
+        </Button>
+      </div>
+      {primaryChosen && (
+        <Alert>
+          <TriangleAlertIcon />
+          <AlertDescription>This is the server&apos;s primary IP. Make sure you intend to use it for this network.</AlertDescription>
+        </Alert>
+      )}
+    </div>
+  );
+}
diff --git a/resources/js/pages/networks/firewall.tsx b/resources/js/pages/networks/firewall.tsx
new file mode 100644
index 000000000..7158dce3e
--- /dev/null
+++ b/resources/js/pages/networks/firewall.tsx
@@ -0,0 +1,88 @@
+import { Head, usePage } from '@inertiajs/react';
+import Container from '@/components/container';
+import HeaderContainer from '@/components/header-container';
+import Heading from '@/components/heading';
+import { Button } from '@/components/ui/button';
+import { BookOpenIcon, MoreVerticalIcon, PlusIcon } from 'lucide-react';
+import { VitoTable } from '@/components/vito-table';
+import { useRealtimeRecord } from '@/hooks/use-socket-events';
+import NetworkLayout from '@/layouts/network/layout';
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuSeparator, DropdownMenuTrigger } from '@/components/ui/dropdown-menu';
+import type { InertiaTableData, Row } from '@forjedio/inertia-table-react';
+import { asRow } from '@/lib/inertia-table';
+import { useDialog } from '@/hooks/use-dialog';
+import { Network, NetworkFirewallRule } from '@/types/network';
+
+export default function NetworkFirewall() {
+  const page = usePage<{
+    network: Network;
+    rules: InertiaTableData;
+  }>();
+  const dialog = useDialog();
+  const network = useRealtimeRecord<Network>(page.props.network, 'network')!;
+
+  return (
+    <NetworkLayout>
+      <Head title={`Firewall - ${network.name}`} />
+
+      <Container className="max-w-5xl">
+        <HeaderContainer>
+          <Heading
+            title="Firewall"
+            description="Rules allow traffic from the network. The default 'Allow all' rule permits everything - delete it to lock the network down"
+          />
+          <div className="flex items-center gap-2">
+            <a href="https://vitodeploy.com/docs/networks/firewall" target="_blank" rel="noreferrer">
+              <Button variant="outline">
+                <BookOpenIcon />
+                <span className="hidden lg:block">Docs</span>
+              </Button>
+            </a>
+            <Button onClick={() => dialog.networkFirewallForm.open({ networkId: network.id })}>
+              <PlusIcon />
+              <span className="hidden lg:block">Rule</span>
+            </Button>
+          </div>
+        </HeaderContainer>
+
+        <VitoTable
+          tableData={page.props.rules}
+          actions={(row: Row) => {
+            const rule = asRow<NetworkFirewallRule>(row, ['id', 'name']);
+            return (
+              <div className="flex items-center justify-end">
+                <DropdownMenu modal={false}>
+                  <DropdownMenuTrigger asChild>
+                    <Button variant="ghost" className="h-8 w-8 p-0">
+                      <span className="sr-only">Open menu</span>
+                      <MoreVerticalIcon />
+                    </Button>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end">
+                    <DropdownMenuItem onSelect={() => dialog.networkFirewallForm.open({ networkId: network.id, rule })}>Edit</DropdownMenuItem>
+                    <DropdownMenuSeparator />
+                    <DropdownMenuItem
+                      variant="destructive"
+                      onSelect={() =>
+                        dialog.confirm.open({
+                          title: `Delete rule [${rule.name}]`,
+                          description: 'Are you sure you want to delete this firewall rule?',
+                          variant: 'destructive',
+                          confirmLabel: 'Delete',
+                          method: 'delete',
+                          url: route('networks.firewall.destroy', { network: network.id, networkFirewallRule: rule.id }),
+                        })
+                      }
+                    >
+                      Delete
+                    </DropdownMenuItem>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              </div>
+            );
+          }}
+        />
+      </Container>
+    </NetworkLayout>
+  );
+}
diff --git a/resources/js/pages/networks/index.tsx b/resources/js/pages/networks/index.tsx
new file mode 100644
index 000000000..f68d0a30a
--- /dev/null
+++ b/resources/js/pages/networks/index.tsx
@@ -0,0 +1,72 @@
+import { Head, Link, usePage } from '@inertiajs/react';
+import Container from '@/components/container';
+import HeaderContainer from '@/components/header-container';
+import Heading from '@/components/heading';
+import { Button } from '@/components/ui/button';
+import { BookOpenIcon, EyeIcon, PlusIcon, RefreshCwIcon } from 'lucide-react';
+import { VitoTable } from '@/components/vito-table';
+import Layout from '@/layouts/app/layout';
+import type { InertiaTableData, Row } from '@forjedio/inertia-table-react';
+import { useDialog } from '@/hooks/use-dialog';
+import { NetworkServerOption } from '@/types/network';
+
+export default function Networks() {
+  const page = usePage<{
+    networks: InertiaTableData;
+    servers: NetworkServerOption[];
+  }>();
+  const dialog = useDialog();
+
+  return (
+    <Layout>
+      <Head title="Networks" />
+
+      <Container className="max-w-5xl">
+        <HeaderContainer>
+          <Heading title="Networks" description="Private networks connecting the servers in this project" />
+          <div className="flex items-center gap-2">
+            <a href="https://vitodeploy.com/docs/networks/overview" target="_blank" rel="noreferrer">
+              <Button variant="outline">
+                <BookOpenIcon />
+                <span className="hidden lg:block">Docs</span>
+              </Button>
+            </a>
+            <Button
+              variant="outline"
+              onClick={() =>
+                dialog.confirm.open({
+                  title: 'Sync provider networks',
+                  description:
+                    "Query every cloud provider connection used by this project's servers and create, update or remove provider-managed networks to match. Servers Vito does not manage are ignored.",
+                  confirmLabel: 'Sync',
+                  method: 'post',
+                  url: route('networks.sync-providers'),
+                })
+              }
+            >
+              <RefreshCwIcon />
+              <span className="hidden lg:block">Sync</span>
+            </Button>
+            <Button onClick={() => dialog.networkCreate.open({ servers: page.props.servers })}>
+              <PlusIcon />
+              <span className="hidden lg:block">Create</span>
+            </Button>
+          </div>
+        </HeaderContainer>
+
+        <VitoTable
+          tableData={page.props.networks}
+          actions={(row: Row) => (
+            <div className="flex items-center justify-end">
+              <Button variant="outline" size="sm" asChild>
+                <Link href={route('networks.show', { network: row.id })} aria-label="View network" prefetch>
+                  <EyeIcon />
+                </Link>
+              </Button>
+            </div>
+          )}
+        />
+      </Container>
+    </Layout>
+  );
+}
diff --git a/resources/js/pages/networks/logs.tsx b/resources/js/pages/networks/logs.tsx
new file mode 100644
index 000000000..f66e8831b
--- /dev/null
+++ b/resources/js/pages/networks/logs.tsx
@@ -0,0 +1,39 @@
+import { Head, usePage } from '@inertiajs/react';
+import Container from '@/components/container';
+import HeaderContainer from '@/components/header-container';
+import Heading from '@/components/heading';
+import { Button } from '@/components/ui/button';
+import { BookOpenIcon } from 'lucide-react';
+import NetworkLayout from '@/layouts/network/layout';
+import { DataTable } from '@/components/data-table';
+import { networkLogColumns } from '@/pages/networks/components/log-columns';
+import { useRealtime, useRealtimeRecord } from '@/hooks/use-socket-events';
+import { PaginatedData } from '@/types';
+import { ServerLog } from '@/types/server-log';
+import { Network } from '@/types/network';
+
+export default function NetworkLogs() {
+  const page = usePage<{ network: Network; logs: PaginatedData<ServerLog> }>();
+  const network = useRealtimeRecord<Network>(page.props.network, 'network')!;
+  const [logs] = useRealtime<ServerLog>(page.props.logs, 'server-log', { network_id: network.id });
+
+  return (
+    <NetworkLayout>
+      <Head title={`Logs - ${network.name}`} />
+
+      <Container className="max-w-5xl">
+        <HeaderContainer>
+          <Heading title="Logs" description="Activity recorded against this network and the servers it runs on" />
+          <a href="https://vitodeploy.com/docs/networks/overview" target="_blank" rel="noreferrer">
+            <Button variant="outline">
+              <BookOpenIcon />
+              <span className="hidden lg:block">Docs</span>
+            </Button>
+          </a>
+        </HeaderContainer>
+
+        <DataTable columns={networkLogColumns} paginatedData={logs} searchable sortable />
+      </Container>
+    </NetworkLayout>
+  );
+}
diff --git a/resources/js/pages/networks/peers.tsx b/resources/js/pages/networks/peers.tsx
new file mode 100644
index 000000000..d3b21672f
--- /dev/null
+++ b/resources/js/pages/networks/peers.tsx
@@ -0,0 +1,120 @@
+import { Head, usePage } from '@inertiajs/react';
+import Container from '@/components/container';
+import HeaderContainer from '@/components/header-container';
+import Heading from '@/components/heading';
+import { Button } from '@/components/ui/button';
+import { BookOpenIcon, MoreVerticalIcon, PlusIcon } from 'lucide-react';
+import { VitoTable } from '@/components/vito-table';
+import { useRealtimeRecord } from '@/hooks/use-socket-events';
+import NetworkLayout from '@/layouts/network/layout';
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuSeparator, DropdownMenuTrigger } from '@/components/ui/dropdown-menu';
+import type { InertiaTableData, Row } from '@forjedio/inertia-table-react';
+import { asRow } from '@/lib/inertia-table';
+import { useDialog } from '@/hooks/use-dialog';
+import { Network, NetworkPeer } from '@/types/network';
+
+export default function NetworkPeers() {
+  const page = usePage<{
+    network: Network;
+    peers: InertiaTableData;
+  }>();
+  const dialog = useDialog();
+  const network = useRealtimeRecord<Network>(page.props.network, 'network')!;
+
+  return (
+    <NetworkLayout>
+      <Head title={`Peers - ${network.name}`} />
+
+      <Container className="max-w-5xl">
+        <HeaderContainer>
+          <Heading title="Peers" description="Devices that connect to this network, such as laptops or CI runners" />
+          <div className="flex items-center gap-2">
+            <a href="https://vitodeploy.com/docs/networks/peers" target="_blank" rel="noreferrer">
+              <Button variant="outline">
+                <BookOpenIcon />
+                <span className="hidden lg:block">Docs</span>
+              </Button>
+            </a>
+            <Button onClick={() => dialog.networkAddPeer.open({ networkId: network.id })}>
+              <PlusIcon />
+              <span className="hidden lg:block">Add peer</span>
+            </Button>
+          </div>
+        </HeaderContainer>
+
+        <VitoTable
+          tableData={page.props.peers}
+          actions={(row: Row) => {
+            const peer = asRow<NetworkPeer>(row, ['id', 'name', 'status', 'byo', 'has_private_key']);
+            const disabled = peer.status === 'disabled';
+            return (
+              <div className="flex items-center justify-end">
+                <DropdownMenu modal={false}>
+                  <DropdownMenuTrigger asChild>
+                    <Button variant="ghost" className="h-8 w-8 p-0">
+                      <span className="sr-only">Open menu</span>
+                      <MoreVerticalIcon />
+                    </Button>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end">
+                    <DropdownMenuItem
+                      onSelect={() => dialog.networkPeerConfig.open({ networkId: network.id, peerId: peer.id, byo: peer.byo, name: peer.name })}
+                    >
+                      Show config
+                    </DropdownMenuItem>
+                    <DropdownMenuItem
+                      onSelect={() =>
+                        dialog.confirm.open({
+                          title: 'Regenerate keys',
+                          description:
+                            'Generate a new key pair for this peer. Its current configuration will stop working until the peer is reconfigured.',
+                          confirmLabel: 'Regenerate',
+                          method: 'post',
+                          url: route('networks.peers.regenerate', { network: network.id, networkPeer: peer.id }),
+                        })
+                      }
+                    >
+                      Regenerate keys
+                    </DropdownMenuItem>
+                    <DropdownMenuItem
+                      onSelect={() =>
+                        dialog.confirm.open({
+                          title: disabled ? 'Enable peer' : 'Disable peer',
+                          description: disabled
+                            ? 'Re-add this peer to every member configuration.'
+                            : 'Remove this peer from every member configuration. Its IP address stays reserved.',
+                          confirmLabel: disabled ? 'Enable' : 'Disable',
+                          method: 'put',
+                          url: route('networks.peers.update', { network: network.id, networkPeer: peer.id }),
+                          data: { name: peer.name, enabled: disabled },
+                        })
+                      }
+                    >
+                      {disabled ? 'Enable' : 'Disable'}
+                    </DropdownMenuItem>
+                    <DropdownMenuSeparator />
+                    <DropdownMenuItem
+                      variant="destructive"
+                      onSelect={() =>
+                        dialog.confirm.open({
+                          title: 'Remove peer',
+                          description: 'Remove this peer from the network and every member configuration.',
+                          variant: 'destructive',
+                          confirmLabel: 'Remove',
+                          method: 'delete',
+                          url: route('networks.peers.destroy', { network: network.id, networkPeer: peer.id }),
+                        })
+                      }
+                    >
+                      Remove
+                    </DropdownMenuItem>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              </div>
+            );
+          }}
+        />
+      </Container>
+    </NetworkLayout>
+  );
+}
diff --git a/resources/js/pages/networks/servers.tsx b/resources/js/pages/networks/servers.tsx
new file mode 100644
index 000000000..1e9a97b50
--- /dev/null
+++ b/resources/js/pages/networks/servers.tsx
@@ -0,0 +1,141 @@
+import { Head, usePage } from '@inertiajs/react';
+import Container from '@/components/container';
+import HeaderContainer from '@/components/header-container';
+import Heading from '@/components/heading';
+import { Button } from '@/components/ui/button';
+import { BookOpenIcon, MoreVerticalIcon, PlusIcon, RefreshCwIcon } from 'lucide-react';
+import { VitoTable } from '@/components/vito-table';
+import { useRealtimeRecord } from '@/hooks/use-socket-events';
+import NetworkLayout from '@/layouts/network/layout';
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuSeparator, DropdownMenuTrigger } from '@/components/ui/dropdown-menu';
+import type { InertiaTableData, Row } from '@forjedio/inertia-table-react';
+import { asRow } from '@/lib/inertia-table';
+import { useDialog } from '@/hooks/use-dialog';
+import { Network, NetworkMemberIp, NetworkServer, NetworkServerOption } from '@/types/network';
+
+export default function NetworkServers() {
+  const page = usePage<{
+    network: Network;
+    members: InertiaTableData;
+    servers: NetworkServerOption[];
+    memberIps: NetworkMemberIp[];
+  }>();
+  const dialog = useDialog();
+  const network = useRealtimeRecord<Network>(page.props.network, 'network')!;
+  const isCustom = network.type_value === 'custom';
+  const isWireGuard = network.type_value === 'wireguard';
+  const isManaged = network.type_value === 'provider';
+
+  return (
+    <NetworkLayout>
+      <Head title={`Servers - ${network.name}`} />
+
+      <Container className="max-w-5xl">
+        <HeaderContainer>
+          <Heading title="Servers" description="Servers connected to this network" />
+          <div className="flex items-center gap-2">
+            <a href="https://vitodeploy.com/docs/networks/servers" target="_blank" rel="noreferrer">
+              <Button variant="outline">
+                <BookOpenIcon />
+                <span className="hidden lg:block">Docs</span>
+              </Button>
+            </a>
+            <Button
+              variant="outline"
+              onClick={() =>
+                dialog.confirm.open({
+                  title: `Sync network [${network.name}]`,
+                  description: isManaged
+                    ? "Query the provider and update this network's members to match. The network is removed if it no longer exists at the provider."
+                    : 'Re-apply configuration to every server in this network.',
+                  confirmLabel: 'Sync',
+                  method: 'post',
+                  url: route('networks.sync', { network: network.id }),
+                })
+              }
+            >
+              <RefreshCwIcon />
+              <span className="hidden lg:block">Sync</span>
+            </Button>
+            {!isManaged && (
+              <Button onClick={() => dialog.networkAddServer.open({ networkId: network.id, isCustom, servers: page.props.servers })}>
+                <PlusIcon />
+                <span className="hidden lg:block">Add server</span>
+              </Button>
+            )}
+          </div>
+        </HeaderContainer>
+
+        <VitoTable
+          tableData={page.props.members}
+          actions={(row: Row) => {
+            const member = asRow<NetworkServer>(row, ['id', 'server_id']);
+
+            // Every action here is rejected server-side on a provider-managed network.
+            if (isManaged) {
+              return null;
+            }
+
+            return (
+              <div className="flex items-center justify-end">
+                <DropdownMenu modal={false}>
+                  <DropdownMenuTrigger asChild>
+                    <Button variant="ghost" className="h-8 w-8 p-0">
+                      <span className="sr-only">Open menu</span>
+                      <MoreVerticalIcon />
+                    </Button>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end">
+                    {isCustom && (
+                      <DropdownMenuItem
+                        onSelect={() => {
+                          const memberIp = page.props.memberIps.find((m) => m.id === member.id);
+                          if (memberIp) {
+                            dialog.networkEditServer.open({ networkId: network.id, member: memberIp });
+                          }
+                        }}
+                      >
+                        Edit
+                      </DropdownMenuItem>
+                    )}
+                    {isWireGuard && (
+                      <DropdownMenuItem
+                        onSelect={() =>
+                          dialog.confirm.open({
+                            title: 'Regenerate configuration',
+                            description: 'Re-apply the network configuration to this server.',
+                            confirmLabel: 'Regenerate',
+                            method: 'post',
+                            url: route('networks.servers.sync', { network: network.id, networkServer: member.id }),
+                          })
+                        }
+                      >
+                        Regenerate
+                      </DropdownMenuItem>
+                    )}
+                    <DropdownMenuSeparator />
+                    <DropdownMenuItem
+                      variant="destructive"
+                      onSelect={() =>
+                        dialog.confirm.open({
+                          title: 'Remove server',
+                          description: 'Remove this server from the network and tear down its configuration.',
+                          variant: 'destructive',
+                          confirmLabel: 'Remove',
+                          method: 'delete',
+                          url: route('networks.servers.destroy', { network: network.id, networkServer: member.id }),
+                        })
+                      }
+                    >
+                      Remove
+                    </DropdownMenuItem>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              </div>
+            );
+          }}
+        />
+      </Container>
+    </NetworkLayout>
+  );
+}
diff --git a/resources/js/pages/networks/settings.tsx b/resources/js/pages/networks/settings.tsx
new file mode 100644
index 000000000..f38a639fa
--- /dev/null
+++ b/resources/js/pages/networks/settings.tsx
@@ -0,0 +1,244 @@
+import { Head, useForm, usePage } from '@inertiajs/react';
+import Container from '@/components/container';
+import HeaderContainer from '@/components/header-container';
+import Heading from '@/components/heading';
+import { Button } from '@/components/ui/button';
+import { BookOpenIcon, LoaderCircleIcon, TriangleAlertIcon } from 'lucide-react';
+import { Badge } from '@/components/ui/badge';
+import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
+import { Separator } from '@/components/ui/separator';
+import { Input } from '@/components/ui/input';
+import InputError from '@/components/ui/input-error';
+import React, { useEffect, useState } from 'react';
+import { useRealtimeRecord } from '@/hooks/use-socket-events';
+import NetworkLayout from '@/layouts/network/layout';
+import { useDialog } from '@/hooks/use-dialog';
+import { formatDateString } from '@/lib/utils';
+import { Network } from '@/types/network';
+
+export default function NetworkSettings() {
+  const page = usePage<{ network: Network }>();
+  const network = useRealtimeRecord<Network>(page.props.network, 'network')!;
+  const dialog = useDialog();
+  const isWireGuard = network.type_value === 'wireguard';
+
+  const [editMode, setEditMode] = useState<string | undefined>();
+
+  const form = useForm<{ name: string }>({
+    name: network.name,
+  });
+
+  const { isDirty, setDefaults, setData } = form;
+
+  useEffect(() => {
+    if (isDirty) {
+      return;
+    }
+    setDefaults('name', network.name);
+    setData('name', network.name);
+  }, [network.name, isDirty, setDefaults, setData]);
+
+  const submit = () => {
+    form.put(route('networks.update', { network: network.id }), {
+      preserveScroll: true,
+      onSuccess: () => {
+        setEditMode(undefined);
+        form.setDefaults();
+        form.reset();
+      },
+    });
+  };
+
+  const handleEnterKey = (e: React.KeyboardEvent<HTMLInputElement>) => {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      submit();
+    }
+  };
+
+  return (
+    <NetworkLayout>
+      <Head title={`Settings - ${network.name}`} />
+
+      <Container className="max-w-5xl">
+        <HeaderContainer>
+          <Heading title="Settings" description="Manage this network's settings" />
+          <a href="https://vitodeploy.com/docs/networks/overview" target="_blank" rel="noreferrer">
+            <Button variant="outline">
+              <BookOpenIcon />
+              <span className="hidden lg:block">Docs</span>
+            </Button>
+          </a>
+        </HeaderContainer>
+
+        <Card className="overflow-hidden">
+          <CardHeader className="flex-row items-center justify-between gap-2">
+            <div className="space-y-2">
+              <CardTitle>Network details</CardTitle>
+              <CardDescription>Update network details</CardDescription>
+            </div>
+            <div className="flex items-center gap-2">
+              {form.isDirty && (
+                <Button onClick={submit}>
+                  {form.processing && <LoaderCircleIcon className="animate-spin" />}
+                  Save changes
+                </Button>
+              )}
+              {(editMode || form.isDirty) && (
+                <Button
+                  variant="outline"
+                  onClick={() => {
+                    setEditMode(undefined);
+                    form.reset();
+                  }}
+                >
+                  Cancel
+                </Button>
+              )}
+            </div>
+          </CardHeader>
+          <CardContent className="bg-background">
+            <div className="flex items-center justify-between p-4">
+              <span>ID</span>
+              <span className="text-muted-foreground">{network.id}</span>
+            </div>
+            <Separator />
+            <div className="flex items-center justify-between p-4">
+              <span>Name</span>
+              {editMode === 'name' ? (
+                <div className="flex max-w-48 flex-col items-end gap-1">
+                  <Input
+                    id="name"
+                    className="h-6"
+                    value={form.data.name}
+                    onChange={(e) => form.setData('name', e.target.value)}
+                    onKeyDown={handleEnterKey}
+                    autoFocus
+                  />
+                  <InputError message={form.errors.name} />
+                </div>
+              ) : (
+                <button type="button" className="text-muted-foreground cursor-pointer underline" onClick={() => setEditMode('name')}>
+                  {form.data.name}
+                </button>
+              )}
+            </div>
+            <Separator />
+            <div className="flex items-center justify-between p-4">
+              <span>Type</span>
+              <Badge variant={network.type_color}>{network.type}</Badge>
+            </div>
+            <Separator />
+            <div className="flex items-center justify-between p-4">
+              <span>Status</span>
+              <Badge variant={network.status_color}>{network.status}</Badge>
+            </div>
+            <Separator />
+            <div className="flex items-center justify-between p-4">
+              <span>CIDR</span>
+              <span className="text-muted-foreground">{network.cidr ?? '-'}</span>
+            </div>
+            {isWireGuard && (
+              <>
+                <Separator />
+                <div className="flex items-center justify-between p-4">
+                  <span>Address pool</span>
+                  <span className="text-muted-foreground">{network.addressing_pool}</span>
+                </div>
+                <Separator />
+                <div className="flex items-center justify-between p-4">
+                  <span>Listen port</span>
+                  <span className="text-muted-foreground">{network.port ?? '-'}</span>
+                </div>
+              </>
+            )}
+            <Separator />
+            <div className="flex items-center justify-between p-4">
+              <span>Created at</span>
+              <span className="text-muted-foreground">{formatDateString(network.created_at)}</span>
+            </div>
+          </CardContent>
+        </Card>
+
+        {network.is_managed && !network.is_orphaned && !network.is_stranded && (
+          <Card className="overflow-hidden">
+            <CardHeader>
+              <CardTitle>Provider managed</CardTitle>
+              <CardDescription>
+                This network mirrors a private network at your cloud provider. Its members are synced automatically, and it is removed from Vito when
+                the network no longer exists at the provider.
+              </CardDescription>
+            </CardHeader>
+            <CardContent className="bg-background p-0">
+              <div className="flex items-center justify-between p-4">
+                <span>Provider</span>
+                <span className="text-muted-foreground">{network.provider ?? '-'}</span>
+              </div>
+              <Separator />
+              <div className="flex items-center justify-between p-4">
+                <span>Region</span>
+                <span className="text-muted-foreground">{network.region ?? '-'}</span>
+              </div>
+              <Separator />
+              <div className="flex items-center justify-between p-4">
+                <span>Last synced</span>
+                <span className="text-muted-foreground">{network.last_synced_at ? formatDateString(network.last_synced_at) : 'Never'}</span>
+              </div>
+            </CardContent>
+          </Card>
+        )}
+
+        {network.is_orphaned && (
+          <Alert>
+            <TriangleAlertIcon className="size-4" />
+            <AlertTitle>Provider connection removed</AlertTitle>
+            <AlertDescription>
+              The cloud provider connection this network came from no longer exists, so it can no longer be synced or removed automatically. Deleting
+              it here is the only way to clear it.
+            </AlertDescription>
+          </Alert>
+        )}
+
+        {network.is_stranded && (
+          <Alert>
+            <TriangleAlertIcon className="size-4" />
+            <AlertTitle>Cannot be synced</AlertTitle>
+            <AlertDescription>
+              None of this network's servers still carries the identifier its cloud provider knows them by, so Vito can no longer sync it or remove it
+              automatically. Deleting it here is the only way to clear it.
+            </AlertDescription>
+          </Alert>
+        )}
+
+        {(!network.is_managed || network.is_orphaned || network.is_stranded) && (
+          <Card className="border-destructive/30 overflow-hidden">
+            <CardHeader>
+              <CardTitle>Delete network</CardTitle>
+              <CardDescription>Tear this network down on all of its servers and remove it. This action cannot be undone.</CardDescription>
+            </CardHeader>
+            <CardContent className="bg-background">
+              <div className="p-4">
+                <Button
+                  variant="destructive"
+                  onClick={() =>
+                    dialog.confirm.open({
+                      title: `Delete network [${network.name}]`,
+                      description: `Are you sure you want to delete ${network.name}? This tears the network down on all of its servers.`,
+                      variant: 'destructive',
+                      confirmLabel: 'Delete',
+                      method: 'delete',
+                      url: route('networks.destroy', { network: network.id }),
+                    })
+                  }
+                >
+                  Delete network
+                </Button>
+              </div>
+            </CardContent>
+          </Card>
+        )}
+      </Container>
+    </NetworkLayout>
+  );
+}
diff --git a/resources/js/pages/networks/show.tsx b/resources/js/pages/networks/show.tsx
new file mode 100644
index 000000000..a014de20e
--- /dev/null
+++ b/resources/js/pages/networks/show.tsx
@@ -0,0 +1,90 @@
+import { Head, usePage } from '@inertiajs/react';
+import Container from '@/components/container';
+import HeaderContainer from '@/components/header-container';
+import Heading from '@/components/heading';
+import { Badge } from '@/components/ui/badge';
+import { Button } from '@/components/ui/button';
+import { BookOpenIcon } from 'lucide-react';
+import { Card, CardContent } from '@/components/ui/card';
+import { ReactNode } from 'react';
+import NetworkLayout from '@/layouts/network/layout';
+import { useRealtime, useRealtimeRecord } from '@/hooks/use-socket-events';
+import { DataTable } from '@/components/data-table';
+import { networkLogColumns } from '@/pages/networks/components/log-columns';
+import { PaginatedData } from '@/types';
+import { ServerLog } from '@/types/server-log';
+import { Network, NetworkStats } from '@/types/network';
+
+function StatTile({ label, children }: { label: string; children: ReactNode }) {
+  return (
+    <Card>
+      <CardContent className="flex flex-col gap-1 p-4">
+        <span className="text-muted-foreground text-xs">{label}</span>
+        <span className="text-2xl font-semibold">{children}</span>
+      </CardContent>
+    </Card>
+  );
+}
+
+function MetaChip({ label, children }: { label: string; children: ReactNode }) {
+  return (
+    <span className="bg-muted/50 inline-flex items-center gap-1.5 rounded-md border px-2.5 py-1 text-xs">
+      <span className="text-muted-foreground">{label}</span>
+      <span className="font-medium">{children}</span>
+    </span>
+  );
+}
+
+export default function NetworkOverview() {
+  const page = usePage<{ network: Network; stats: NetworkStats; logs: PaginatedData<ServerLog> }>();
+  const network = useRealtimeRecord<Network>(page.props.network, 'network')!;
+  const { stats } = page.props;
+  const [logs] = useRealtime<ServerLog>(page.props.logs, 'server-log', { network_id: network.id });
+  const isWireGuard = network.type_value === 'wireguard';
+
+  return (
+    <NetworkLayout>
+      <Head title={`Overview - ${network.name}`} />
+
+      <Container className="max-w-5xl">
+        <HeaderContainer>
+          <div className="space-y-3">
+            <Heading title="Overview" description={network.name} />
+            <div className="flex flex-wrap items-center gap-2">
+              <Badge variant={network.type_color}>{network.type}</Badge>
+              <Badge variant={network.status_color}>{network.status}</Badge>
+              {network.cidr && (
+                <MetaChip label="CIDR">
+                  <span className="font-mono">{network.cidr}</span>
+                </MetaChip>
+              )}
+              {isWireGuard && <MetaChip label="Pool">{network.addressing_pool}</MetaChip>}
+              {isWireGuard && network.port && (
+                <MetaChip label="Port">
+                  <span className="font-mono">{network.port}</span>
+                </MetaChip>
+              )}
+            </div>
+          </div>
+          <a href="https://vitodeploy.com/docs/networks/overview" target="_blank" rel="noreferrer">
+            <Button variant="outline">
+              <BookOpenIcon />
+              <span className="hidden lg:block">Docs</span>
+            </Button>
+          </a>
+        </HeaderContainer>
+
+        <div className="grid grid-cols-2 gap-4 lg:grid-cols-3">
+          <StatTile label="Servers">{stats.servers}</StatTile>
+          <StatTile label="Peers">{isWireGuard ? stats.peers : 'N/A'}</StatTile>
+          <StatTile label="Firewall rules">{stats.firewall_rules}</StatTile>
+        </div>
+
+        <div className="space-y-4">
+          <Heading title="Recent activity" description="Logs from this network's servers" />
+          <DataTable columns={networkLogColumns} paginatedData={logs} searchable sortable />
+        </div>
+      </Container>
+    </NetworkLayout>
+  );
+}
diff --git a/resources/js/pages/redirects/components/edit-redirect.tsx b/resources/js/pages/redirects/components/edit-redirect.tsx
index 26137e82e..31633b0ac 100644
--- a/resources/js/pages/redirects/components/edit-redirect.tsx
+++ b/resources/js/pages/redirects/components/edit-redirect.tsx
@@ -7,15 +7,7 @@ import { Dialog, DialogClose, DialogContent, DialogDescription, DialogFooter, Di
 import { Redirect } from '@/types/redirect';
 import RedirectFormFields, { RedirectForm } from './redirect-form-fields';
 
-export default function EditRedirect({
-  open,
-  onOpenChange,
-  redirect,
-}: {
-  open: boolean;
-  onOpenChange: (open: boolean) => void;
-  redirect: Redirect;
-}) {
+export default function EditRedirect({ open, onOpenChange, redirect }: { open: boolean; onOpenChange: (open: boolean) => void; redirect: Redirect }) {
   const form = useForm<RedirectForm>({
     mode: String(redirect.mode),
     from: redirect.from,
diff --git a/resources/js/pages/redirects/components/redirect-form-fields.tsx b/resources/js/pages/redirects/components/redirect-form-fields.tsx
index 5542f81ee..3d0e25358 100644
--- a/resources/js/pages/redirects/components/redirect-form-fields.tsx
+++ b/resources/js/pages/redirects/components/redirect-form-fields.tsx
@@ -67,12 +67,7 @@ export default function RedirectFormFields({ form }: { form: InertiaFormProps<Re
       {form.data.mode === '1000' && (
         <FormField>
           <div className="flex items-center gap-3">
-            <Checkbox
-              id="websocket"
-              name="websocket"
-              checked={form.data.websocket}
-              onClick={() => form.setData('websocket', !form.data.websocket)}
-            />
+            <Checkbox id="websocket" name="websocket" checked={form.data.websocket} onClick={() => form.setData('websocket', !form.data.websocket)} />
             <Label htmlFor="websocket">WebSocket support</Label>
           </div>
           <InputError message={form.errors.websocket} />
diff --git a/resources/js/pages/server-network/index.tsx b/resources/js/pages/server-network/index.tsx
index d4708a8f3..06cdc53ad 100644
--- a/resources/js/pages/server-network/index.tsx
+++ b/resources/js/pages/server-network/index.tsx
@@ -56,7 +56,7 @@ export default function ServerNetwork() {
         <HeaderContainer>
           <Heading title="Network" description="Here you can manage the IP addresses configured on the server" />
           <div className="flex items-center gap-2">
-            <a href="https://vitodeploy.com/docs/servers/networking" target="_blank">
+            <a href="https://vitodeploy.com/docs/servers/network" target="_blank">
               <Button variant="outline">
                 <BookOpenIcon />
                 <span className="hidden lg:block">Docs</span>
diff --git a/resources/js/pages/services/components/install.tsx b/resources/js/pages/services/components/install.tsx
index 1b66667cd..eb77e6dd3 100644
--- a/resources/js/pages/services/components/install.tsx
+++ b/resources/js/pages/services/components/install.tsx
@@ -74,20 +74,22 @@ export default function InstallService({ name, children }: { name?: string; chil
                       <CommandInput placeholder="Search service..." />
                       <CommandList>
                         <CommandGroup>
-                          {Object.entries(configs.service.services).map(([key, service]) => (
-                            <CommandItem
-                              key={`service-${key}`}
-                              value={service.label}
-                              onSelect={() => {
-                                form.setData('name', key);
-                                form.setData('version', '');
-                                setNameOpen(false);
-                              }}
-                            >
-                              {service.label}
-                              <CheckIcon className={cn('ml-auto', form.data.name === key ? 'opacity-100' : 'opacity-0')} />
-                            </CommandItem>
-                          ))}
+                          {Object.entries(configs.service.services)
+                            .filter(([, service]) => service.type !== 'vpn')
+                            .map(([key, service]) => (
+                              <CommandItem
+                                key={`service-${key}`}
+                                value={service.label}
+                                onSelect={() => {
+                                  form.setData('name', key);
+                                  form.setData('version', '');
+                                  setNameOpen(false);
+                                }}
+                              >
+                                {service.label}
+                                <CheckIcon className={cn('ml-auto', form.data.name === key ? 'opacity-100' : 'opacity-0')} />
+                              </CommandItem>
+                            ))}
                         </CommandGroup>
                       </CommandList>
                     </Command>
diff --git a/resources/js/pages/site-tooling/index.tsx b/resources/js/pages/site-tooling/index.tsx
index 2b58f2d72..9c507edd8 100644
--- a/resources/js/pages/site-tooling/index.tsx
+++ b/resources/js/pages/site-tooling/index.tsx
@@ -63,7 +63,7 @@ export default function SiteTooling() {
       <Container className="max-w-5xl">
         <HeaderContainer>
           <Heading title="Tooling" description={`Manage developer tooling installed for isolated user ${isolated_user}.`} />
-          <a href="https://vitodeploy.com/docs/sites/tooling" target="_blank">
+          <a href="https://vitodeploy.com/docs/sites/site-tooling" target="_blank">
             <Button variant="outline">
               <BookOpenIcon />
               <span className="hidden lg:block">Docs</span>
diff --git a/resources/js/types/network.d.ts b/resources/js/types/network.d.ts
new file mode 100644
index 000000000..a9000b9ef
--- /dev/null
+++ b/resources/js/types/network.d.ts
@@ -0,0 +1,86 @@
+export type StatusColor = 'gray' | 'success' | 'info' | 'warning' | 'danger';
+
+export interface Network {
+  id: number;
+  project_id: number;
+  name: string;
+  type: string;
+  type_value: string;
+  type_color: StatusColor;
+  addressing_pool: string;
+  cidr: string | null;
+  port: number | null;
+  region: string | null;
+  is_managed: boolean;
+  is_orphaned: boolean;
+  is_stranded: boolean;
+  provider?: string | null;
+  last_synced_at: string | null;
+  status: string;
+  status_color: StatusColor;
+  servers_count?: number;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface NetworkServer {
+  id: number;
+  network_id: number;
+  server_id: number;
+  server_name?: string;
+  ip: string | null;
+  private_ip?: string | null;
+  public_key: string | null;
+  status: string;
+  status_color: StatusColor;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface NetworkStats {
+  servers: number;
+  peers: number;
+  firewall_rules: number;
+}
+
+export interface NetworkPeer {
+  id: number;
+  network_id: number;
+  name: string;
+  ip: string;
+  public_key: string;
+  status: string;
+  status_color: StatusColor;
+  last_handshake_at?: string | null;
+  byo: boolean;
+  has_private_key: boolean;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface NetworkFirewallRule {
+  id: number;
+  network_id: number;
+  name: string;
+  protocol: string | null;
+  port: string | null;
+  status: string;
+  status_color: StatusColor;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface NetworkServerOption {
+  id: number;
+  name: string;
+  is_ready: boolean;
+  private_ips: { id: number; ip: string; is_primary: boolean }[];
+}
+
+export interface NetworkMemberIp {
+  id: number;
+  server_id: number;
+  server_name: string;
+  ip_address_id: number | null;
+  private_ips: { id: number; ip: string; is_primary: boolean }[];
+}
diff --git a/resources/js/types/server-log.d.ts b/resources/js/types/server-log.d.ts
index b39ed181b..56828ce11 100644
--- a/resources/js/types/server-log.d.ts
+++ b/resources/js/types/server-log.d.ts
@@ -1,7 +1,9 @@
 export interface ServerLog {
   id: number;
   server_id: number;
+  server_name?: string;
   site_id: number | null;
+  network_id?: number | null;
   type: string;
   name: string;
   disk: string;
diff --git a/resources/views/ssh/services/firewall/ufw/apply-rules.blade.php b/resources/views/ssh/services/firewall/ufw/apply-rules.blade.php
index 397ff042a..d9ebd86fb 100644
--- a/resources/views/ssh/services/firewall/ufw/apply-rules.blade.php
+++ b/resources/views/ssh/services/firewall/ufw/apply-rules.blade.php
@@ -18,12 +18,28 @@
         $source = isset($rule->source) && $rule->source !== null
             ? $rule->source . (isset($rule->mask) && $rule->mask !== null ? '/' . $rule->mask : '')
             : 'any';
+        $protocol = isset($rule->protocol) && $rule->protocol !== null && $rule->protocol !== ''
+            ? ' proto ' . $rule->protocol
+            : '';
+        $port = isset($rule->port) && $rule->port !== null && $rule->port !== ''
+            ? ' port ' . $rule->port
+            : '';
+        $isV6Source = isset($rule->source) && $rule->source !== null && \App\Support\Cidr::isV6($rule->source);
     @endphp
 
-    if ! sudo ufw {{ $rule->type }} from {{ $source }} to any proto {{ $rule->protocol }} port {{ $rule->port }}; then
+@if($isV6Source)
+    if grep -q '^IPV6=yes' /etc/default/ufw 2>/dev/null; then
+        if ! sudo ufw {{ $rule->type }} from {{ $source }} to any{{ $protocol }}{{ $port }}; then
+            @include('ssh.services.firewall.ufw.restore-rules')
+            echo 'VITO_SSH_ERROR' && exit 1
+        fi
+    fi
+@else
+    if ! sudo ufw {{ $rule->type }} from {{ $source }} to any{{ $protocol }}{{ $port }}; then
         @include('ssh.services.firewall.ufw.restore-rules')
         echo 'VITO_SSH_ERROR' && exit 1
     fi
+@endif
 @endforeach
 
 if ! sudo ufw --force enable; then
diff --git a/resources/views/ssh/services/firewall/ufw/install-ufw.blade.php b/resources/views/ssh/services/firewall/ufw/install-ufw.blade.php
index 0d5c9bc16..5df01d6fc 100755
--- a/resources/views/ssh/services/firewall/ufw/install-ufw.blade.php
+++ b/resources/views/ssh/services/firewall/ufw/install-ufw.blade.php
@@ -1,3 +1,12 @@
+if [ -f /proc/net/if_inet6 ] && [ -f /etc/default/ufw ] && ! grep -q '^IPV6=yes' /etc/default/ufw; then
+    if ! sudo sed -i '/^IPV6=/d' /etc/default/ufw; then
+        echo 'VITO_SSH_ERROR' && exit 1
+    fi
+    if ! echo 'IPV6=yes' | sudo tee -a /etc/default/ufw > /dev/null; then
+        echo 'VITO_SSH_ERROR' && exit 1
+    fi
+fi
+
 if ! sudo ufw default deny incoming; then
     echo 'VITO_SSH_ERROR' && exit 1
 fi
@@ -6,15 +15,15 @@
     echo 'VITO_SSH_ERROR' && exit 1
 fi
 
-if ! sudo ufw allow from 0.0.0.0/0 to any proto tcp port {{ $sshPort }}; then
+if ! sudo ufw allow proto tcp to any port {{ $sshPort }}; then
     echo 'VITO_SSH_ERROR' && exit 1
 fi
 
-if ! sudo ufw allow from 0.0.0.0/0 to any proto tcp port 80; then
+if ! sudo ufw allow proto tcp to any port 80; then
     echo 'VITO_SSH_ERROR' && exit 1
 fi
 
-if ! sudo ufw allow from 0.0.0.0/0 to any proto tcp port 443; then
+if ! sudo ufw allow proto tcp to any port 443; then
     echo 'VITO_SSH_ERROR' && exit 1
 fi
 
diff --git a/resources/views/ssh/services/wireguard/conf.blade.php b/resources/views/ssh/services/wireguard/conf.blade.php
new file mode 100644
index 000000000..535b3df37
--- /dev/null
+++ b/resources/views/ssh/services/wireguard/conf.blade.php
@@ -0,0 +1,14 @@
+[Interface]
+Address = {{ $address }}/{{ $prefix }}
+ListenPort = {{ $listenPort }}
+PrivateKey = {{ $privateKey }}
+@foreach ($peers as $peer)
+
+[Peer]
+PublicKey = {{ $peer['public_key'] }}
+AllowedIPs = {{ $peer['allowed_ips'] }}
+@if (! empty($peer['endpoint']))
+Endpoint = {{ $peer['endpoint'] }}
+PersistentKeepalive = 25
+@endif
+@endforeach
diff --git a/resources/views/ssh/services/wireguard/configure.blade.php b/resources/views/ssh/services/wireguard/configure.blade.php
new file mode 100644
index 000000000..f243aeb77
--- /dev/null
+++ b/resources/views/ssh/services/wireguard/configure.blade.php
@@ -0,0 +1,27 @@
+sudo mkdir -p /etc/wireguard
+sudo chmod 700 /etc/wireguard
+
+sudo install -m 600 -o root -g root /etc/wireguard/wg-vito-{{ $networkId }}.conf.tmp /etc/wireguard/wg-vito-{{ $networkId }}.conf
+sudo rm -f /etc/wireguard/wg-vito-{{ $networkId }}.conf.tmp
+
+sudo systemctl enable wg-quick@wg-vito-{{ $networkId }}
+sudo systemctl restart wg-quick@wg-vito-{{ $networkId }}
+
+if ! sudo wg show wg-vito-{{ $networkId }} >/dev/null 2>&1; then
+    echo "VITO_SSH_ERROR: wireguard interface wg-vito-{{ $networkId }} failed to start"
+    exit 1
+fi
+
+@php $keep = implode(' ', array_map('intval', $keepNetworkIds)); @endphp
+for conf in /etc/wireguard/wg-vito-*.conf; do
+    [ -e "$conf" ] || continue
+    id=$(basename "$conf" .conf)
+    id=${id#wg-vito-}
+    case " {{ $keep }} " in
+        *" $id "*) continue ;;
+    esac
+    sudo systemctl stop wg-quick@wg-vito-"$id" 2>/dev/null || true
+    sudo systemctl disable wg-quick@wg-vito-"$id" 2>/dev/null || true
+    sudo wg-quick down wg-vito-"$id" 2>/dev/null || true
+    sudo rm -f "$conf"
+done
diff --git a/resources/views/ssh/services/wireguard/install.blade.php b/resources/views/ssh/services/wireguard/install.blade.php
new file mode 100644
index 000000000..b28c63de8
--- /dev/null
+++ b/resources/views/ssh/services/wireguard/install.blade.php
@@ -0,0 +1,9 @@
+export DEBIAN_FRONTEND=noninteractive
+
+sudo apt-get update -y
+sudo apt-get install -y wireguard wireguard-tools
+
+if ! command -v wg >/dev/null 2>&1; then
+    echo "VITO_SSH_ERROR: wireguard installation failed"
+    exit 1
+fi
diff --git a/resources/views/ssh/services/wireguard/latest-handshakes.blade.php b/resources/views/ssh/services/wireguard/latest-handshakes.blade.php
new file mode 100644
index 000000000..d365cfb55
--- /dev/null
+++ b/resources/views/ssh/services/wireguard/latest-handshakes.blade.php
@@ -0,0 +1 @@
+sudo wg show wg-vito-{{ $networkId }} latest-handshakes
diff --git a/resources/views/ssh/services/wireguard/remove-network.blade.php b/resources/views/ssh/services/wireguard/remove-network.blade.php
new file mode 100644
index 000000000..0a9368b06
--- /dev/null
+++ b/resources/views/ssh/services/wireguard/remove-network.blade.php
@@ -0,0 +1,4 @@
+sudo systemctl stop wg-quick@wg-vito-{{ $networkId }} 2>/dev/null || true
+sudo systemctl disable wg-quick@wg-vito-{{ $networkId }} 2>/dev/null || true
+sudo wg-quick down wg-vito-{{ $networkId }} 2>/dev/null || true
+sudo rm -f /etc/wireguard/wg-vito-{{ $networkId }}.conf
diff --git a/resources/views/ssh/services/wireguard/uninstall.blade.php b/resources/views/ssh/services/wireguard/uninstall.blade.php
new file mode 100644
index 000000000..630cf8b27
--- /dev/null
+++ b/resources/views/ssh/services/wireguard/uninstall.blade.php
@@ -0,0 +1,4 @@
+export DEBIAN_FRONTEND=noninteractive
+
+sudo apt-get remove -y wireguard wireguard-tools || true
+sudo apt-get autoremove -y || true
diff --git a/resources/views/wireguard/peer-conf.blade.php b/resources/views/wireguard/peer-conf.blade.php
new file mode 100644
index 000000000..29343500c
--- /dev/null
+++ b/resources/views/wireguard/peer-conf.blade.php
@@ -0,0 +1,11 @@
+[Interface]
+Address = {{ $address }}/{{ $prefix }}
+PrivateKey = {{ $privateKey }}
+@foreach ($peers as $peer)
+
+[Peer]
+PublicKey = {{ $peer['public_key'] }}
+AllowedIPs = {{ $peer['allowed_ips'] }}
+Endpoint = {{ $peer['endpoint'] }}
+PersistentKeepalive = 25
+@endforeach
diff --git a/tests/Feature/NetworkFirewallTest.php b/tests/Feature/NetworkFirewallTest.php
new file mode 100644
index 000000000..aa523260e
--- /dev/null
+++ b/tests/Feature/NetworkFirewallTest.php
@@ -0,0 +1,627 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Actions\FirewallRule\ManageRule;
+use App\Actions\Network\CreateNetwork;
+use App\Actions\Network\ManageNetworkFirewallRule;
+use App\Actions\Network\MaterializeServerNetworkRules;
+use App\Actions\Server\EditServer;
+use App\Enums\IpAddressType;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkStatus;
+use App\Enums\NetworkType;
+use App\Enums\ServerNetworkRuleKind;
+use App\Enums\ServerStatus;
+use App\Facades\SSH;
+use App\Jobs\Network\ApplyNetworkFirewallJob;
+use App\Models\Network;
+use App\Models\Server;
+use App\Models\ServerIpAddress;
+use App\Models\ServerNetworkRule;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Validation\ValidationException;
+use Inertia\Testing\AssertableInertia;
+use PHPUnit\Framework\Attributes\DataProvider;
+use Tests\TestCase;
+
+class NetworkFirewallTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * @param  array<int, int>  $servers
+     */
+    private function wireguardNetwork(array $servers): Network
+    {
+        return app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => $servers,
+        ]);
+    }
+
+    public function test_network_is_seeded_with_a_default_allow_all_rule(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        $this->assertDatabaseHas('network_firewall_rules', [
+            'network_id' => $network->id,
+            'name' => 'Allow all',
+            'protocol' => null,
+            'port' => null,
+        ]);
+    }
+
+    public function test_wireguard_handshake_port_is_opened(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $peer = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $this->wireguardNetwork([$this->server->id, $peer->id]);
+
+        SSH::assertExecutedContains('proto udp port 51820');
+    }
+
+    public function test_default_allow_all_rule_emits_catch_all(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $this->wireguardNetwork([$this->server->id]);
+
+        SSH::assertExecutedContains('allow from 100.64.0.0/24 to any');
+    }
+
+    public function test_allow_rule_is_emitted_scoped_to_the_network_cidr(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        app(ManageNetworkFirewallRule::class)->create($network, [
+            'name' => 'mysql',
+            'protocol' => 'tcp',
+            'port' => '3306',
+        ]);
+
+        SSH::assertExecutedContains('allow from 100.64.0.0/24 to any proto tcp port 3306');
+        $this->assertDatabaseHas('network_firewall_rules', [
+            'network_id' => $network->id,
+            'name' => 'mysql',
+            'port' => '3306',
+        ]);
+    }
+
+    public function test_network_rules_are_not_stored_as_server_firewall_rules(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = $this->wireguardNetwork([$this->server->id]);
+        app(ManageNetworkFirewallRule::class)->create($network, [
+            'name' => 'mysql',
+            'protocol' => 'tcp',
+            'port' => '3306',
+        ]);
+
+        $this->assertSame(0, $this->server->firewallRules()->count());
+    }
+
+    public function test_server_firewall_page_exposes_managed_networks(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        $this->actingAs($this->user);
+
+        $this->get(route('firewall', ['server' => $this->server]))
+            ->assertSuccessful()
+            ->assertInertia(fn (AssertableInertia $page) => $page
+                ->component('firewall/index')
+                ->where('networkRules.data.0.network_id', $network->id)
+                ->where('networkRules.data.0.name', 'Allow all'));
+    }
+
+    public function test_leaving_member_network_is_not_listed_as_managed(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = $this->wireguardNetwork([$this->server->id]);
+        $network->servers()->update(['status' => NetworkServerStatus::LEAVING]);
+
+        $this->actingAs($this->user);
+
+        $this->get(route('firewall', ['server' => $this->server]))
+            ->assertSuccessful()
+            ->assertInertia(fn (AssertableInertia $page) => $page
+                ->component('firewall/index')
+                ->count('networkRules.data', 0));
+    }
+
+    public function test_server_level_firewall_change_reapplies_network_rules(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $this->wireguardNetwork([$this->server->id]);
+
+        app(ManageRule::class)->create($this->server, [
+            'name' => 'ssh',
+            'type' => 'allow',
+            'protocol' => 'tcp',
+            'port' => '22',
+        ]);
+
+        SSH::assertExecutedContains('allow from 100.64.0.0/24 to any');
+    }
+
+    public function test_installing_ufw_opens_wireguard_handshake_for_existing_member(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $peer = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $this->wireguardNetwork([$this->server->id, $peer->id]);
+
+        SSH::fake();
+        $this->server->firewall()->handler()->install();
+
+        SSH::assertExecutedContains('from '.$peer->ip.'/32 to any proto udp port 51820');
+    }
+
+    public function test_failed_firewall_apply_marks_member_failed(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = $this->wireguardNetwork([$this->server->id]);
+        $member = $network->servers()->firstOrFail();
+
+        (new ApplyNetworkFirewallJob($member))->failed(new \RuntimeException('boom'));
+
+        $this->assertSame(NetworkServerStatus::FAILED, $member->fresh()->status);
+    }
+
+    public function test_deleting_allow_all_locks_down_but_keeps_tunnel_handshake(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $peer = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $network = $this->wireguardNetwork([$this->server->id, $peer->id]);
+
+        $allowAll = $network->firewallRules()->whereNull('protocol')->whereNull('port')->firstOrFail();
+        app(ManageNetworkFirewallRule::class)->delete($allowAll);
+
+        $rules = ServerNetworkRule::query()->where('server_id', $this->server->id);
+
+        $this->assertFalse((clone $rules)->where('kind', ServerNetworkRuleKind::RULE)->exists());
+        $this->assertTrue((clone $rules)->where('kind', ServerNetworkRuleKind::HANDSHAKE)->exists());
+    }
+
+    public function test_firewall_change_on_offline_server_marks_member_pending(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        $this->server->update(['status' => ServerStatus::DISCONNECTED]);
+
+        app(ManageNetworkFirewallRule::class)->create($network, [
+            'name' => 'mysql',
+            'protocol' => 'tcp',
+            'port' => '3306',
+        ]);
+
+        $this->assertSame(NetworkServerStatus::PENDING, $network->servers()->firstOrFail()->status);
+        $this->assertSame(NetworkStatus::SYNCING, $network->fresh()->status);
+    }
+
+    public function test_custom_network_with_a_cidr_uses_the_range_as_the_rule_source(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $ip = ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => '10.0.0.5',
+            'type' => IpAddressType::PRIVATE,
+        ]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'custom-net',
+            'type' => 'custom',
+            'cidr' => '10.0.0.0/24',
+            'servers' => [$this->server->id],
+            'ip_addresses' => [$this->server->id => $ip->id],
+        ]);
+
+        app(ManageNetworkFirewallRule::class)->create($network, [
+            'name' => 'mysql',
+            'protocol' => 'tcp',
+            'port' => '3306',
+        ]);
+
+        SSH::assertExecutedContains('allow from 10.0.0.0/24 to any proto tcp port 3306');
+        SSH::assertNotExecutedContains(
+            "grep -q '^IPV6=yes'",
+            'An IPv4 rule must be applied unconditionally, not behind the IPv6 guard.'
+        );
+    }
+
+    public function test_custom_network_without_a_cidr_uses_each_member_private_ip(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $ip1 = ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => '10.0.0.5',
+            'type' => IpAddressType::PRIVATE,
+        ]);
+
+        $peer = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+        $ip2 = ServerIpAddress::factory()->create([
+            'server_id' => $peer->id,
+            'ip' => '10.0.0.6',
+            'type' => IpAddressType::PRIVATE,
+        ]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'custom-net',
+            'type' => 'custom',
+            'servers' => [$this->server->id, $peer->id],
+            'ip_addresses' => [$this->server->id => $ip1->id, $peer->id => $ip2->id],
+        ]);
+
+        app(ManageNetworkFirewallRule::class)->create($network, [
+            'name' => 'mysql',
+            'protocol' => 'tcp',
+            'port' => '3306',
+        ]);
+
+        SSH::assertExecutedContains('from 10.0.0.6/32 to any');
+    }
+
+    public function test_custom_network_applies_the_catch_all_rule_on_create(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $ip = ServerIpAddress::factory()->create(['server_id' => $this->server->id, 'ip' => '10.0.0.5', 'type' => IpAddressType::PRIVATE]);
+
+        app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'custom-net',
+            'type' => 'custom',
+            'cidr' => '10.0.0.0/24',
+            'servers' => [$this->server->id],
+            'ip_addresses' => [$this->server->id => $ip->id],
+        ]);
+
+        SSH::assertExecutedContains('allow from 10.0.0.0/24 to any');
+    }
+
+    public function test_provider_network_never_uses_the_vpc_cidr_as_a_rule_source(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $peer = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $network = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'type' => NetworkType::PROVIDER,
+            'status' => NetworkStatus::ACTIVE,
+            'cidr' => '172.31.0.0/16',
+            'cidr_canonical' => '172.31.0.0/16',
+        ]);
+
+        $network->servers()->create([
+            'server_id' => $this->server->id,
+            'ip' => '172.31.0.5',
+            'status' => NetworkServerStatus::ACTIVE,
+        ]);
+        $network->servers()->create([
+            'server_id' => $peer->id,
+            'ip' => '172.31.0.6',
+            'status' => NetworkServerStatus::ACTIVE,
+        ]);
+
+        app(ManageNetworkFirewallRule::class)->create($network, [
+            'name' => 'mysql',
+            'protocol' => 'tcp',
+            'port' => '3306',
+        ]);
+
+        $sources = ServerNetworkRule::query()
+            ->where('server_id', $this->server->id)
+            ->where('network_id', $network->id)
+            ->pluck('source')
+            ->all();
+
+        $this->assertContains('172.31.0.6', $sources);
+        $this->assertNotContains('172.31.0.0', $sources, 'Provider networks must never widen the firewall to the whole VPC CIDR.');
+
+        $this->assertSame(
+            0,
+            ServerNetworkRule::query()
+                ->where('network_id', $network->id)
+                ->where('mask', 16)
+                ->count(),
+            'Provider network rules must be per-member /32s.'
+        );
+    }
+
+    public function test_server_with_zero_networks_has_no_materialized_rules(): void
+    {
+        $this->assertSame(0, ServerNetworkRule::query()->where('server_id', $this->server->id)->count());
+    }
+
+    public function test_network_create_materializes_handshake_and_catch_all_rows(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $peer = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $network = $this->wireguardNetwork([$this->server->id, $peer->id]);
+        $allowAll = $network->firewallRules()->whereNull('protocol')->whereNull('port')->firstOrFail();
+
+        $this->assertDatabaseHas('server_network_rules', [
+            'server_id' => $this->server->id,
+            'network_id' => $network->id,
+            'kind' => ServerNetworkRuleKind::HANDSHAKE->value,
+            'protocol' => 'udp',
+            'port' => (string) $network->port,
+            'source' => $peer->ip,
+            'network_firewall_rule_id' => null,
+        ]);
+
+        $this->assertDatabaseHas('server_network_rules', [
+            'server_id' => $this->server->id,
+            'network_id' => $network->id,
+            'kind' => ServerNetworkRuleKind::RULE->value,
+            'protocol' => null,
+            'port' => null,
+            'source' => '100.64.0.0',
+            'network_firewall_rule_id' => $allowAll->id,
+        ]);
+    }
+
+    /**
+     * @return array<string, array{0: ?string, 1: ?string, 2: string}>
+     */
+    public static function protocolAndPortCombinations(): array
+    {
+        return [
+            'both' => ['tcp', '3306', 'to any proto tcp port 3306'],
+            'port only' => [null, '3306', 'to any port 3306'],
+            'protocol only' => ['udp', null, 'to any proto udp'],
+            'neither' => [null, null, 'to any'],
+        ];
+    }
+
+    /**
+     * Protocol and port are documented as independently optional, so all four combinations
+     * must validate and each must render a command `ufw` actually accepts — an empty `proto`
+     * or a silently dropped protocol are both wrong.
+     */
+    #[DataProvider('protocolAndPortCombinations')]
+    public function test_protocol_and_port_are_independently_optional(?string $protocol, ?string $port, string $expected): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $peer = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $network = $this->wireguardNetwork([$this->server->id, $peer->id]);
+        $network->firewallRules()->delete();
+
+        SSH::fake();
+        app(ManageNetworkFirewallRule::class)->create($network, [
+            'name' => 'combo',
+            'protocol' => $protocol,
+            'port' => $port,
+        ]);
+
+        $this->assertDatabaseHas('network_firewall_rules', [
+            'network_id' => $network->id,
+            'name' => 'combo',
+            'protocol' => $protocol,
+            'port' => $port,
+        ]);
+
+        SSH::assertExecutedContains('allow from 100.64.0.0/24 '.$expected);
+    }
+
+    /**
+     * `ufw` refuses a multi-port rule that names no protocol. Accepting one would apply on every
+     * member and fail there, and because rules are reset and reapplied as a unit that failure
+     * takes the network's other rules — and the server's own — down with it.
+     */
+    public function test_port_range_without_a_protocol_is_rejected(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        try {
+            app(ManageNetworkFirewallRule::class)->create($network, [
+                'name' => 'range',
+                'protocol' => null,
+                'port' => '3000:3010',
+            ]);
+            $this->fail('A port range without a protocol must be rejected.');
+        } catch (ValidationException $e) {
+            $this->assertArrayHasKey('protocol', $e->errors());
+        }
+
+        $this->assertDatabaseMissing('network_firewall_rules', [
+            'network_id' => $network->id,
+            'name' => 'range',
+        ]);
+
+        app(ManageNetworkFirewallRule::class)->create($network, [
+            'name' => 'range',
+            'protocol' => 'tcp',
+            'port' => '3000:3010',
+        ]);
+
+        SSH::assertExecutedContains('to any proto tcp port 3000:3010');
+    }
+
+    /**
+     * Every network type derives rules that name the other members, so deleting a server must
+     * clear its address from the remaining members' rules — a provider address in particular
+     * can be reassigned to an unrelated host later.
+     */
+    public function test_deleting_a_server_clears_its_rules_from_remaining_members_of_a_custom_network(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $peer = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $mine = ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => '10.40.0.2',
+            'type' => IpAddressType::PRIVATE,
+        ]);
+        $theirs = ServerIpAddress::factory()->create([
+            'server_id' => $peer->id,
+            'ip' => '10.40.0.3',
+            'type' => IpAddressType::PRIVATE,
+        ]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'no-cidr-custom',
+            'type' => 'custom',
+            'servers' => [$this->server->id, $peer->id],
+            'ip_addresses' => [$this->server->id => $mine->id, $peer->id => $theirs->id],
+        ]);
+
+        $this->assertDatabaseHas('server_network_rules', [
+            'server_id' => $this->server->id,
+            'network_id' => $network->id,
+            'source' => '10.40.0.3',
+        ]);
+
+        $peer->delete();
+
+        $this->assertDatabaseMissing('server_network_rules', [
+            'server_id' => $this->server->id,
+            'network_id' => $network->id,
+            'source' => '10.40.0.3',
+        ]);
+    }
+
+    /**
+     * @return array<string, array{0: string}>
+     */
+    public static function untrustedServerAddresses(): array
+    {
+        return [
+            'command chaining' => ['10.0.0.9; sudo ufw disable'],
+            'command substitution' => ['10.0.0.9 $(id)'],
+            'backticks' => ['`whoami`'],
+            'newline' => ["10.0.0.9\nsudo ufw disable"],
+            'not an address' => ['not-an-ip'],
+            'cidr not address' => ['10.0.0.0/24'],
+        ];
+    }
+
+    /**
+     * A server's public address becomes an unquoted `ufw` source on every WireGuard sibling,
+     * and Blade escapes HTML rather than shell metacharacters — so it must be rejected at the
+     * edge rather than reaching the template.
+     */
+    #[DataProvider('untrustedServerAddresses')]
+    public function test_server_address_that_is_not_an_ip_is_rejected(string $ip): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $this->expectException(ValidationException::class);
+
+        app(EditServer::class)->edit($this->server, [
+            'name' => $this->server->name,
+            'ip' => $ip,
+            'port' => 22,
+        ]);
+    }
+
+    public function test_untrusted_address_never_reaches_the_firewall_template(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $peer = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $network = $this->wireguardNetwork([$this->server->id, $peer->id]);
+
+        Server::query()->whereKey($peer->id)->update(['ip' => '10.0.0.9; sudo ufw disable']);
+
+        SSH::fake();
+        app(MaterializeServerNetworkRules::class)->forServer($this->server->refresh());
+        $this->server->firewall()?->handler()->applyRules();
+
+        $this->assertDatabaseMissing('server_network_rules', [
+            'network_id' => $network->id,
+            'source' => '10.0.0.9; sudo ufw disable',
+        ]);
+
+        SSH::assertNotExecutedContains(
+            'sudo ufw disable',
+            'A non-address value must never be interpolated into the firewall script.'
+        );
+    }
+}
diff --git a/tests/Feature/NetworkIpv6Test.php b/tests/Feature/NetworkIpv6Test.php
new file mode 100644
index 000000000..f37c624d3
--- /dev/null
+++ b/tests/Feature/NetworkIpv6Test.php
@@ -0,0 +1,324 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Actions\Network\AddServersToNetwork;
+use App\Actions\Network\CreateNetwork;
+use App\Actions\Network\CreateNetworkPeer;
+use App\Actions\Network\GetNetworkPeerConfig;
+use App\Actions\Network\UpdateNetworkServerIp;
+use App\Enums\IpAddressFamily;
+use App\Enums\IpAddressType;
+use App\Enums\ServerStatus;
+use App\Enums\ServiceStatus;
+use App\Facades\SSH;
+use App\Models\Network;
+use App\Models\Server;
+use App\Models\ServerIpAddress;
+use App\Support\Cidr;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Validation\ValidationException;
+use Tests\TestCase;
+
+class NetworkIpv6Test extends TestCase
+{
+    use RefreshDatabase;
+
+    private function readyServer(string $ip): Server
+    {
+        return Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'ip' => $ip,
+            'status' => ServerStatus::READY,
+        ]);
+    }
+
+    private function privateIp(Server $server, string $ip, int $prefix): ServerIpAddress
+    {
+        return ServerIpAddress::factory()->create([
+            'server_id' => $server->id,
+            'ip' => $ip,
+            'prefix_length' => $prefix,
+            'family' => str_contains($ip, ':') ? IpAddressFamily::V6 : IpAddressFamily::V4,
+            'type' => IpAddressType::PRIVATE,
+        ]);
+    }
+
+    public function test_cidr_helpers_handle_both_families(): void
+    {
+        $this->assertSame(32, Cidr::hostPrefix('10.0.0.1'));
+        $this->assertSame(128, Cidr::hostPrefix('fd00::1'));
+        $this->assertSame('fd00::/64', Cidr::canonical('fd00::dead:beef/64'));
+        $this->assertTrue(Cidr::contains('fd00::/64', 'fd00::9'));
+        $this->assertFalse(Cidr::contains('fd00::/64', 'fd00:1::9'));
+        $this->assertSame('fd00::2', Cidr::nextHost('fd00::/64', []));
+        $this->assertSame('fd00::3', Cidr::nextHost('fd00::/64', ['fd00::2']));
+    }
+
+    /**
+     * A family mismatch must never read as containment — an IPv4 pool and an IPv6 range
+     * would otherwise look like they overlap and block allocation.
+     */
+    public function test_cross_family_comparisons_never_match(): void
+    {
+        $this->assertFalse(Cidr::overlaps('10.0.0.0/8', 'fd00::/8'));
+        $this->assertFalse(Cidr::contains('10.0.0.0/8', 'fd00::1'));
+        $this->assertFalse(Cidr::contains('fd00::/8', '10.0.0.1'));
+    }
+
+    public function test_endpoint_brackets_ipv6_only(): void
+    {
+        $this->assertSame('1.2.3.4:51820', Cidr::endpoint('1.2.3.4', 51820));
+        $this->assertSame('[2001:db8::1]:51820', Cidr::endpoint('2001:db8::1', 51820));
+    }
+
+    /**
+     * WireGuard rejects a bare `host:port` for IPv6 — the address has to be bracketed or the
+     * config will not parse on the member or in a downloaded peer config.
+     */
+    public function test_ipv6_server_endpoint_is_bracketed_in_member_and_peer_configs(): void
+    {
+        SSH::fake();
+        $first = $this->readyServer('2001:db8::1');
+        $second = $this->readyServer('2001:db8::2');
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'v6-endpoints',
+            'type' => 'wireguard',
+            'servers' => [$first->id, $second->id],
+        ]);
+
+        $this->assertStringContainsString('Endpoint = [2001:db8::1]:'.$network->port, SSH::getUploadedContent());
+
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+        $config = app(GetNetworkPeerConfig::class)->config($peer)['config'];
+
+        $this->assertMatchesRegularExpression('/^Endpoint = \[2001:db8::1\]:'.$network->port.'$/m', $config);
+        $this->assertStringNotContainsString('Endpoint = 2001:db8::1:', $config);
+    }
+
+    /**
+     * The handshake rule's source is the peer's public address, so an IPv6 endpoint needs a
+     * /128 host prefix rather than the IPv4 /32.
+     */
+    public function test_ipv6_handshake_rule_uses_a_128_prefix(): void
+    {
+        SSH::fake();
+        $this->server->update(['ip' => '2001:db8::1', 'status' => ServerStatus::READY]);
+        $peer = $this->readyServer('2001:db8::2');
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'v6-handshake',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id, $peer->id],
+        ]);
+
+        $this->assertDatabaseHas('server_network_rules', [
+            'network_id' => $network->id,
+            'server_id' => $this->server->id,
+            'source' => '2001:db8::2',
+            'mask' => 128,
+        ]);
+
+        SSH::assertExecutedContains('allow from 2001:db8::2/128 to any proto udp port '.$network->port);
+    }
+
+    /**
+     * ufw refuses a v6 rule when its own IPv6 support is off, and rules are applied as one
+     * reset-and-reapply batch — so an unguarded v6 rule would fail the whole batch on an
+     * IPv4-only member and leave it permanently `failed`. With IPv6 off the kernel table is
+     * unfiltered anyway, so skipping the rule loses nothing.
+     */
+    public function test_ipv6_rules_are_skipped_on_a_member_whose_ufw_has_no_ipv6(): void
+    {
+        SSH::fake();
+        $this->server->update(['ip' => '2001:db8::1', 'status' => ServerStatus::READY]);
+        $peer = $this->readyServer('2001:db8::2');
+
+        app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'v6-guard',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id, $peer->id],
+        ]);
+
+        SSH::assertExecutedContains("grep -q '^IPV6=yes' /etc/default/ufw");
+    }
+
+    public function test_custom_network_accepts_an_ipv6_range_and_members(): void
+    {
+        SSH::fake();
+        $server = $this->readyServer('2001:db8::10');
+        $ip = $this->privateIp($server, 'fd00:1::5', 64);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'v6-custom',
+            'type' => 'custom',
+            'cidr' => 'fd00:1::/64',
+            'servers' => [$server->id],
+            'ip_addresses' => [$server->id => $ip->id],
+        ]);
+
+        $this->assertSame('fd00:1::/64', $network->cidr);
+        $this->assertSame('fd00:1::/64', $network->cidr_canonical);
+    }
+
+    public function test_ipv6_custom_network_rule_uses_the_declared_range(): void
+    {
+        SSH::fake();
+        $this->server->update(['ip' => '2001:db8::21', 'status' => ServerStatus::READY]);
+        $peer = $this->readyServer('2001:db8::22');
+        $firstIp = $this->privateIp($this->server, 'fd00:2::5', 64);
+        $secondIp = $this->privateIp($peer, 'fd00:2::6', 64);
+
+        app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'v6-custom-rules',
+            'type' => 'custom',
+            'cidr' => 'fd00:2::/64',
+            'servers' => [$this->server->id, $peer->id],
+            'ip_addresses' => [$this->server->id => $firstIp->id, $peer->id => $secondIp->id],
+        ]);
+
+        SSH::assertExecutedContains('allow from fd00:2::/64 to any');
+    }
+
+    public function test_ufw_install_enables_ipv6(): void
+    {
+        SSH::fake();
+        $server = $this->readyServer('2001:db8::30');
+
+        $server->services()->where('type', 'firewall')->delete();
+        $service = $server->services()->create([
+            'type' => 'firewall',
+            'name' => 'ufw',
+            'version' => 'latest',
+            'status' => ServiceStatus::INSTALLING,
+        ]);
+
+        $service->handler()->install();
+
+        SSH::assertExecutedContains("sed -i '/^IPV6=/d' /etc/default/ufw");
+        SSH::assertExecutedContains("echo 'IPV6=yes' | sudo tee -a /etc/default/ufw");
+    }
+
+    /**
+     * The install allows SSH before enabling the firewall. Scoping that allow to an IPv4 source
+     * would leave a default-deny v6 table with no way in, locking Vito out of a server it
+     * reaches over IPv6 — and the very next thing install does is open a new connection.
+     */
+    public function test_ufw_install_opens_ssh_for_both_families(): void
+    {
+        SSH::fake();
+        $server = $this->readyServer('2001:db8::31');
+
+        $server->services()->where('type', 'firewall')->delete();
+        $service = $server->services()->create([
+            'type' => 'firewall',
+            'name' => 'ufw',
+            'version' => 'latest',
+            'status' => ServiceStatus::INSTALLING,
+        ]);
+
+        $service->handler()->install();
+
+        SSH::assertExecutedContains('ufw allow proto tcp to any port '.($server->port ?? 22));
+        SSH::assertNotExecutedContains('from 0.0.0.0/0', 'The install must not scope its own allows to IPv4.');
+    }
+
+    public function test_member_address_outside_the_declared_range_is_rejected(): void
+    {
+        SSH::fake();
+        $server = $this->readyServer('2001:db8::40');
+        $ip = $this->privateIp($server, '10.9.9.9', 32);
+
+        $this->expectException(ValidationException::class);
+
+        app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'mismatched',
+            'type' => 'custom',
+            'cidr' => '10.50.0.0/24',
+            'servers' => [$server->id],
+            'ip_addresses' => [$server->id => $ip->id],
+        ]);
+    }
+
+    public function test_member_address_outside_the_range_is_rejected_when_adding_and_updating(): void
+    {
+        SSH::fake();
+        $first = $this->readyServer('2001:db8::41');
+        $firstIp = $this->privateIp($first, '10.50.0.5', 24);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'contained',
+            'type' => 'custom',
+            'cidr' => '10.50.0.0/24',
+            'servers' => [$first->id],
+            'ip_addresses' => [$first->id => $firstIp->id],
+        ]);
+
+        $second = $this->readyServer('2001:db8::42');
+        $outside = $this->privateIp($second, '10.99.0.5', 24);
+
+        try {
+            app(AddServersToNetwork::class)->add($network, [
+                'servers' => [$second->id],
+                'ip_addresses' => [$second->id => $outside->id],
+            ]);
+            $this->fail('An address outside the declared range must be rejected.');
+        } catch (ValidationException) {
+            // expected
+        }
+
+        $member = $network->servers()->where('server_id', $first->id)->firstOrFail();
+        $alsoOutside = $this->privateIp($first, '10.99.0.6', 24);
+
+        $this->expectException(ValidationException::class);
+        app(UpdateNetworkServerIp::class)->update($member, ['server_ip_address_id' => $alsoOutside->id]);
+    }
+
+    /**
+     * A network with no declared range derives per-member host rules instead, so containment
+     * cannot be checked and any private address is allowed.
+     */
+    public function test_network_without_a_range_accepts_any_private_address(): void
+    {
+        SSH::fake();
+        $server = $this->readyServer('2001:db8::50');
+        $ip = $this->privateIp($server, '10.77.0.5', 24);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'no-range',
+            'type' => 'custom',
+            'cidr' => '',
+            'servers' => [$server->id],
+            'ip_addresses' => [$server->id => $ip->id],
+        ]);
+
+        $this->assertNull($network->cidr);
+        $this->assertSame(1, $network->servers()->count());
+    }
+
+    public function test_malformed_cidr_is_rejected_for_both_families(): void
+    {
+        SSH::fake();
+        $server = $this->readyServer('2001:db8::60');
+        $ip = $this->privateIp($server, '10.0.0.5', 24);
+
+        foreach (['10.0.0.0/33', 'fd00::/129', 'not-a-cidr', '10.0.0.0', '10.0.0.0/24; id'] as $cidr) {
+            try {
+                app(CreateNetwork::class)->create($this->server->project, [
+                    'name' => 'bad-'.md5($cidr),
+                    'type' => 'custom',
+                    'cidr' => $cidr,
+                    'servers' => [$server->id],
+                    'ip_addresses' => [$server->id => $ip->id],
+                ]);
+                $this->fail("Expected [$cidr] to be rejected.");
+            } catch (ValidationException) {
+                $this->assertTrue(true);
+            }
+        }
+
+        $this->assertSame(0, Network::query()->where('project_id', $this->server->project_id)->count());
+    }
+}
diff --git a/tests/Feature/NetworkPeerTest.php b/tests/Feature/NetworkPeerTest.php
new file mode 100644
index 000000000..dc947e1a5
--- /dev/null
+++ b/tests/Feature/NetworkPeerTest.php
@@ -0,0 +1,505 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Actions\Network\AddServersToNetwork;
+use App\Actions\Network\ConcealNetworkPeerKey;
+use App\Actions\Network\CreateNetwork;
+use App\Actions\Network\CreateNetworkPeer;
+use App\Actions\Network\DeleteNetworkPeer;
+use App\Actions\Network\GetNetworkPeerConfig;
+use App\Actions\Network\RecomputeNetworkStatus;
+use App\Actions\Network\UpdateNetworkPeer;
+use App\Enums\NetworkPeerStatus;
+use App\Enums\NetworkType;
+use App\Enums\ServerStatus;
+use App\Enums\ServiceStatus;
+use App\Enums\UserRole;
+use App\Facades\SSH;
+use App\Jobs\Network\PollPeerHandshakesJob;
+use App\Models\Network;
+use App\Models\NetworkPeer;
+use App\Models\Server;
+use App\Models\User;
+use App\Services\VPN\WireGuard;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use PHPUnit\Framework\Attributes\DataProvider;
+use Tests\TestCase;
+
+class NetworkPeerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * @param  array<int, int>  $servers
+     */
+    private function wireguardNetwork(array $servers): Network
+    {
+        return app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => $servers,
+        ]);
+    }
+
+    private function readyPeerServer(): Server
+    {
+        return Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+    }
+
+    /**
+     * A network with no members has nothing to configure the peer on, so the peer waits rather
+     * than claiming to be connected. It must clear itself once a server joins — nothing else
+     * activates a pending peer.
+     */
+    public function test_peer_on_a_member_less_network_activates_once_a_server_joins(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'type' => NetworkType::WIREGUARD,
+        ]);
+
+        app(RecomputeNetworkStatus::class)->handle($network);
+
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+        $this->assertSame(NetworkPeerStatus::PENDING, $peer->fresh()?->status);
+
+        app(AddServersToNetwork::class)->add($network, ['servers' => [$this->server->id]]);
+
+        $this->assertSame(NetworkPeerStatus::ACTIVE, $peer->fresh()?->status);
+    }
+
+    public function test_create_peer_allocates_next_free_ip(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        $this->assertDatabaseHas('network_peers', [
+            'id' => $peer->id,
+            'network_id' => $network->id,
+            'ip' => '100.64.0.3',
+            'byo' => false,
+        ]);
+        $this->assertNotNull($peer->private_key);
+    }
+
+    public function test_server_add_skips_peer_ip(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        $other = $this->readyPeerServer();
+        app(AddServersToNetwork::class)->add($network, ['servers' => [$other->id]]);
+
+        $this->assertDatabaseHas('network_servers', [
+            'network_id' => $network->id,
+            'server_id' => $other->id,
+            'ip' => '100.64.0.4',
+        ]);
+    }
+
+    /**
+     * @return array<string, array{0: NetworkType}>
+     */
+    public static function nonWireGuardTypes(): array
+    {
+        return [
+            'custom' => [NetworkType::CUSTOM],
+            'provider' => [NetworkType::PROVIDER],
+        ];
+    }
+
+    #[DataProvider('nonWireGuardTypes')]
+    public function test_peer_routes_404_on_non_wireguard_network(NetworkType $type): void
+    {
+        $network = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'type' => $type,
+        ]);
+
+        $this->actingAs($this->user);
+
+        $this->get(route('networks.peers', $network))->assertNotFound();
+        $this->post(route('networks.peers.store', $network), ['name' => 'laptop'])->assertNotFound();
+    }
+
+    public function test_peer_appears_in_member_config_without_endpoint(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        $conf = SSH::getUploadedContent();
+        $this->assertStringContainsString($peer->public_key, $conf);
+        $this->assertStringNotContainsString('Endpoint', $conf);
+    }
+
+    public function test_devices_handshake_rule_is_materialized_and_removed(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        SSH::assertExecutedContains('allow from any to any proto udp port 51820');
+        $this->assertDatabaseHas('server_network_rules', [
+            'network_id' => $network->id,
+            'name' => 'WireGuard handshake (devices)',
+            'source' => null,
+        ]);
+
+        app(DeleteNetworkPeer::class)->delete($peer);
+
+        $this->assertDatabaseMissing('server_network_rules', [
+            'network_id' => $network->id,
+            'name' => 'WireGuard handshake (devices)',
+        ]);
+    }
+
+    /**
+     * WireGuard requires one directive per line — a reformatted blade template that
+     * collapses these onto a single line produces a config no client can parse.
+     */
+    public function test_peer_config_is_valid_wireguard_ini_format(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        $config = app(GetNetworkPeerConfig::class)->config($peer)['config'];
+
+        $this->assertMatchesRegularExpression('/^\[Interface\]$/m', $config);
+        $this->assertMatchesRegularExpression('/^Address = '.preg_quote((string) $peer->ip, '/').'\/32$/m', $config);
+        $this->assertMatchesRegularExpression('/^PrivateKey = \S+$/m', $config);
+        $this->assertMatchesRegularExpression('/^\[Peer\]$/m', $config);
+        $this->assertMatchesRegularExpression('/^PublicKey = \S+$/m', $config);
+        $this->assertMatchesRegularExpression('/^AllowedIPs = \S+$/m', $config);
+        $this->assertMatchesRegularExpression('/^PersistentKeepalive = 25$/m', $config);
+    }
+
+    /**
+     * The config is not a secret — it must stay available so it can be regenerated.
+     */
+    public function test_private_key_is_revealed_once_but_config_remains_available(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        $this->actingAs($this->user);
+
+        $url = route('networks.peers.config', ['network' => $network->id, 'networkPeer' => $peer->id]);
+
+        $this->getJson($url)
+            ->assertOk()
+            ->assertJsonPath('private_key', fn (?string $key): bool => filled($key))
+            ->assertJsonPath('config', fn (string $config): bool => str_contains($config, '[Interface]')
+                && ! str_contains($config, 'REPLACE_WITH_YOUR_PRIVATE_KEY'));
+
+        $this->post(route('networks.peers.conceal', ['network' => $network->id, 'networkPeer' => $peer->id]))
+            ->assertRedirect();
+
+        $this->assertDatabaseHas('network_peers', ['id' => $peer->id, 'private_key' => null]);
+
+        $this->getJson($url)
+            ->assertOk()
+            ->assertJsonPath('private_key', null)
+            ->assertJsonPath('config', fn (string $config): bool => str_contains($config, 'REPLACE_WITH_YOUR_PRIVATE_KEY'));
+    }
+
+    public function test_config_reflects_servers_added_after_the_key_was_concealed(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        app(ConcealNetworkPeerKey::class)->conceal($peer);
+
+        $newServer = $this->readyPeerServer();
+        app(AddServersToNetwork::class)->add($network, ['servers' => [$newServer->id]]);
+
+        $config = app(GetNetworkPeerConfig::class)->config($peer->fresh());
+
+        $this->assertNull($config['private_key']);
+        $this->assertStringContainsString(
+            (string) $newServer->ip,
+            $config['config'],
+            'A peer must be able to regenerate its config to reach servers added after concealment.'
+        );
+    }
+
+    /**
+     * The first member listed in a peer config carries the whole network range as its
+     * AllowedIPs, so it is the server the device routes the subnet through. That makes the
+     * order load-bearing: it must be stable across regenerations, not left to the database.
+     */
+    public function test_peer_config_routes_the_subnet_through_a_stable_member(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $second = $this->readyPeerServer();
+        $third = $this->readyPeerServer();
+
+        $network = $this->wireguardNetwork([$this->server->id]);
+        app(AddServersToNetwork::class)->add($network, ['servers' => [$second->id, $third->id]]);
+
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        $lowest = $network->servers()->orderBy('id')->firstOrFail();
+
+        for ($i = 0; $i < 3; $i++) {
+            $config = app(GetNetworkPeerConfig::class)->config($peer->refresh())['config'];
+
+            $blocks = array_slice(preg_split('/^\[Peer\]$/m', $config) ?: [], 1);
+            $this->assertCount(3, $blocks);
+
+            $this->assertStringContainsString('AllowedIPs = '.$network->cidr, $blocks[0]);
+            $this->assertStringContainsString('PublicKey = '.$lowest->public_key, $blocks[0]);
+
+            foreach (array_slice($blocks, 1) as $block) {
+                $this->assertStringNotContainsString('AllowedIPs = '.$network->cidr, $block);
+                $this->assertMatchesRegularExpression('/AllowedIPs = \S+\/32/', $block);
+            }
+        }
+    }
+
+    public function test_byo_peer_keeps_config_and_rejects_conceal(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        $key = base64_encode(random_bytes(32));
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop', 'public_key' => $key]);
+
+        $this->assertDatabaseHas('network_peers', ['id' => $peer->id, 'byo' => true, 'private_key' => null, 'public_key' => $key]);
+
+        $this->actingAs($this->user);
+
+        $this->getJson(route('networks.peers.config', ['network' => $network->id, 'networkPeer' => $peer->id]))
+            ->assertOk()
+            ->assertJsonPath('config', fn (string $config): bool => str_contains($config, 'REPLACE_WITH_YOUR_PRIVATE_KEY'));
+
+        $this->post(route('networks.peers.conceal', ['network' => $network->id, 'networkPeer' => $peer->id]))
+            ->assertSessionHasErrors('peer');
+    }
+
+    public function test_byo_public_key_validation(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        $this->actingAs($this->user);
+
+        $this->post(route('networks.peers.store', $network), ['name' => 'bad', 'public_key' => 'not-base64!!'])
+            ->assertSessionHasErrors('public_key');
+
+        $memberKey = $network->servers()->first()->public_key;
+        $this->post(route('networks.peers.store', $network), ['name' => 'collide-member', 'public_key' => $memberKey])
+            ->assertSessionHasErrors('public_key');
+
+        $existing = base64_encode(random_bytes(32));
+        app(CreateNetworkPeer::class)->create($network, ['name' => 'first', 'public_key' => $existing]);
+        $this->post(route('networks.peers.store', $network), ['name' => 'collide-peer', 'public_key' => $existing])
+            ->assertSessionHasErrors('public_key');
+    }
+
+    /**
+     * @return array<string, array{0: string}>
+     */
+    public static function untrustedPublicKeys(): array
+    {
+        $valid = 'QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWY=';
+
+        return [
+            'embedded space' => ['QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZW Y='],
+            'embedded newline' => ["QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZW\nY="],
+            'trailing newline directive' => [$valid."\nAllowedIPs = 0.0.0.0/0"],
+            'embedded tab' => ["QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZW\tY="],
+            'command substitution' => ['$(id)'],
+            'command chaining' => [$valid.'; rm -rf /'],
+            'backticks' => ['`whoami`'],
+            'too short' => ['QUJDREVG'],
+            'wrong padding' => [str_repeat('A', 44)],
+        ];
+    }
+
+    /**
+     * A bring-your-own public key is interpolated straight into the WireGuard config
+     * template, so anything but the exact 44-character wire form must be rejected.
+     */
+    #[DataProvider('untrustedPublicKeys')]
+    public function test_untrusted_byo_public_keys_are_rejected(string $publicKey): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        $this->actingAs($this->user);
+
+        $this->post(route('networks.peers.store', $network), ['name' => 'laptop', 'public_key' => $publicKey])
+            ->assertSessionHasErrors('public_key');
+
+        $this->assertDatabaseMissing('network_peers', ['network_id' => $network->id, 'public_key' => $publicKey]);
+    }
+
+    public function test_regenerate_peer_keys(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+        $original = $peer->public_key;
+
+        $this->actingAs($this->user);
+        $this->post(route('networks.peers.regenerate', ['network' => $network->id, 'networkPeer' => $peer->id]))
+            ->assertRedirect();
+
+        $peer->refresh();
+        $this->assertNotSame($original, $peer->public_key);
+        $this->assertFalse($peer->byo);
+        $this->assertTrue($peer->hasPrivateKey());
+    }
+
+    public function test_disable_removes_peer_from_config_and_enable_restores(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        app(UpdateNetworkPeer::class)->update($peer, ['name' => 'laptop', 'enabled' => false]);
+        $this->assertSame(NetworkPeerStatus::DISABLED, $peer->refresh()->status);
+        $this->assertStringNotContainsString($peer->public_key, SSH::getUploadedContent());
+
+        app(UpdateNetworkPeer::class)->update($peer, ['name' => 'laptop', 'enabled' => true]);
+        $this->assertStringContainsString($peer->public_key, SSH::getUploadedContent());
+    }
+
+    /**
+     * The lowest-id member is polled first, but a member whose WireGuard service is not yet
+     * READY must not stop the poll — a later member with a ready service still serves it.
+     */
+    public function test_poll_peer_handshakes_falls_back_to_a_later_eligible_member(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $second = $this->readyPeerServer();
+
+        $network = $this->wireguardNetwork([$this->server->id]);
+        app(AddServersToNetwork::class)->add($network, ['servers' => [$second->id]]);
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        $first = $network->servers()->where('server_id', $this->server->id)->firstOrFail();
+        $first->server->service(WireGuard::type())->update(['status' => ServiceStatus::INSTALLING]);
+
+        SSH::fake("{$peer->public_key}\t1700000000");
+        (new PollPeerHandshakesJob($network->refresh()))->handle();
+
+        $this->assertNotNull($peer->refresh()->last_handshake_at);
+    }
+
+    public function test_poll_peer_handshakes_updates_last_handshake(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        SSH::fake("{$peer->public_key}\t1700000000");
+        (new PollPeerHandshakesJob($network->refresh()))->handle();
+        $this->assertNotNull($peer->refresh()->last_handshake_at);
+
+        $peer->update(['last_handshake_at' => null]);
+        SSH::fake("{$peer->public_key}\t0");
+        (new PollPeerHandshakesJob($network->refresh()))->handle();
+        $this->assertNull($peer->refresh()->last_handshake_at);
+    }
+
+    public function test_duplicate_name_is_rejected(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+        app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        $this->actingAs($this->user);
+        $this->post(route('networks.peers.store', $network), ['name' => 'laptop'])
+            ->assertSessionHasErrors('name');
+    }
+
+    public function test_config_endpoint_is_write_gated(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        $viewer = User::factory()->create();
+        $this->server->project->users()->create(['user_id' => $viewer->id, 'role' => UserRole::USER]);
+        $viewer->current_project_id = $this->server->project_id;
+        $viewer->save();
+
+        $this->actingAs($viewer);
+
+        $this->get(route('networks.peers', $network))->assertOk();
+        $this->getJson(route('networks.peers.config', ['network' => $network->id, 'networkPeer' => $peer->id]))
+            ->assertForbidden();
+        $this->post(route('networks.peers.store', $network), ['name' => 'nope'])->assertForbidden();
+    }
+
+    public function test_peer_from_another_project_is_not_found(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        $otherUser = User::factory()->create();
+        $otherUser->ensureHasDefaultProject();
+        $otherNetwork = Network::factory()->create([
+            'project_id' => $otherUser->current_project_id,
+            'type' => NetworkType::WIREGUARD,
+        ]);
+        $foreignPeer = NetworkPeer::factory()->create(['network_id' => $otherNetwork->id]);
+
+        $this->actingAs($this->user);
+        $this->getJson(route('networks.peers.config', ['network' => $network->id, 'networkPeer' => $foreignPeer->id]))
+            ->assertNotFound();
+    }
+
+    public function test_recompute_activates_pending_peers(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $network = $this->wireguardNetwork([$this->server->id]);
+
+        $peer = NetworkPeer::factory()->create([
+            'network_id' => $network->id,
+            'status' => NetworkPeerStatus::PENDING,
+        ]);
+
+        app(RecomputeNetworkStatus::class)->handle($network);
+
+        $this->assertSame(NetworkPeerStatus::ACTIVE, $peer->refresh()->status);
+    }
+}
diff --git a/tests/Feature/NetworkProviderSyncTest.php b/tests/Feature/NetworkProviderSyncTest.php
new file mode 100644
index 000000000..0432362b0
--- /dev/null
+++ b/tests/Feature/NetworkProviderSyncTest.php
@@ -0,0 +1,840 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Actions\Network\RecomputeNetworkStatus;
+use App\Actions\Network\SyncProviderNetworks;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkStatus;
+use App\Enums\NetworkType;
+use App\Enums\ServerStatus;
+use App\Enums\UserRole;
+use App\Events\SocketEvent;
+use App\Exceptions\PrivateNetworkPersistError;
+use App\Exceptions\PrivateNetworkSyncError;
+use App\Facades\SSH;
+use App\Jobs\Network\SyncProviderNetworksJob;
+use App\Models\Network;
+use App\Models\Server;
+use App\Models\ServerNetworkRule;
+use App\Models\ServerProvider;
+use App\Models\User;
+use App\ServerProviders\AWS;
+use App\ServerProviders\Hetzner;
+use GuzzleHttp\Promise\PromiseInterface;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Client\Request;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Queue;
+use RuntimeException;
+use Tests\TestCase;
+
+class NetworkProviderSyncTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private ServerProvider $connection;
+
+    /** @var array<int, array<string, mixed>> */
+    private array $networksPayload = [];
+
+    /** @var array<int, array<string, mixed>> */
+    private array $serversPayload = [];
+
+    private ?int $failStatus = null;
+
+    private bool $malformed = false;
+
+    /**
+     * `Http::fake()` merges stubs rather than replacing them, so a per-call fake would let
+     * the first registration win for every later sync. One closure reading mutable state
+     * is the only way to vary the response across runs within a test.
+     */
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        SSH::fake();
+
+        Http::fake(function (Request $request): PromiseInterface {
+            if ($this->failStatus !== null) {
+                return Http::response(['error' => ['message' => 'nope']], $this->failStatus);
+            }
+
+            if ($this->malformed) {
+                return Http::response(['unexpected' => 'shape']);
+            }
+
+            if (str_contains($request->url(), '/networks')) {
+                return Http::response([
+                    'networks' => $this->networksPayload,
+                    'meta' => ['pagination' => ['next_page' => null]],
+                ]);
+            }
+
+            return Http::response([
+                'servers' => $this->serversPayload,
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]);
+        });
+
+        $this->connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => Hetzner::id(),
+            'profile' => 'hetzner-main',
+            'credentials' => ['token' => 'secret-token'],
+        ]);
+
+        $this->server->update([
+            'status' => ServerStatus::READY,
+            'provider_id' => $this->connection->id,
+            'provider_data' => ['hetzner_id' => 101, 'region' => 'nbg1'],
+        ]);
+    }
+
+    private function otherServer(int $hetznerId = 102): Server
+    {
+        return Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+            'provider_id' => $this->connection->id,
+            'provider_data' => ['hetzner_id' => $hetznerId, 'region' => 'nbg1'],
+        ]);
+    }
+
+    /**
+     * @param  array<int, array<string, mixed>>  $networks
+     * @param  array<int, array<string, mixed>>  $servers
+     */
+    private function fakeProvider(array $networks, array $servers): void
+    {
+        $this->networksPayload = $networks;
+        $this->serversPayload = $servers;
+        $this->failStatus = null;
+    }
+
+    private function sync(?Network $only = null): void
+    {
+        app(SyncProviderNetworks::class)->forProject($this->server->project, $only);
+    }
+
+    public function test_creates_network_and_members_from_provider(): void
+    {
+        $peer = $this->otherServer();
+
+        $this->fakeProvider(
+            [[
+                'id' => 4711,
+                'name' => 'prod',
+                'ip_range' => '10.0.0.0/16',
+                'subnets' => [['network_zone' => 'eu-central']],
+                'servers' => [101, 102],
+            ]],
+            [
+                ['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]],
+                ['id' => 102, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.3']]],
+            ],
+        );
+
+        $this->sync();
+
+        $this->assertDatabaseHas('networks', [
+            'project_id' => $this->server->project_id,
+            'server_provider_id' => $this->connection->id,
+            'external_id' => '4711',
+            'name' => 'prod',
+            'type' => NetworkType::PROVIDER->value,
+            'cidr' => '10.0.0.0/16',
+            'region' => 'eu-central',
+        ]);
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+
+        $this->assertDatabaseHas('network_servers', [
+            'network_id' => $network->id,
+            'server_id' => $this->server->id,
+            'ip' => '10.0.0.2',
+        ]);
+        $this->assertDatabaseHas('network_servers', [
+            'network_id' => $network->id,
+            'server_id' => $peer->id,
+            'ip' => '10.0.0.3',
+        ]);
+    }
+
+    public function test_second_run_creates_no_duplicates(): void
+    {
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+            [['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]]],
+        );
+
+        $this->sync();
+        $this->sync();
+
+        $this->assertSame(1, Network::query()->where('external_id', '4711')->count());
+        $this->assertSame(1, Network::query()->where('type', NetworkType::PROVIDER)->count());
+    }
+
+    public function test_adds_and_removes_members_as_provider_changes(): void
+    {
+        $peer = $this->otherServer();
+
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101, 102]]],
+            [
+                ['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]],
+                ['id' => 102, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.3']]],
+            ],
+        );
+        $this->sync();
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+        $this->assertSame(2, $network->servers()->count());
+
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+            [['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]]],
+        );
+        $this->sync();
+
+        $this->assertSame(
+            0,
+            $network->servers()->where('server_id', $peer->id)->whereNot('status', NetworkServerStatus::LEAVING)->count(),
+            'A detached server must no longer be a live member.'
+        );
+    }
+
+    public function test_reattached_server_revives_a_leaving_member_instead_of_throwing(): void
+    {
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+            [['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]]],
+        );
+        $this->sync();
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+        $member = $network->servers()->firstOrFail();
+        $member->update(['status' => NetworkServerStatus::LEAVING, 'sync_attempts' => 3]);
+
+        $this->sync();
+
+        $member->refresh();
+        $this->assertSame(NetworkServerStatus::ACTIVE, $member->status);
+        $this->assertSame(0, $member->sync_attempts);
+        $this->assertSame(1, $network->servers()->count(), 'Reviving must not insert a second member row.');
+    }
+
+    /**
+     * The peer keeps the network alive so this exercises member removal, not network prune.
+     */
+    public function test_already_leaving_member_is_not_torn_down_again(): void
+    {
+        $peer = $this->otherServer();
+
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101, 102]]],
+            [
+                ['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]],
+                ['id' => 102, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.3']]],
+            ],
+        );
+        $this->sync();
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+        $member = $network->servers()->where('server_id', $this->server->id)->firstOrFail();
+        $member->update(['status' => NetworkServerStatus::LEAVING, 'sync_attempts' => 3]);
+
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [102]]],
+            [['id' => 102, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.3']]]],
+        );
+        $this->sync();
+
+        $member->refresh();
+        $this->assertSame(
+            3,
+            $member->sync_attempts,
+            'Re-driving teardown would reset sync_attempts and defeat forceConverge escalation.'
+        );
+        $this->assertNotNull($peer->id);
+    }
+
+    public function test_resurrects_a_deleting_network_that_reappears(): void
+    {
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+            [['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]]],
+        );
+        $this->sync();
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+        $network->update(['status' => NetworkStatus::DELETING]);
+        $network->servers()->update(['status' => NetworkServerStatus::LEAVING]);
+
+        $this->sync();
+
+        $network->refresh();
+        $this->assertNotSame(NetworkStatus::DELETING, $network->status);
+        $this->assertSame(
+            0,
+            $network->servers()->where('status', NetworkServerStatus::LEAVING)->count(),
+            'Resurrected networks must not keep LEAVING members that never converge.'
+        );
+    }
+
+    public function test_deletes_network_when_vpc_disappears(): void
+    {
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+            [['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]]],
+        );
+        $this->sync();
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+
+        $this->fakeProvider([], []);
+        $this->sync();
+
+        $this->assertNotSame(
+            NetworkStatus::ACTIVE,
+            $network->fresh()?->status,
+            'A removed VPC must start teardown.'
+        );
+    }
+
+    /**
+     * A failed connection must leave its networks untouched rather than pruning them, and the
+     * error must still reach the caller so the sync is not reported as a success.
+     */
+    public function test_provider_failure_never_prunes_and_is_rethrown(): void
+    {
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+            [['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]]],
+        );
+        $this->sync();
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+
+        $this->failStatus = 500;
+
+        $threw = false;
+        try {
+            $this->sync();
+        } catch (PrivateNetworkSyncError) {
+            $threw = true;
+        }
+
+        $this->assertTrue($threw, 'A provider failure must not be reported as a successful sync.');
+
+        $network->refresh();
+        $this->assertSame(NetworkStatus::ACTIVE, $network->status);
+        $this->assertSame(1, $network->servers()->count());
+    }
+
+    /**
+     * Deleting the last server on a connection leaves its provider networks with no members,
+     * so nothing can reconcile them — and the policy refuses a manual delete while the network
+     * is provider-managed. The sweep therefore still has to visit the connection and prune.
+     */
+    public function test_provider_network_is_pruned_after_its_last_managed_server_is_deleted(): void
+    {
+        $other = $this->otherServer();
+
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101, 102]]],
+            [
+                ['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]],
+                ['id' => 102, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.3']]],
+            ],
+        );
+        $this->sync();
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+        $this->assertSame(2, $network->servers()->count());
+
+        $other->delete();
+        $this->server->delete();
+
+        $this->assertSame(0, $network->servers()->count());
+
+        $this->sync();
+
+        $this->assertNull(
+            Network::query()->find($network->id),
+            'A provider network with no managed servers left must be pruned, not stranded.'
+        );
+    }
+
+    /**
+     * A connection can yield no instance ids while its servers still exist — for example when
+     * `provider_data` is missing the id key. An empty result then says nothing about what is
+     * still at the provider, so a network that has members must survive rather than be reaped.
+     */
+    public function test_network_with_live_members_survives_when_no_instance_ids_can_be_queried(): void
+    {
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+            [['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]]],
+        );
+        $this->sync();
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+        $this->assertSame(1, $network->servers()->count());
+
+        $this->server->update(['provider_data' => ['region' => 'nbg1']]);
+
+        $this->sync();
+
+        $this->assertNotNull(
+            Network::query()->find($network->id),
+            'A network with live members must not be pruned when the provider could not be queried.'
+        );
+        $this->assertSame(1, $network->servers()->count());
+    }
+
+    /**
+     * EC2 is queried per region, so a connection whose servers carry no region cannot be asked
+     * at all. Reading that empty result as "the VPCs are gone" would delete every AWS network
+     * on the connection, with its firewall rules, on a single sync.
+     */
+    public function test_aws_networks_survive_when_no_region_is_known(): void
+    {
+        $connection = $this->awsConnection();
+        $server = $this->awsServer($connection, 'i-0abc');
+        $network = $this->awsNetwork($connection, 'vpc-0abc', $server);
+
+        $this->sync();
+
+        $this->assertNotNull(
+            Network::query()->find($network->id),
+            'An AWS network must not be pruned when no region was available to query.'
+        );
+        $this->assertSame(1, $network->servers()->count());
+    }
+
+    /**
+     * Only the regions actually collected are queried, so one server without a region leaves its
+     * VPC unasked-about while the rest of the connection answers normally. Treating that as a
+     * complete answer would delete precisely the network the guard exists to protect.
+     */
+    public function test_aws_networks_survive_when_one_server_has_no_region(): void
+    {
+        $connection = $this->awsConnection();
+        $this->awsServer($connection, 'i-known', 'eu-west-1');
+        $stranded = $this->awsServer($connection, 'i-unknown');
+        $network = $this->awsNetwork($connection, 'vpc-unknown', $stranded);
+
+        $this->sync();
+
+        $this->assertNotNull(
+            Network::query()->find($network->id),
+            'A network in an unqueried region must not be pruned because other servers answered.'
+        );
+        $this->assertSame(1, $network->servers()->count());
+    }
+
+    /**
+     * Sync spares a network it could not ask about, and the policy refuses to delete a network
+     * whose connection still exists. A network no member can be identified at the provider by
+     * falls into both, so it has to be deletable or it is stranded with no way out.
+     */
+    public function test_provider_network_no_member_can_be_identified_by_becomes_deletable(): void
+    {
+        $network = $this->providerNetwork($this->connection->id);
+        $network->servers()->create([
+            'server_id' => $this->server->id,
+            'ip' => '10.0.0.2',
+            'status' => NetworkServerStatus::ACTIVE,
+        ]);
+
+        $this->actingAs($this->user);
+
+        $this->delete(route('networks.destroy', $network))->assertForbidden();
+
+        $this->server->update(['provider_data' => ['region' => 'nbg1']]);
+
+        $this->sync();
+
+        $this->assertNotNull(
+            Network::query()->find($network->id),
+            'Sync cannot ask about this network, so it must not be pruned either.'
+        );
+
+        $this->delete(route('networks.destroy', $network))->assertRedirect();
+        $this->assertNotSame(NetworkStatus::ACTIVE, $network->fresh()?->status);
+    }
+
+    /**
+     * A 200 whose body is not the expected shape says nothing about the account's inventory.
+     * Reading it as "no networks" would make an API change, a proxy, or a captive portal delete
+     * every synced network on the connection.
+     */
+    public function test_malformed_provider_response_fails_the_sweep_instead_of_pruning(): void
+    {
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+            [['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]]],
+        );
+        $this->sync();
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+
+        $this->malformed = true;
+
+        try {
+            $this->sync();
+            $this->fail('A malformed provider response must fail the sweep.');
+        } catch (PrivateNetworkSyncError) {
+            // expected
+        }
+
+        $this->assertNotNull(
+            Network::query()->find($network->id),
+            'A network must not be pruned on the strength of an unreadable response.'
+        );
+    }
+
+    /**
+     * Discovered networks that cannot be written leave the sweep incomplete. Pruning still runs
+     * for the rest, but the job has to report failure rather than a silent partial sync.
+     */
+    public function test_a_network_that_cannot_be_persisted_fails_the_sweep(): void
+    {
+        $peer = $this->otherServer();
+
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101, 102]]],
+            [
+                ['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]],
+                ['id' => 102, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]],
+            ],
+        );
+
+        $this->expectException(PrivateNetworkPersistError::class);
+
+        $this->sync();
+
+        $this->assertNotNull($peer);
+    }
+
+    /**
+     * The client replaces its whole copy of the network from this payload, so a relation the
+     * initial page load included has to be present here too — otherwise Settings blanks the
+     * provider the moment any status change is broadcast.
+     */
+    public function test_status_broadcast_carries_the_provider_relation(): void
+    {
+        Event::fake([SocketEvent::class]);
+
+        $network = $this->providerNetwork($this->connection->id);
+
+        app(RecomputeNetworkStatus::class)->handle($network);
+
+        $payload = null;
+
+        Event::assertDispatched(SocketEvent::class, function (SocketEvent $event) use (&$payload): bool {
+            if ($event->data->type === 'network.updated' && is_array($event->data->data)) {
+                $payload = $event->data->data;
+            }
+
+            return true;
+        });
+
+        $this->assertIsArray($payload);
+        $this->assertSame(Hetzner::id(), $payload['provider'] ?? null);
+    }
+
+    /**
+     * Only the sweep's own exceptions are built credential-free; anything else can carry a token
+     * in its message, and this log is written verbatim.
+     */
+    public function test_failed_job_does_not_log_an_unexpected_exception_message(): void
+    {
+        Log::spy();
+        Notification::fake();
+
+        (new SyncProviderNetworksJob($this->server->project))->failed(new RuntimeException('token=super-secret'));
+
+        Log::shouldHaveReceived('warning')->withArgs(
+            fn (string $message, array $context): bool => $context['exception'] === RuntimeException::class
+                && $context['reason'] === null
+        );
+    }
+
+    private function awsConnection(): ServerProvider
+    {
+        return ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => AWS::id(),
+            'profile' => 'aws-main',
+            'credentials' => ['key' => 'key', 'secret' => 'secret'],
+        ]);
+    }
+
+    private function awsServer(ServerProvider $connection, string $instanceId, ?string $region = null): Server
+    {
+        return Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+            'provider_id' => $connection->id,
+            'provider_data' => $region === null
+                ? ['instance_id' => $instanceId]
+                : ['instance_id' => $instanceId, 'region' => $region],
+        ]);
+    }
+
+    private function awsNetwork(ServerProvider $connection, string $externalId, Server $member): Network
+    {
+        $network = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'type' => NetworkType::PROVIDER,
+            'server_provider_id' => $connection->id,
+            'external_id' => $externalId,
+        ]);
+
+        $network->servers()->create([
+            'server_id' => $member->id,
+            'ip' => '172.31.0.5',
+            'status' => NetworkServerStatus::ACTIVE,
+        ]);
+
+        return $network;
+    }
+
+    public function test_vpc_without_managed_servers_is_not_imported(): void
+    {
+        $this->fakeProvider(
+            [['id' => 9999, 'name' => 'someone-elses', 'ip_range' => '10.9.0.0/16', 'servers' => [777]]],
+            [['id' => 777, 'private_net' => [['network' => 9999, 'ip' => '10.9.0.2']]]],
+        );
+
+        $this->sync();
+
+        $this->assertSame(0, Network::query()->where('type', NetworkType::PROVIDER)->count());
+    }
+
+    public function test_imported_network_firewall_uses_member_ips_not_vpc_cidr(): void
+    {
+        $peer = $this->otherServer();
+
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '172.31.0.0/16', 'servers' => [101, 102]]],
+            [
+                ['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '172.31.0.2']]],
+                ['id' => 102, 'private_net' => [['network' => 4711, 'ip' => '172.31.0.3']]],
+            ],
+        );
+
+        $this->sync();
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+
+        $this->assertSame(
+            0,
+            ServerNetworkRule::query()->where('network_id', $network->id)->where('mask', 16)->count(),
+            'Sync must never widen the firewall to the whole VPC.'
+        );
+
+        $sources = ServerNetworkRule::query()
+            ->where('network_id', $network->id)
+            ->where('server_id', $this->server->id)
+            ->pluck('source')
+            ->all();
+
+        $this->assertContains('172.31.0.3', $sources);
+        $this->assertNotContains('172.31.0.0', $sources);
+        $this->assertNotNull($peer->id);
+    }
+
+    public function test_name_collision_is_uniqued(): void
+    {
+        Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'name' => 'prod',
+            'type' => NetworkType::CUSTOM,
+        ]);
+
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+            [['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]]],
+        );
+
+        $this->sync();
+
+        $this->assertDatabaseHas('networks', ['external_id' => '4711', 'name' => 'prod-2']);
+    }
+
+    public function test_provider_name_change_does_not_rename_the_local_network(): void
+    {
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+            [['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]]],
+        );
+        $this->sync();
+
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'renamed-at-provider', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+            [['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]]],
+        );
+        $this->sync();
+
+        $this->assertDatabaseHas('networks', ['external_id' => '4711', 'name' => 'prod']);
+    }
+
+    public function test_recycled_ip_between_members_does_not_violate_unique_index(): void
+    {
+        $peer = $this->otherServer();
+
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101, 102]]],
+            [
+                ['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]],
+                ['id' => 102, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.3']]],
+            ],
+        );
+        $this->sync();
+
+        $this->fakeProvider(
+            [['id' => 4711, 'name' => 'prod', 'ip_range' => '10.0.0.0/16', 'servers' => [101, 102]]],
+            [
+                ['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.3']]],
+                ['id' => 102, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]],
+            ],
+        );
+        $this->sync();
+
+        $network = Network::query()->where('external_id', '4711')->firstOrFail();
+
+        $this->assertSame('10.0.0.3', $network->servers()->where('server_id', $this->server->id)->value('ip'));
+        $this->assertSame('10.0.0.2', $network->servers()->where('server_id', $peer->id)->value('ip'));
+    }
+
+    private function providerNetwork(?int $connectionId = null): Network
+    {
+        return Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'type' => NetworkType::PROVIDER,
+            'server_provider_id' => $connectionId,
+            'external_id' => '4711',
+        ]);
+    }
+
+    public function test_provider_network_cannot_be_deleted(): void
+    {
+        $network = $this->providerNetwork($this->connection->id);
+
+        $this->actingAs($this->user)
+            ->delete(route('networks.destroy', $network))
+            ->assertForbidden();
+
+        $this->assertDatabaseHas('networks', ['id' => $network->id]);
+    }
+
+    public function test_orphaned_provider_network_can_be_deleted(): void
+    {
+        $network = $this->providerNetwork(null);
+
+        $this->actingAs($this->user)
+            ->delete(route('networks.destroy', $network))
+            ->assertRedirect();
+
+        $this->assertNotSame(NetworkStatus::ACTIVE, $network->fresh()?->status);
+    }
+
+    public function test_manual_member_routes_are_rejected_on_a_provider_network(): void
+    {
+        $network = $this->providerNetwork($this->connection->id);
+        $member = $network->servers()->create([
+            'server_id' => $this->server->id,
+            'ip' => '10.0.0.2',
+            'status' => NetworkServerStatus::ACTIVE,
+        ]);
+
+        $this->actingAs($this->user);
+
+        $this->post(route('networks.servers.store', $network), ['servers' => [$this->server->id]])
+            ->assertNotFound();
+
+        $this->put(route('networks.servers.update', ['network' => $network, 'networkServer' => $member]), [])
+            ->assertNotFound();
+
+        $this->post(route('networks.servers.sync', ['network' => $network, 'networkServer' => $member]))
+            ->assertNotFound();
+
+        $this->delete(route('networks.servers.destroy', ['network' => $network, 'networkServer' => $member]))
+            ->assertNotFound();
+
+        $this->assertDatabaseHas('network_servers', ['id' => $member->id, 'status' => NetworkServerStatus::ACTIVE->value]);
+    }
+
+    public function test_global_sync_route_dispatches_the_job(): void
+    {
+        Queue::fake();
+
+        $this->actingAs($this->user)
+            ->post(route('networks.sync-providers'))
+            ->assertRedirect();
+
+        Queue::assertPushed(SyncProviderNetworksJob::class);
+    }
+
+    public function test_repeated_sync_clicks_are_debounced(): void
+    {
+        Queue::fake();
+
+        $this->actingAs($this->user);
+
+        $this->post(route('networks.sync-providers'))->assertRedirect();
+        $this->post(route('networks.sync-providers'))->assertRedirect();
+
+        Queue::assertPushed(SyncProviderNetworksJob::class, 1);
+    }
+
+    public function test_viewer_cannot_trigger_a_provider_sync(): void
+    {
+        Queue::fake();
+
+        $viewer = User::factory()->create();
+        $this->server->project->users()->create(['user_id' => $viewer->id, 'role' => UserRole::USER]);
+        $viewer->current_project_id = $this->server->project_id;
+        $viewer->save();
+
+        $this->actingAs($viewer)
+            ->post(route('networks.sync-providers'))
+            ->assertForbidden();
+
+        Queue::assertNothingPushed();
+    }
+
+    public function test_sync_ignores_networks_of_another_project(): void
+    {
+        $other = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'type' => NetworkType::PROVIDER,
+            'server_provider_id' => $this->connection->id,
+            'external_id' => '4711',
+        ]);
+
+        $otherUser = User::factory()->create();
+        $otherUser->ensureHasDefaultProject();
+
+        $before = $other->only(['project_id', 'server_provider_id', 'external_id', 'name', 'status', 'cidr', 'last_synced_at']);
+
+        app(SyncProviderNetworks::class)->forProject($otherUser->currentProject, $other);
+
+        $this->assertDatabaseHas('networks', ['id' => $other->id]);
+        $this->assertSame(
+            $before,
+            $other->fresh()?->only(['project_id', 'server_provider_id', 'external_id', 'name', 'status', 'cidr', 'last_synced_at']),
+            'Syncing one project must not write to another project\'s network.'
+        );
+        $this->assertSame(0, $other->servers()->count());
+    }
+}
diff --git a/tests/Feature/NetworkSyncTest.php b/tests/Feature/NetworkSyncTest.php
new file mode 100644
index 000000000..36c52fe34
--- /dev/null
+++ b/tests/Feature/NetworkSyncTest.php
@@ -0,0 +1,735 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Actions\Network\AddServersToNetwork;
+use App\Actions\Network\AllocateNetworkBlock;
+use App\Actions\Network\CreateNetwork;
+use App\Actions\Network\CreateNetworkPeer;
+use App\Actions\Network\DeleteNetwork;
+use App\Actions\Network\RemoveServerFromNetwork;
+use App\Actions\Network\SyncNetwork;
+use App\Actions\ServerIp\ManageServerIp;
+use App\Actions\ServerIp\RefreshServerIps;
+use App\Enums\IpAddressFamily;
+use App\Enums\IpAddressType;
+use App\Enums\NetworkAddressingPool;
+use App\Enums\NetworkPeerStatus;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkStatus;
+use App\Enums\ServerStatus;
+use App\Enums\ServiceStatus;
+use App\Facades\SSH;
+use App\Jobs\Network\SyncNetworkServerJob;
+use App\Models\NetworkServer;
+use App\Models\Server;
+use App\Models\ServerIpAddress;
+use App\Models\User;
+use App\Support\Cidr;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Artisan;
+use Illuminate\Validation\ValidationException;
+use Tests\TestCase;
+
+class NetworkSyncTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_cidr_helpers(): void
+    {
+        $this->assertSame('100.64.0.0/24', Cidr::canonical('100.64.0.5/24'));
+        $this->assertTrue(Cidr::overlaps('10.0.0.0/16', '10.0.5.0/24'));
+        $this->assertFalse(Cidr::overlaps('10.0.0.0/24', '10.1.0.0/24'));
+        $this->assertSame('100.64.0.2', Cidr::nextHost('100.64.0.0/24', []));
+        $this->assertSame('100.64.0.3', Cidr::nextHost('100.64.0.0/24', ['100.64.0.2']));
+    }
+
+    public function test_block_allocator_skips_member_subnet(): void
+    {
+        ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => '100.64.0.10',
+            'prefix_length' => 24,
+            'type' => IpAddressType::PUBLIC,
+        ]);
+
+        $cidr = app(AllocateNetworkBlock::class)->allocate(
+            NetworkAddressingPool::CGNAT,
+            24,
+            collect(),
+            collect([$this->server])
+        );
+
+        $this->assertSame('100.64.1.0/24', $cidr);
+    }
+
+    public function test_create_wireguard_network_allocates_block_and_activates_ready_member(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $this->assertStringStartsWith('100.64.', (string) $network->cidr);
+
+        $member = $network->servers()->firstOrFail();
+        $this->assertSame('100.64.0.2', $member->ip);
+        $this->assertNotNull($member->public_key);
+        $this->assertSame(NetworkServerStatus::ACTIVE, $member->fresh()->status);
+        $this->assertSame(NetworkStatus::ACTIVE, $network->fresh()->status);
+        $this->assertNotNull($this->server->fresh()->service('vpn'));
+        SSH::assertExecutedContains('wg-quick@wg-vito-'.$network->id);
+    }
+
+    public function test_create_wireguard_member_pending_when_server_not_ready_then_reconciler_activates(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::DISCONNECTED]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $member = $network->servers()->firstOrFail();
+        $this->assertSame(NetworkServerStatus::PENDING, $member->status);
+        $this->assertSame(NetworkStatus::SYNCING, $network->fresh()->status);
+
+        $this->server->update(['status' => ServerStatus::READY]);
+        Artisan::call('networks:reconcile');
+
+        $this->assertSame(NetworkServerStatus::ACTIVE, $member->fresh()->status);
+        $this->assertSame(NetworkStatus::ACTIVE, $network->fresh()->status);
+    }
+
+    public function test_custom_network_members_are_active_without_wireguard(): void
+    {
+        SSH::fake();
+
+        $ip = ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => '10.0.0.5',
+            'type' => IpAddressType::PRIVATE,
+        ]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'prov-net',
+            'type' => 'custom',
+            'servers' => [$this->server->id],
+            'ip_addresses' => [$this->server->id => $ip->id],
+        ]);
+
+        $member = $network->servers()->firstOrFail();
+        $this->assertSame(NetworkServerStatus::ACTIVE, $member->status);
+        $this->assertSame($ip->id, $member->server_ip_address_id);
+        $this->assertSame(NetworkStatus::ACTIVE, $network->fresh()->status);
+        $this->assertNull($this->server->fresh()->service('vpn'));
+        SSH::assertNotExecutedContains('wg-quick');
+    }
+
+    public function test_create_rejects_zero_servers(): void
+    {
+        $this->expectException(ValidationException::class);
+
+        app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'empty',
+            'type' => 'wireguard',
+            'servers' => [],
+        ]);
+    }
+
+    public function test_custom_network_rejects_a_public_ip(): void
+    {
+        $ip = ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => '1.2.3.4',
+            'type' => IpAddressType::PUBLIC,
+        ]);
+
+        $this->expectException(ValidationException::class);
+
+        app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'prov-net',
+            'type' => 'custom',
+            'servers' => [$this->server->id],
+            'ip_addresses' => [$this->server->id => $ip->id],
+        ]);
+    }
+
+    public function test_remove_last_wireguard_member_tears_down_and_uninstalls(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+        $member = $network->servers()->firstOrFail();
+
+        app(RemoveServerFromNetwork::class)->remove($member->fresh());
+
+        $this->assertDatabaseMissing('network_servers', ['id' => $member->id]);
+        $this->assertNull($this->server->fresh()->service('vpn'));
+        SSH::assertExecutedContains('wg-quick down wg-vito-'.$network->id);
+        SSH::assertExecutedContains('apt-get remove -y wireguard');
+    }
+
+    public function test_delete_network_removes_members_and_network(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        app(DeleteNetwork::class)->delete($network);
+
+        $this->assertDatabaseMissing('networks', ['id' => $network->id]);
+        $this->assertDatabaseMissing('network_servers', ['network_id' => $network->id]);
+    }
+
+    public function test_teardown_failure_recomputes_network_status(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+        $member = $network->servers()->firstOrFail();
+
+        NetworkServer::query()->whereKey($member->id)->update([
+            'status' => NetworkServerStatus::LEAVING,
+        ]);
+
+        (new SyncNetworkServerJob($member->fresh(), true))->failed(new \Exception('boom'));
+
+        $this->assertDatabaseHas('network_servers', ['id' => $member->id]);
+        $this->assertSame(NetworkStatus::SYNCING, $network->fresh()->status);
+    }
+
+    /**
+     * Cleanup on the server can only run while it is reachable, so a teardown that has burned
+     * its fast attempts keeps retrying on the slow cadence — abandoning it there would leave the
+     * tunnel configured on a server that was merely rebooting.
+     */
+    public function test_reconciler_keeps_retrying_a_leaving_member_past_the_fast_attempts(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+        $member = $network->servers()->firstOrFail();
+
+        NetworkServer::query()->whereKey($member->id)->update([
+            'status' => NetworkServerStatus::LEAVING,
+            'sync_attempts' => 5,
+            'updated_at' => now()->subMinutes(3),
+        ]);
+
+        Artisan::call('networks:reconcile');
+
+        $this->assertDatabaseHas('network_servers', ['id' => $member->id]);
+
+        NetworkServer::query()->whereKey($member->id)->update([
+            'status' => NetworkServerStatus::LEAVING,
+            'updated_at' => now()->subMinutes(61),
+        ]);
+
+        Artisan::call('networks:reconcile');
+
+        $this->assertDatabaseMissing('network_servers', ['id' => $member->id]);
+        $this->assertDatabaseMissing('server_logs', [
+            'network_id' => $network->id,
+            'type' => 'network-leave-incomplete',
+        ]);
+    }
+
+    /**
+     * The retries are bounded so a server that never comes back cannot strand the network in
+     * `deleting` forever. The membership goes; the log records that the server may still hold
+     * the tunnel configuration.
+     */
+    public function test_reconciler_force_converges_a_leaving_member_that_never_converges(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+        $member = $network->servers()->firstOrFail();
+
+        NetworkServer::query()->whereKey($member->id)->update([
+            'status' => NetworkServerStatus::LEAVING,
+            'sync_attempts' => 30,
+            'updated_at' => now()->subMinutes(3),
+        ]);
+
+        Artisan::call('networks:reconcile');
+
+        $this->assertDatabaseMissing('network_servers', ['id' => $member->id]);
+        $this->assertDatabaseHas('server_logs', [
+            'network_id' => $network->id,
+            'type' => 'network-leave-incomplete',
+        ]);
+    }
+
+    public function test_create_wireguard_rejects_when_block_is_full(): void
+    {
+        SSH::fake();
+
+        $servers = [$this->server->id];
+        for ($i = 0; $i < 13; $i++) {
+            $servers[] = Server::factory()->create([
+                'project_id' => $this->server->project_id,
+                'user_id' => $this->user->id,
+                'status' => ServerStatus::DISCONNECTED,
+            ])->id;
+        }
+
+        try {
+            app(CreateNetwork::class)->create($this->server->project, [
+                'name' => 'wg-full',
+                'type' => 'wireguard',
+                'prefix' => 28,
+                'servers' => $servers,
+            ]);
+            $this->fail('Expected a full-block ValidationException.');
+        } catch (ValidationException $e) {
+            $this->assertArrayHasKey('servers', $e->errors());
+        }
+
+        $this->assertDatabaseMissing('networks', ['name' => 'wg-full']);
+    }
+
+    public function test_add_server_to_wireguard_network_assigns_distinct_ip(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $server2 = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        app(AddServersToNetwork::class)->add($network, ['servers' => [$server2->id]]);
+
+        $ips = $network->servers()->pluck('ip');
+        $this->assertSame(2, $ips->count());
+        $this->assertSame($ips->count(), $ips->unique()->count());
+        $this->assertContains('100.64.0.3', $ips->all());
+    }
+
+    public function test_add_server_rejects_cross_project_server(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $otherUser = User::factory()->create();
+        $otherUser->ensureHasDefaultProject();
+        $foreign = Server::factory()->create([
+            'project_id' => $otherUser->current_project_id,
+            'user_id' => $otherUser->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $this->expectException(ValidationException::class);
+
+        app(AddServersToNetwork::class)->add($network, ['servers' => [$foreign->id]]);
+    }
+
+    public function test_sync_reinstalls_wireguard_when_service_not_ready(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $this->server->services()->create([
+            'type' => 'vpn',
+            'name' => 'wireguard',
+            'version' => 'latest',
+            'status' => ServiceStatus::INSTALLATION_FAILED,
+        ]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        SSH::assertExecutedContains('apt-get install -y wireguard');
+        $this->assertSame(ServiceStatus::READY, $this->server->fresh()->service('vpn')->status);
+        $this->assertSame(NetworkServerStatus::ACTIVE, $network->servers()->firstOrFail()->status);
+    }
+
+    public function test_reconciler_retries_failed_member_when_server_ready(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+        $member = $network->servers()->firstOrFail();
+
+        NetworkServer::query()->whereKey($member->id)->update([
+            'status' => NetworkServerStatus::FAILED,
+            'sync_attempts' => 1,
+        ]);
+
+        Artisan::call('networks:reconcile');
+
+        $fresh = $member->fresh();
+        $this->assertSame(NetworkServerStatus::ACTIVE, $fresh->status);
+        $this->assertSame(0, $fresh->sync_attempts);
+    }
+
+    /**
+     * A member that burns through its fast attempts drops to an hourly retry rather than being
+     * abandoned: giving up permanently would keep the network `failed` forever and would never
+     * pick up a later change, with nothing in the UI to say a manual sync is needed.
+     */
+    public function test_reconciler_retries_an_exhausted_member_on_the_slow_cadence(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+        $member = $network->servers()->firstOrFail();
+
+        NetworkServer::query()->whereKey($member->id)->update([
+            'status' => NetworkServerStatus::FAILED,
+            'sync_attempts' => 5,
+            'updated_at' => now()->subMinutes(5),
+        ]);
+
+        Artisan::call('networks:reconcile');
+
+        $this->assertSame(
+            NetworkServerStatus::FAILED,
+            $member->fresh()?->status,
+            'An exhausted member must not be retried again on the fast cadence.'
+        );
+
+        NetworkServer::query()->whereKey($member->id)->update(['updated_at' => now()->subMinutes(61)]);
+
+        Artisan::call('networks:reconcile');
+
+        $this->assertSame(NetworkServerStatus::ACTIVE, $member->fresh()?->status);
+    }
+
+    /**
+     * A custom membership is addressed solely by its IP row, so the membership has to go when
+     * the address does. The refresh used to drop these rows with a query-builder delete, which
+     * fires no model events, leaving the membership behind with a null address.
+     */
+    public function test_refresh_removes_a_custom_membership_when_its_address_disappears(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $address = ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => '10.70.0.5',
+            'prefix_length' => 24,
+            'family' => IpAddressFamily::V4,
+            'type' => IpAddressType::PRIVATE,
+            'is_managed' => false,
+        ]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'custom-net',
+            'type' => 'custom',
+            'cidr' => '10.70.0.0/24',
+            'servers' => [$this->server->id],
+            'ip_addresses' => [$this->server->id => $address->id],
+        ]);
+
+        $this->assertSame(1, $network->servers()->count());
+
+        SSH::fake(json_encode([[
+            'ifname' => 'eth0',
+            'addr_info' => [[
+                'family' => 'inet',
+                'local' => '10.70.0.9',
+                'prefixlen' => 24,
+                'scope' => 'global',
+            ]],
+        ]]));
+
+        app(RefreshServerIps::class)->handle($this->server);
+
+        $this->assertDatabaseMissing('server_ip_addresses', ['id' => $address->id]);
+        $this->assertSame(0, $network->servers()->where('status', '!=', NetworkServerStatus::LEAVING)->count());
+    }
+
+    /**
+     * A network losing its last member has no sibling left whose sync would recompute it, so the
+     * status has to be recomputed from the departure itself — otherwise the network reports
+     * `active` with no servers, and its peers report connected to nothing.
+     */
+    /**
+     * A peer's WireGuard endpoint is the server's public address, so promoting a different one
+     * has to push the change to the other members — the same resync an explicit IP edit does.
+     * Without it they keep dialling the old address.
+     */
+    public function test_promoting_a_public_ip_resyncs_wireguard_members(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $other = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id, $other->id],
+        ]);
+
+        $promoted = ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => '203.0.113.9',
+            'family' => IpAddressFamily::V4,
+            'type' => IpAddressType::PUBLIC,
+        ]);
+
+        SSH::fake();
+
+        app(ManageServerIp::class)->setPrimary($promoted);
+
+        $this->assertSame('203.0.113.9', $this->server->fresh()?->ip);
+        $this->assertStringContainsString(
+            'Endpoint = 203.0.113.9:'.$network->port,
+            SSH::getUploadedContent(),
+            "The other member's tunnel must point at the new address."
+        );
+    }
+
+    public function test_deleting_the_last_member_server_recomputes_the_network(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $peer = app(CreateNetworkPeer::class)->create($network, ['name' => 'laptop']);
+
+        $this->assertSame(NetworkStatus::ACTIVE, $network->fresh()?->status);
+        $this->assertSame(NetworkPeerStatus::ACTIVE, $peer->fresh()?->status);
+
+        $this->server->delete();
+
+        $this->assertSame(0, $network->servers()->count());
+        $this->assertSame(NetworkStatus::CREATING, $network->fresh()?->status);
+        $this->assertSame(NetworkPeerStatus::PENDING, $peer->fresh()?->status);
+    }
+
+    public function test_deleting_server_resyncs_wireguard_siblings(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $server2 = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id, $server2->id],
+        ]);
+        $sibling = $network->servers()->where('server_id', $server2->id)->firstOrFail();
+        $departingKey = (string) $network->servers()->where('server_id', $this->server->id)->firstOrFail()->public_key;
+
+        SSH::fake();
+
+        $this->server->deleteFromProvider = false;
+        $this->server->delete();
+
+        $this->assertDatabaseMissing('network_servers', ['server_id' => $this->server->id]);
+        $this->assertSame(1, $network->servers()->count());
+        $this->assertSame(NetworkServerStatus::ACTIVE, $sibling->fresh()->status);
+
+        SSH::assertExecutedContains('wg-quick@wg-vito-'.$network->id);
+        $this->assertStringNotContainsString(
+            $departingKey,
+            SSH::getUploadedContent(),
+            "The sibling's tunnel must be rewritten without the departed server's key."
+        );
+    }
+
+    public function test_leaving_one_of_two_wireguard_networks_keeps_service_installed(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $networkA = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-a',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+        app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-b',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $memberA = $networkA->servers()->firstOrFail();
+        app(RemoveServerFromNetwork::class)->remove($memberA->fresh());
+
+        $this->assertDatabaseMissing('network_servers', ['id' => $memberA->id]);
+        $this->assertNotNull($this->server->fresh()->service('vpn'));
+    }
+
+    public function test_reconciler_recovers_stale_updating_member(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+        $member = $network->servers()->firstOrFail();
+
+        NetworkServer::query()->whereKey($member->id)->update([
+            'status' => NetworkServerStatus::UPDATING,
+            'updated_at' => now()->subMinutes(91),
+        ]);
+
+        Artisan::call('networks:reconcile');
+
+        $this->assertSame(NetworkServerStatus::ACTIVE, $member->fresh()->status);
+    }
+
+    public function test_allocator_ignores_ipv6_member_address(): void
+    {
+        ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => 'fe80::1',
+            'prefix_length' => 64,
+            'family' => IpAddressFamily::V6,
+            'type' => IpAddressType::PUBLIC,
+        ]);
+
+        $cidr = app(AllocateNetworkBlock::class)->allocate(
+            NetworkAddressingPool::CGNAT,
+            24,
+            collect(),
+            collect([$this->server])
+        );
+
+        $this->assertSame('100.64.0.0/24', $cidr);
+    }
+
+    public function test_two_wireguard_networks_sharing_a_server_get_distinct_ports(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $a = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-a',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+        $b = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-b',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $this->assertSame(51820, $a->port);
+        $this->assertSame(51821, $b->port);
+    }
+
+    public function test_custom_network_accepts_a_second_server(): void
+    {
+        SSH::fake();
+        $ip1 = ServerIpAddress::factory()->create(['server_id' => $this->server->id, 'ip' => '10.0.0.5', 'type' => IpAddressType::PRIVATE]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'prov',
+            'type' => 'custom',
+            'servers' => [$this->server->id],
+            'ip_addresses' => [$this->server->id => $ip1->id],
+        ]);
+
+        $peer = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+        $ip2 = ServerIpAddress::factory()->create(['server_id' => $peer->id, 'ip' => '10.0.0.6', 'type' => IpAddressType::PRIVATE]);
+
+        app(AddServersToNetwork::class)->add($network, ['servers' => [$peer->id], 'ip_addresses' => [$peer->id => $ip2->id]]);
+
+        $this->assertSame(2, $network->servers()->count());
+        $this->assertSame(NetworkServerStatus::ACTIVE, $network->servers()->where('server_id', $peer->id)->firstOrFail()->status);
+    }
+
+    public function test_sync_network_member_regenerates_config(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+        $member = $network->servers()->firstOrFail();
+
+        app(SyncNetwork::class)->member($member->fresh());
+
+        $this->assertSame(NetworkServerStatus::ACTIVE, $member->fresh()->status);
+        SSH::assertExecutedContains('wg-quick@wg-vito-'.$network->id);
+    }
+}
diff --git a/tests/Feature/NetworkTest.php b/tests/Feature/NetworkTest.php
new file mode 100644
index 000000000..1d5112cdd
--- /dev/null
+++ b/tests/Feature/NetworkTest.php
@@ -0,0 +1,799 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Actions\Network\AddServersToNetwork;
+use App\Actions\Network\CreateNetwork;
+use App\Actions\Network\CreateNetworkPeer;
+use App\Actions\Network\GenerateWireGuardKeys;
+use App\Actions\Network\RecomputeNetworkStatus;
+use App\Enums\IpAddressType;
+use App\Enums\NetworkServerStatus;
+use App\Enums\NetworkStatus;
+use App\Enums\NetworkType;
+use App\Enums\ServerStatus;
+use App\Enums\ServiceStatus;
+use App\Enums\UserRole;
+use App\Facades\SSH;
+use App\Http\Resources\NetworkPeerResource;
+use App\Http\Resources\NetworkServerResource;
+use App\Models\Network;
+use App\Models\NetworkFirewallRule;
+use App\Models\NetworkPeer;
+use App\Models\NetworkServer;
+use App\Models\Server;
+use App\Models\ServerIpAddress;
+use App\Models\User;
+use App\Services\VPN\WireGuard;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Validation\ValidationException;
+use Inertia\Testing\AssertableInertia;
+use Tests\TestCase;
+
+class NetworkTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_network_persists_and_casts_enums(): void
+    {
+        $network = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+        ]);
+
+        $this->assertDatabaseHas('networks', [
+            'id' => $network->id,
+            'project_id' => $this->server->project_id,
+            'type' => NetworkType::WIREGUARD->value,
+            'status' => NetworkStatus::ACTIVE->value,
+        ]);
+
+        $network->refresh();
+        $this->assertInstanceOf(NetworkType::class, $network->type);
+        $this->assertInstanceOf(NetworkStatus::class, $network->status);
+        $this->assertTrue($network->port === 51820);
+    }
+
+    public function test_network_relations(): void
+    {
+        $network = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+        ]);
+
+        $member = NetworkServer::factory()->create([
+            'network_id' => $network->id,
+            'server_id' => $this->server->id,
+            'ip' => '100.64.0.2',
+        ]);
+
+        $rule = NetworkFirewallRule::factory()->create([
+            'network_id' => $network->id,
+        ]);
+
+        $this->assertTrue($network->servers->contains($member));
+        $this->assertTrue($network->firewallRules->contains($rule));
+        $this->assertTrue($this->server->project->networks->contains($network));
+        $this->assertTrue($member->network->is($network));
+        $this->assertTrue($member->server->is($this->server));
+    }
+
+    public function test_network_server_private_key_is_encrypted_at_rest(): void
+    {
+        $member = NetworkServer::factory()->create([
+            'network_id' => Network::factory()->create([
+                'project_id' => $this->server->project_id,
+            ])->id,
+            'server_id' => $this->server->id,
+            'ip' => '100.64.0.3',
+            'private_key' => 'super-secret-private-key',
+            'status' => NetworkServerStatus::PENDING,
+        ]);
+
+        $raw = DB::table('network_servers')->where('id', $member->id)->value('private_key');
+        $this->assertNotSame('super-secret-private-key', $raw);
+        $this->assertSame('super-secret-private-key', $member->fresh()->private_key);
+        $this->assertInstanceOf(NetworkServerStatus::class, $member->fresh()->status);
+    }
+
+    public function test_generate_wireguard_keys_produce_valid_curve25519_format(): void
+    {
+        $keys = app(GenerateWireGuardKeys::class)->generate();
+
+        foreach (['private_key', 'public_key'] as $key) {
+            $decoded = base64_decode($keys[$key], true);
+            $this->assertNotFalse($decoded);
+            $this->assertSame(32, strlen((string) $decoded));
+            $this->assertSame(44, strlen($keys[$key]));
+        }
+
+        $private = base64_decode($keys['private_key']);
+        $this->assertSame(0, ord($private[0]) & 7);
+        $this->assertSame(64, ord($private[31]) & 192);
+    }
+
+    public function test_wireguard_service_installs_and_uninstalls_via_ssh(): void
+    {
+        SSH::fake('v1.0.20210914');
+
+        $service = $this->server->services()->create([
+            'type' => WireGuard::type(),
+            'name' => WireGuard::id(),
+            'version' => 'latest',
+            'status' => ServiceStatus::INSTALLING,
+        ]);
+
+        $handler = $service->handler();
+        $handler->install();
+        SSH::assertExecutedContains('apt-get install -y wireguard');
+        $this->assertSame('v1.0.20210914', $handler->version());
+
+        $handler->uninstall();
+        SSH::assertExecutedContains('apt-get remove -y wireguard');
+    }
+
+    public function test_wireguard_cannot_be_installed_via_services_store(): void
+    {
+        SSH::fake();
+
+        $this->actingAs($this->user);
+
+        $this->post(route('services.store', ['server' => $this->server]), [
+            'name' => WireGuard::id(),
+            'version' => 'latest',
+        ])->assertSessionHasErrors('name');
+
+        $this->assertDatabaseMissing('services', [
+            'server_id' => $this->server->id,
+            'name' => WireGuard::id(),
+        ]);
+    }
+
+    public function test_wireguard_configure_network_uploads_conf_and_starts_interface(): void
+    {
+        SSH::fake();
+
+        $network = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'cidr' => '100.64.0.0/24',
+            'cidr_canonical' => '100.64.0.0/24',
+            'port' => 51820,
+        ]);
+
+        $peerServer = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+        ]);
+
+        NetworkServer::factory()->create([
+            'network_id' => $network->id,
+            'server_id' => $peerServer->id,
+            'ip' => '100.64.0.3',
+            'public_key' => 'PEERPUBLICKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=',
+            'status' => NetworkServerStatus::ACTIVE,
+        ]);
+
+        $membership = NetworkServer::factory()->create([
+            'network_id' => $network->id,
+            'server_id' => $this->server->id,
+            'ip' => '100.64.0.2',
+            'private_key' => 'MYPRIVATEKEYBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=',
+            'public_key' => 'MYPUBLICKEYCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC=',
+            'status' => NetworkServerStatus::UPDATING,
+        ]);
+
+        $service = $this->server->services()->create([
+            'type' => WireGuard::type(),
+            'name' => WireGuard::id(),
+            'version' => 'latest',
+            'status' => ServiceStatus::READY,
+        ]);
+
+        /** @var WireGuard $handler */
+        $handler = $service->handler();
+        $handler->configureNetwork($membership);
+
+        SSH::assertFileUploaded("/etc/wireguard/wg-vito-{$network->id}.conf.tmp");
+        SSH::assertExecutedContains('install -m 600 -o root -g root /etc/wireguard/wg-vito-'.$network->id.'.conf.tmp');
+
+        $content = SSH::getUploadedContent();
+        $this->assertStringContainsString('[Interface]', $content);
+        $this->assertStringContainsString('Address = 100.64.0.2/24', $content);
+        $this->assertStringContainsString('ListenPort = 51820', $content);
+        $this->assertStringContainsString('[Peer]', $content);
+        $this->assertStringContainsString('PEERPUBLICKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', $content);
+        $this->assertStringContainsString('AllowedIPs = 100.64.0.3/32', $content);
+        $this->assertStringContainsString('Endpoint = '.$peerServer->ip.':51820', $content);
+
+        SSH::assertExecutedContains("wg-quick@wg-vito-{$network->id}");
+    }
+
+    public function test_store_creates_wireguard_network_and_redirects(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+        $this->actingAs($this->user);
+
+        $response = $this->post(route('networks.store'), [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $response->assertRedirect();
+        $this->assertDatabaseHas('networks', [
+            'name' => 'wg-net',
+            'type' => NetworkType::WIREGUARD->value,
+            'project_id' => $this->server->project_id,
+        ]);
+    }
+
+    public function test_add_server_via_http_rejects_cross_project_server(): void
+    {
+        SSH::fake();
+        $network = Network::factory()->create(['project_id' => $this->server->project_id]);
+
+        $otherUser = User::factory()->create();
+        $otherUser->ensureHasDefaultProject();
+        $foreign = Server::factory()->create([
+            'project_id' => $otherUser->current_project_id,
+            'user_id' => $otherUser->id,
+        ]);
+
+        $this->actingAs($this->user);
+
+        $this->post(route('networks.servers.store', $network), [
+            'servers' => [$foreign->id],
+        ])->assertSessionHasErrors('servers.0');
+
+        $this->assertDatabaseMissing('network_servers', ['server_id' => $foreign->id]);
+    }
+
+    public function test_destroy_network_via_http(): void
+    {
+        SSH::fake();
+        $network = Network::factory()->create(['project_id' => $this->server->project_id]);
+
+        $this->actingAs($this->user);
+
+        $this->delete(route('networks.destroy', $network))->assertRedirect(route('networks'));
+        $this->assertDatabaseMissing('networks', ['id' => $network->id]);
+    }
+
+    public function test_cannot_view_another_projects_network(): void
+    {
+        $otherUser = User::factory()->create();
+        $otherUser->ensureHasDefaultProject();
+        $network = Network::factory()->create(['project_id' => $otherUser->current_project_id]);
+
+        $this->actingAs($this->user);
+
+        $this->get(route('networks.show', $network))->assertForbidden();
+    }
+
+    public function test_network_server_resource_never_exposes_private_key(): void
+    {
+        $network = Network::factory()->create(['project_id' => $this->server->project_id]);
+        $member = NetworkServer::factory()->create([
+            'network_id' => $network->id,
+            'server_id' => $this->server->id,
+            'ip' => '100.64.0.9',
+            'private_key' => 'top-secret',
+        ]);
+
+        $data = (new NetworkServerResource($member->load('server')))->toArray(request());
+
+        $this->assertArrayNotHasKey('private_key', $data);
+        $this->assertArrayHasKey('public_key', $data);
+    }
+
+    public function test_network_peer_is_never_serialised_with_its_private_key(): void
+    {
+        $network = Network::factory()->create(['project_id' => $this->server->project_id]);
+        $peer = NetworkPeer::factory()->create([
+            'network_id' => $network->id,
+            'private_key' => 'top-secret',
+        ]);
+
+        $this->assertArrayNotHasKey('private_key', (new NetworkPeerResource($peer))->toArray(request()));
+        $this->assertArrayNotHasKey('private_key', $peer->toArray());
+        $this->assertSame('top-secret', $peer->private_key);
+    }
+
+    public function test_firewall_rule_update_via_http(): void
+    {
+        SSH::fake();
+        $network = Network::factory()->create(['project_id' => $this->server->project_id]);
+        $rule = NetworkFirewallRule::factory()->create(['network_id' => $network->id, 'port' => '80']);
+
+        $this->actingAs($this->user);
+
+        $this->put(route('networks.firewall.update', ['network' => $network, 'networkFirewallRule' => $rule]), [
+            'name' => 'updated',
+            'protocol' => 'tcp',
+            'port' => '443',
+        ])->assertSessionDoesntHaveErrors();
+
+        $this->assertDatabaseHas('network_firewall_rules', ['id' => $rule->id, 'name' => 'updated', 'port' => '443']);
+    }
+
+    /**
+     * The create dialog posts an empty string when the optional CIDR is left blank.
+     */
+    public function test_empty_cidr_is_stored_as_null_not_canonicalised(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $ip = ServerIpAddress::factory()->create(['server_id' => $this->server->id, 'ip' => '10.0.0.5', 'type' => IpAddressType::PRIVATE]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'no-cidr-net',
+            'type' => 'custom',
+            'cidr' => '',
+            'servers' => [$this->server->id],
+            'ip_addresses' => [$this->server->id => $ip->id],
+        ]);
+
+        $this->assertDatabaseHas('networks', [
+            'id' => $network->id,
+            'cidr' => null,
+            'cidr_canonical' => null,
+        ]);
+    }
+
+    public function test_update_provider_network_server_ip_via_http(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $ip1 = ServerIpAddress::factory()->create(['server_id' => $this->server->id, 'ip' => '10.0.0.5', 'type' => IpAddressType::PRIVATE]);
+        $ip2 = ServerIpAddress::factory()->create(['server_id' => $this->server->id, 'ip' => '10.0.0.6', 'type' => IpAddressType::PRIVATE]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'prov-net',
+            'type' => 'custom',
+            'cidr' => '10.0.0.0/24',
+            'servers' => [$this->server->id],
+            'ip_addresses' => [$this->server->id => $ip1->id],
+        ]);
+        $member = $network->servers()->firstOrFail();
+
+        $this->actingAs($this->user);
+
+        $this->put(route('networks.servers.update', ['network' => $network, 'networkServer' => $member]), [
+            'server_ip_address_id' => $ip2->id,
+        ])->assertSessionDoesntHaveErrors();
+
+        $this->assertDatabaseHas('network_servers', ['id' => $member->id, 'server_ip_address_id' => $ip2->id]);
+    }
+
+    public function test_cannot_update_ip_on_wireguard_network_server(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $ip = ServerIpAddress::factory()->create(['server_id' => $this->server->id, 'ip' => '10.0.0.6', 'type' => IpAddressType::PRIVATE]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+        $member = $network->servers()->firstOrFail();
+
+        $this->actingAs($this->user);
+
+        $this->put(route('networks.servers.update', ['network' => $network, 'networkServer' => $member]), [
+            'server_ip_address_id' => $ip->id,
+        ])->assertNotFound();
+    }
+
+    /**
+     * Two WireGuard interfaces on one host cannot share a listen port. A server joining a second
+     * network on the port it already runs moves that network to the next free one — refusing the
+     * server instead would make "a server can belong to several networks" unreachable on the
+     * default port, with no way to change it.
+     */
+    public function test_adding_a_server_moves_the_network_off_a_port_it_already_uses(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $other = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        $first = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-first',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $second = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-second',
+            'type' => 'wireguard',
+            'servers' => [$other->id],
+        ]);
+
+        $this->assertSame(51820, $first->port);
+        $this->assertSame(51820, $second->port);
+
+        app(AddServersToNetwork::class)->add($second, ['servers' => [$this->server->id]]);
+
+        $this->assertSame(51821, $second->fresh()?->port);
+        $this->assertSame(51820, $first->fresh()?->port);
+        $this->assertSame(2, $second->servers()->count());
+    }
+
+    /**
+     * A peer's endpoint port is fixed when its config is downloaded, so a config already imported
+     * on a laptop keeps pointing at the old port after the network moves. Nothing on the peer
+     * changes and no handshake failure surfaces, so the move has to be called out.
+     */
+    public function test_port_move_warns_that_peers_must_download_their_config_again(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $other = Server::factory()->create([
+            'project_id' => $this->server->project_id,
+            'user_id' => $this->user->id,
+            'status' => ServerStatus::READY,
+        ]);
+
+        app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-first',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $second = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-second',
+            'type' => 'wireguard',
+            'servers' => [$other->id],
+        ]);
+
+        app(CreateNetworkPeer::class)->create($second, ['name' => 'laptop']);
+
+        $this->actingAs($this->user);
+
+        $this->post(route('networks.servers.store', ['network' => $second]), [
+            'servers' => [$this->server->id],
+        ])->assertSessionHas('warning');
+
+        $this->assertSame(51821, $second->fresh()?->port);
+    }
+
+    /**
+     * The declared range is what the firewall rules are scoped to, so a range wider than private
+     * space would emit `allow from 0.0.0.0/0` on every member — opening those ports to the
+     * internet on servers that were default-deny.
+     */
+    public function test_a_range_outside_private_address_space_is_rejected(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $ip = ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => '10.80.0.5',
+            'type' => IpAddressType::PRIVATE,
+        ]);
+
+        foreach (['0.0.0.0/0', '::/0', '8.8.8.0/24', '10.0.0.0/7', '2001:db8::/32'] as $cidr) {
+            try {
+                app(CreateNetwork::class)->create($this->server->project, [
+                    'name' => 'public-'.md5($cidr),
+                    'type' => 'custom',
+                    'cidr' => $cidr,
+                    'servers' => [$this->server->id],
+                    'ip_addresses' => [$this->server->id => $ip->id],
+                ]);
+                $this->fail("Expected [$cidr] to be rejected.");
+            } catch (ValidationException) {
+                // expected
+            }
+        }
+
+        $this->assertSame(0, Network::query()->where('project_id', $this->server->project_id)->count());
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'private-range',
+            'type' => 'custom',
+            'cidr' => '10.80.0.0/24',
+            'servers' => [$this->server->id],
+            'ip_addresses' => [$this->server->id => $ip->id],
+        ]);
+
+        $this->assertSame('10.80.0.0/24', $network->cidr);
+    }
+
+    /**
+     * The per-server IP rules are keyed by server id, so building them from raw input turned a
+     * malformed `servers` entry into a 500 before the validator ever ran.
+     */
+    public function test_malformed_servers_input_is_a_validation_error(): void
+    {
+        $network = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'type' => NetworkType::CUSTOM,
+        ]);
+
+        $this->actingAs($this->user);
+
+        $this->post(route('networks.store'), [
+            'name' => 'bad-input',
+            'type' => 'custom',
+            'servers' => [['nested']],
+            'ip_addresses' => [],
+        ])->assertSessionHasErrors('servers.0');
+
+        $this->post(route('networks.servers.store', ['network' => $network]), [
+            'servers' => [['nested']],
+            'ip_addresses' => [],
+        ])->assertSessionHasErrors('servers.0');
+
+        $this->assertDatabaseMissing('networks', ['name' => 'bad-input']);
+    }
+
+    public function test_sub_resource_404_when_not_belonging_to_network(): void
+    {
+        $network = Network::factory()->create(['project_id' => $this->server->project_id]);
+        $other = Network::factory()->create(['project_id' => $this->server->project_id]);
+        $rule = NetworkFirewallRule::factory()->create(['network_id' => $other->id]);
+
+        $this->actingAs($this->user);
+
+        $this->delete(route('networks.firewall.destroy', ['network' => $network, 'networkFirewallRule' => $rule]))
+            ->assertNotFound();
+    }
+
+    public function test_update_network_rename_via_http(): void
+    {
+        $network = Network::factory()->create(['project_id' => $this->server->project_id, 'name' => 'old-name']);
+
+        $this->actingAs($this->user);
+
+        $this->put(route('networks.update', $network), ['name' => 'new-name'])->assertSessionDoesntHaveErrors();
+
+        $this->assertDatabaseHas('networks', ['id' => $network->id, 'name' => 'new-name']);
+    }
+
+    public function test_viewer_role_cannot_create_network(): void
+    {
+        $viewer = User::factory()->create();
+        $this->server->project->users()->create(['user_id' => $viewer->id, 'role' => UserRole::USER]);
+        $viewer->current_project_id = $this->server->project_id;
+        $viewer->save();
+
+        $this->actingAs($viewer);
+
+        $this->post(route('networks.store'), [
+            'name' => 'denied',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ])->assertForbidden();
+    }
+
+    public function test_member_regenerate_via_http_resyncs_the_member(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'cidr' => '100.64.0.0/24',
+            'cidr_canonical' => '100.64.0.0/24',
+        ]);
+        $member = NetworkServer::factory()->create([
+            'network_id' => $network->id,
+            'server_id' => $this->server->id,
+            'ip' => '100.64.0.5',
+            'status' => NetworkServerStatus::FAILED,
+            'sync_attempts' => 3,
+        ]);
+
+        $this->actingAs($this->user);
+
+        $this->post(route('networks.servers.sync', ['network' => $network, 'networkServer' => $member]))
+            ->assertSessionDoesntHaveErrors();
+
+        $fresh = $member->fresh();
+        $this->assertSame(NetworkServerStatus::ACTIVE, $fresh?->status);
+        $this->assertSame(0, $fresh?->sync_attempts);
+        SSH::assertExecutedContains('wg-quick@wg-vito-'.$network->id);
+    }
+
+    public function test_custom_network_duplicate_cidr_is_rejected(): void
+    {
+        $ip = ServerIpAddress::factory()->create(['server_id' => $this->server->id, 'ip' => '10.0.0.5', 'type' => IpAddressType::PRIVATE]);
+        Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'type' => NetworkType::CUSTOM,
+            'cidr' => '10.0.0.0/24',
+            'cidr_canonical' => '10.0.0.0/24',
+        ]);
+
+        $this->actingAs($this->user);
+
+        $this->post(route('networks.store'), [
+            'name' => 'dup',
+            'type' => 'custom',
+            'cidr' => '10.0.0.5/24',
+            'servers' => [$this->server->id],
+            'ip_addresses' => [$this->server->id => $ip->id],
+        ])->assertSessionHasErrors('cidr');
+    }
+
+    public function test_network_sync_logs_are_associated_to_the_network(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $this->assertDatabaseHas('server_logs', [
+            'server_id' => $this->server->id,
+            'network_id' => $network->id,
+            'type' => 'configure-wireguard-'.$network->id,
+        ]);
+        $this->assertDatabaseHas('server_logs', [
+            'network_id' => $network->id,
+            'type' => 'apply-rules',
+        ]);
+        $this->assertSame(0, DB::table('server_logs')->whereNull('network_id')->count());
+    }
+
+    /**
+     * `active` reads as "every server is configured and in sync", which a network with no
+     * servers at all has no business claiming.
+     */
+    public function test_network_without_servers_is_not_reported_as_active(): void
+    {
+        $network = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'status' => NetworkStatus::ACTIVE,
+        ]);
+
+        app(RecomputeNetworkStatus::class)->handle($network);
+
+        $this->assertSame(NetworkStatus::CREATING, $network->fresh()?->status);
+    }
+
+    /**
+     * The create dialog reads `servers` as a bare list of options, each carrying the private
+     * addresses a custom network can be built from.
+     */
+    public function test_index_lists_servers_as_options_with_their_private_ips(): void
+    {
+        $ip = ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => '10.0.0.7',
+            'type' => IpAddressType::PRIVATE,
+        ]);
+
+        $this->actingAs($this->user);
+
+        $this->get(route('networks'))
+            ->assertSuccessful()
+            ->assertInertia(fn (AssertableInertia $page) => $page
+                ->component('networks/index')
+                ->has('servers.0', fn (AssertableInertia $option) => $option
+                    ->where('id', $this->server->id)
+                    ->where('name', $this->server->name)
+                    ->has('is_ready')
+                    ->has('private_ips.0', fn (AssertableInertia $address) => $address
+                        ->where('id', $ip->id)
+                        ->where('ip', '10.0.0.7')
+                        ->has('is_primary')))
+                ->etc());
+    }
+
+    /**
+     * The servers tab of a custom network offers each member's other private addresses so the
+     * one it joined with can be changed.
+     */
+    public function test_servers_page_lists_member_ips_for_a_custom_network(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $ip = ServerIpAddress::factory()->create([
+            'server_id' => $this->server->id,
+            'ip' => '10.60.0.5',
+            'type' => IpAddressType::PRIVATE,
+        ]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'custom-members',
+            'type' => 'custom',
+            'cidr' => '10.60.0.0/24',
+            'servers' => [$this->server->id],
+            'ip_addresses' => [$this->server->id => $ip->id],
+        ]);
+
+        $this->actingAs($this->user);
+
+        $this->get(route('networks.servers', $network))
+            ->assertSuccessful()
+            ->assertInertia(fn (AssertableInertia $page) => $page
+                ->component('networks/servers')
+                ->has('memberIps.0', fn (AssertableInertia $member) => $member
+                    ->where('server_id', $this->server->id)
+                    ->where('server_name', $this->server->name)
+                    ->where('ip_address_id', $ip->id)
+                    ->has('private_ips.0')
+                    ->etc())
+                ->etc());
+    }
+
+    public function test_overview_returns_stats_and_recent_logs(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $this->actingAs($this->user);
+
+        $this->get(route('networks.show', $network))
+            ->assertSuccessful()
+            ->assertInertia(fn (AssertableInertia $page) => $page
+                ->component('networks/show')
+                ->where('stats.servers', 1)
+                ->where('stats.peers', 0)
+                ->where('stats.firewall_rules', 1)
+                ->has('logs.data.0', fn (AssertableInertia $log) => $log
+                    ->where('network_id', $network->id)
+                    ->etc()));
+    }
+
+    public function test_logs_page_returns_network_logs_with_their_server(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        $network = app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $this->actingAs($this->user);
+
+        $this->get(route('networks.logs', $network))
+            ->assertSuccessful()
+            ->assertInertia(fn (AssertableInertia $page) => $page
+                ->component('networks/logs')
+                ->has('logs.data.0', fn (AssertableInertia $log) => $log
+                    ->where('network_id', $network->id)
+                    ->where('server_id', $this->server->id)
+                    ->where('server_name', $this->server->name)
+                    ->etc()));
+    }
+
+    public function test_logs_page_is_not_visible_to_other_projects(): void
+    {
+        $network = Network::factory()->create([
+            'project_id' => $this->server->project_id,
+            'type' => NetworkType::CUSTOM,
+        ]);
+
+        $outsider = User::factory()->create();
+        $outsider->ensureHasDefaultProject();
+
+        $this->actingAs($outsider)
+            ->get(route('networks.logs', $network))
+            ->assertForbidden();
+    }
+}
diff --git a/tests/Feature/ProviderPrivateNetworkTest.php b/tests/Feature/ProviderPrivateNetworkTest.php
new file mode 100644
index 000000000..9b5630d01
--- /dev/null
+++ b/tests/Feature/ProviderPrivateNetworkTest.php
@@ -0,0 +1,629 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Exceptions\PrivateNetworkSyncError;
+use App\Models\ServerProvider;
+use App\ServerProviders\AWS;
+use App\ServerProviders\DigitalOcean;
+use App\ServerProviders\Hetzner;
+use App\ServerProviders\Linode;
+use App\ServerProviders\Vultr;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use PHPUnit\Framework\Attributes\DataProvider;
+use Tests\TestCase;
+
+class ProviderPrivateNetworkTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function hetznerConnection(): ServerProvider
+    {
+        return ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => Hetzner::id(),
+            'profile' => 'hetzner-main',
+            'credentials' => ['token' => 'secret-token'],
+        ]);
+    }
+
+    public function test_hetzner_maps_networks_and_member_ips(): void
+    {
+        Http::fake([
+            'api.hetzner.cloud/v1/networks*' => Http::response([
+                'networks' => [
+                    [
+                        'id' => 4711,
+                        'name' => 'prod-net',
+                        'ip_range' => '10.0.0.0/16',
+                        'subnets' => [['network_zone' => 'eu-central']],
+                        'servers' => [101, 102, 999],
+                    ],
+                ],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+            'api.hetzner.cloud/v1/servers*' => Http::response([
+                'servers' => [
+                    ['id' => 101, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.2']]],
+                    ['id' => 102, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.3']]],
+                    ['id' => 999, 'private_net' => [['network' => 4711, 'ip' => '10.0.0.9']]],
+                ],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+        ]);
+
+        /** @var Hetzner $provider */
+        $provider = $this->hetznerConnection()->provider();
+
+        $networks = $provider->privateNetworks(['101', '102'], []);
+
+        $this->assertCount(1, $networks);
+        $this->assertSame('4711', $networks[0]->externalId);
+        $this->assertSame('prod-net', $networks[0]->name);
+        $this->assertSame('10.0.0.0/16', $networks[0]->cidr);
+        $this->assertSame('eu-central', $networks[0]->region);
+
+        $this->assertCount(2, $networks[0]->members, 'Instances Vito does not manage must be ignored.');
+        $this->assertSame(['101', '102'], array_map(fn ($m): string => $m->instanceId, $networks[0]->members));
+        $this->assertSame(['10.0.0.2', '10.0.0.3'], array_map(fn ($m): ?string => $m->ip, $networks[0]->members));
+    }
+
+    public function test_hetzner_skips_networks_with_no_managed_members(): void
+    {
+        Http::fake([
+            'api.hetzner.cloud/v1/networks*' => Http::response([
+                'networks' => [
+                    ['id' => 1, 'name' => 'unrelated', 'ip_range' => '10.1.0.0/16', 'servers' => [777]],
+                ],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+            'api.hetzner.cloud/v1/servers*' => Http::response([
+                'servers' => [],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+        ]);
+
+        /** @var Hetzner $provider */
+        $provider = $this->hetznerConnection()->provider();
+
+        $this->assertSame([], $provider->privateNetworks(['101'], []));
+    }
+
+    public function test_hetzner_follows_pagination(): void
+    {
+        Http::fakeSequence('api.hetzner.cloud/v1/networks*')
+            ->push([
+                'networks' => [['id' => 1, 'name' => 'a', 'ip_range' => '10.1.0.0/16', 'servers' => []]],
+                'meta' => ['pagination' => ['next_page' => 2]],
+            ])
+            ->push([
+                'networks' => [['id' => 2, 'name' => 'b', 'ip_range' => '10.2.0.0/16', 'servers' => [101]]],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]);
+
+        Http::fake([
+            'api.hetzner.cloud/v1/servers*' => Http::response([
+                'servers' => [['id' => 101, 'private_net' => [['network' => 2, 'ip' => '10.2.0.4']]]],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+        ]);
+
+        /** @var Hetzner $provider */
+        $provider = $this->hetznerConnection()->provider();
+
+        $networks = $provider->privateNetworks(['101'], []);
+
+        $this->assertCount(1, $networks);
+        $this->assertSame('2', $networks[0]->externalId);
+        $this->assertSame('10.2.0.4', $networks[0]->members[0]->ip);
+    }
+
+    public function test_hetzner_error_does_not_leak_credentials(): void
+    {
+        Http::fake([
+            'api.hetzner.cloud/v1/*' => Http::response(['error' => ['message' => 'forbidden']], 403),
+        ]);
+
+        /** @var Hetzner $provider */
+        $provider = $this->hetznerConnection()->provider();
+
+        try {
+            $provider->privateNetworks(['101'], []);
+            $this->fail('Expected PrivateNetworkSyncError.');
+        } catch (PrivateNetworkSyncError $e) {
+            $this->assertTrue($e->isPermissionError());
+            $this->assertStringNotContainsString('secret-token', $e->getMessage());
+            $this->assertStringNotContainsString('secret-token', (string) $e);
+            $this->assertSame('hetzner', $e->provider);
+            $this->assertSame('hetzner-main', $e->profile);
+        }
+    }
+
+    public function test_digitalocean_uses_droplet_vpc_uuid_and_private_address(): void
+    {
+        Http::fake([
+            'api.digitalocean.com/v2/vpcs*' => Http::response([
+                'vpcs' => [
+                    ['id' => 'vpc-abc', 'name' => 'default-lon1', 'ip_range' => '10.106.0.0/20', 'region' => 'lon1'],
+                ],
+            ]),
+            'api.digitalocean.com/v2/droplets*' => Http::response([
+                'droplets' => [
+                    [
+                        'id' => 3164444,
+                        'vpc_uuid' => 'vpc-abc',
+                        'networks' => ['v4' => [
+                            ['type' => 'public', 'ip_address' => '203.0.113.5'],
+                            ['type' => 'private', 'ip_address' => '10.106.0.4'],
+                        ]],
+                    ],
+                    ['id' => 999, 'vpc_uuid' => 'vpc-abc', 'networks' => ['v4' => []]],
+                ],
+            ]),
+        ]);
+
+        $connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => DigitalOcean::id(),
+            'credentials' => ['token' => 'secret-token'],
+        ]);
+
+        /** @var DigitalOcean $provider */
+        $provider = $connection->provider();
+
+        $networks = $provider->privateNetworks(['3164444'], []);
+
+        $this->assertCount(1, $networks);
+        $this->assertSame('vpc-abc', $networks[0]->externalId);
+        $this->assertSame('10.106.0.0/20', $networks[0]->cidr);
+        $this->assertCount(1, $networks[0]->members, 'Unmanaged droplets must be excluded.');
+        $this->assertSame('10.106.0.4', $networks[0]->members[0]->ip);
+    }
+
+    public function test_linode_reads_membership_from_subnets_and_ips_from_account_list(): void
+    {
+        Http::fake([
+            'api.linode.com/v4/vpcs/ips*' => Http::response([
+                'data' => [
+                    ['linode_id' => 555, 'vpc_id' => 77, 'address' => '10.0.1.4', 'active' => true],
+                    ['linode_id' => 555, 'vpc_id' => 77, 'address' => null, 'address_range' => '10.0.9.0/28'],
+                ],
+                'page' => 1,
+                'pages' => 1,
+            ]),
+            'api.linode.com/v4/vpcs*' => Http::response([
+                'data' => [
+                    [
+                        'id' => 77,
+                        'label' => 'prod-vpc',
+                        'region' => 'eu-west',
+                        'subnets' => [
+                            ['ipv4' => '10.0.1.0/24', 'linodes' => [['id' => 555], ['id' => 888]]],
+                        ],
+                    ],
+                ],
+                'page' => 1,
+                'pages' => 1,
+            ]),
+        ]);
+
+        $connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => Linode::id(),
+            'credentials' => ['token' => 'secret-token'],
+        ]);
+
+        /** @var Linode $provider */
+        $provider = $connection->provider();
+
+        $networks = $provider->privateNetworks(['555'], []);
+
+        $this->assertCount(1, $networks);
+        $this->assertSame('prod-vpc', $networks[0]->name);
+        $this->assertSame('10.0.1.0/24', $networks[0]->cidr);
+        $this->assertCount(1, $networks[0]->members);
+        $this->assertSame('10.0.1.4', $networks[0]->members[0]->ip);
+    }
+
+    /**
+     * A page count the API never stops advancing past would otherwise be walked until the job's
+     * timeout. Failing beats returning what was collected so far: a partial view of the account
+     * would look like the missing VPCs are gone, and sync prunes on that.
+     */
+    public function test_linode_stops_and_fails_on_a_runaway_page_count(): void
+    {
+        Http::fake([
+            'api.linode.com/v4/*' => Http::response([
+                'data' => [],
+                'page' => 1,
+                'pages' => 100000,
+            ]),
+        ]);
+
+        $connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => Linode::id(),
+            'credentials' => ['token' => 'secret-token'],
+        ]);
+
+        /** @var Linode $provider */
+        $provider = $connection->provider();
+
+        $this->expectException(PrivateNetworkSyncError::class);
+
+        $provider->privateNetworks(['555'], []);
+    }
+
+    public function test_linode_multi_subnet_vpc_reports_no_single_cidr(): void
+    {
+        Http::fake([
+            'api.linode.com/v4/vpcs/ips*' => Http::response(['data' => [], 'page' => 1, 'pages' => 1]),
+            'api.linode.com/v4/vpcs*' => Http::response([
+                'data' => [[
+                    'id' => 77,
+                    'label' => 'multi',
+                    'subnets' => [
+                        ['ipv4' => '10.0.1.0/24', 'linodes' => [['id' => 555]]],
+                        ['ipv4' => '10.0.2.0/24', 'linodes' => []],
+                    ],
+                ]],
+                'page' => 1,
+                'pages' => 1,
+            ]),
+        ]);
+
+        $connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => Linode::id(),
+            'credentials' => ['token' => 'secret-token'],
+        ]);
+
+        /** @var Linode $provider */
+        $provider = $connection->provider();
+
+        $networks = $provider->privateNetworks(['555'], []);
+
+        $this->assertNull(
+            $networks[0]->cidr,
+            'A VPC with several subnets has no single CIDR; firewall rules fall back to member /32s.'
+        );
+    }
+
+    public function test_vultr_builds_cidr_from_v4_subnet_and_mask(): void
+    {
+        Http::fake([
+            'api.vultr.com/v2/instances/*/vpcs*' => Http::response([
+                'vpcs' => [['id' => 'vpc-1', 'ip_address' => '10.20.0.4', 'mac_address' => 'aa:bb']],
+            ]),
+            'api.vultr.com/v2/vpcs*' => Http::response([
+                'vpcs' => [[
+                    'id' => 'vpc-1',
+                    'description' => 'prod-vpc',
+                    'v4_subnet' => '10.20.0.0',
+                    'v4_subnet_mask' => 24,
+                    'region' => 'lhr',
+                ]],
+            ]),
+        ]);
+
+        $connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => Vultr::id(),
+            'credentials' => ['token' => 'secret-token'],
+        ]);
+
+        /** @var Vultr $provider */
+        $provider = $connection->provider();
+
+        $networks = $provider->privateNetworks(['inst-1'], []);
+
+        $this->assertCount(1, $networks);
+        $this->assertSame('prod-vpc', $networks[0]->name);
+        $this->assertSame('10.20.0.0/24', $networks[0]->cidr);
+        $this->assertSame('10.20.0.4', $networks[0]->members[0]->ip);
+    }
+
+    public function test_vultr_stale_instance_id_does_not_abort_the_connection(): void
+    {
+        Http::fake([
+            'api.vultr.com/v2/instances/gone/vpcs*' => Http::response(['error' => 'not found'], 404),
+            'api.vultr.com/v2/instances/*/vpcs*' => Http::response([
+                'vpcs' => [['id' => 'vpc-1', 'ip_address' => '10.20.0.4']],
+            ]),
+            'api.vultr.com/v2/vpcs*' => Http::response([
+                'vpcs' => [['id' => 'vpc-1', 'description' => 'prod', 'v4_subnet' => '10.20.0.0', 'v4_subnet_mask' => 24]],
+            ]),
+        ]);
+
+        $connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => Vultr::id(),
+            'credentials' => ['token' => 'secret-token'],
+        ]);
+
+        /** @var Vultr $provider */
+        $provider = $connection->provider();
+
+        $networks = $provider->privateNetworks(['gone', 'live'], []);
+
+        $this->assertCount(1, $networks, 'A deleted instance must not abort the whole connection.');
+        $this->assertSame('10.20.0.4', $networks[0]->members[0]->ip);
+        $this->assertSame('live', $networks[0]->members[0]->instanceId);
+    }
+
+    public function test_vultr_non_404_error_still_fails_the_connection(): void
+    {
+        Http::fake([
+            'api.vultr.com/v2/*' => Http::response(['error' => 'boom'], 500),
+        ]);
+
+        $connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => Vultr::id(),
+            'credentials' => ['token' => 'secret-token'],
+        ]);
+
+        /** @var Vultr $provider */
+        $provider = $connection->provider();
+
+        $this->expectException(PrivateNetworkSyncError::class);
+        $provider->privateNetworks(['live'], []);
+    }
+
+    public function test_aws_mapper_prefers_network_interface_and_name_tag(): void
+    {
+        $connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => AWS::id(),
+            'credentials' => ['key' => 'k', 'secret' => 's'],
+        ]);
+
+        /** @var AWS $provider */
+        $provider = $connection->provider();
+
+        $reservations = [[
+            'Instances' => [
+                [
+                    'InstanceId' => 'i-123',
+                    'VpcId' => 'vpc-top',
+                    'PrivateIpAddress' => '172.31.9.9',
+                    'NetworkInterfaces' => [
+                        ['VpcId' => 'vpc-eni', 'PrivateIpAddress' => '172.31.0.5'],
+                    ],
+                ],
+                ['InstanceId' => 'i-unmanaged', 'VpcId' => 'vpc-eni', 'PrivateIpAddress' => '172.31.0.6'],
+            ],
+        ]];
+
+        $vpcs = [[
+            'VpcId' => 'vpc-eni',
+            'CidrBlock' => '172.31.0.0/16',
+            'Tags' => [['Key' => 'Name', 'Value' => 'production']],
+        ]];
+
+        $networks = $provider->mapPrivateNetworks($reservations, $vpcs, ['i-123'], 'eu-west-2');
+
+        $this->assertCount(1, $networks);
+        $this->assertSame('vpc-eni', $networks[0]->externalId);
+        $this->assertSame('production', $networks[0]->name);
+        $this->assertSame('172.31.0.0/16', $networks[0]->cidr);
+        $this->assertSame('eu-west-2', $networks[0]->region);
+        $this->assertCount(1, $networks[0]->members);
+        $this->assertSame('172.31.0.5', $networks[0]->members[0]->ip);
+    }
+
+    /**
+     * An IPv6-only VPC carries its range in the association set and its instances have no
+     * `PrivateIpAddress`. Reading only the IPv4 fields would sync the network with no range and
+     * its members with no address, leaving them outside every firewall rule derived from it.
+     */
+    public function test_aws_mapper_reads_ipv6_only_vpcs_and_members(): void
+    {
+        $connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => AWS::id(),
+            'credentials' => ['key' => 'k', 'secret' => 's'],
+        ]);
+
+        /** @var AWS $provider */
+        $provider = $connection->provider();
+
+        $networks = $provider->mapPrivateNetworks(
+            [['Instances' => [[
+                'InstanceId' => 'i-v6',
+                'NetworkInterfaces' => [[
+                    'VpcId' => 'vpc-v6',
+                    'Ipv6Addresses' => [['Ipv6Address' => '2001:db8:1::5']],
+                ]],
+            ]]]],
+            [[
+                'VpcId' => 'vpc-v6',
+                'Ipv6CidrBlockAssociationSet' => [['Ipv6CidrBlock' => '2001:db8:1::/56']],
+            ]],
+            ['i-v6'],
+            'eu-west-1',
+        );
+
+        $this->assertCount(1, $networks);
+        $this->assertSame('2001:db8:1::/56', $networks[0]->cidr);
+        $this->assertSame('2001:db8:1::5', $networks[0]->members[0]->ip);
+    }
+
+    /**
+     * A dual-stack VPC keeps its IPv4 identity — a network holds one range, and the members
+     * report their IPv4 addresses.
+     */
+    public function test_aws_mapper_prefers_ipv4_on_a_dual_stack_vpc(): void
+    {
+        $connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => AWS::id(),
+            'credentials' => ['key' => 'k', 'secret' => 's'],
+        ]);
+
+        /** @var AWS $provider */
+        $provider = $connection->provider();
+
+        $networks = $provider->mapPrivateNetworks(
+            [['Instances' => [[
+                'InstanceId' => 'i-dual',
+                'NetworkInterfaces' => [[
+                    'VpcId' => 'vpc-dual',
+                    'PrivateIpAddress' => '172.31.0.5',
+                    'Ipv6Addresses' => [['Ipv6Address' => '2001:db8:2::5']],
+                ]],
+            ]]]],
+            [[
+                'VpcId' => 'vpc-dual',
+                'CidrBlock' => '172.31.0.0/16',
+                'Ipv6CidrBlockAssociationSet' => [['Ipv6CidrBlock' => '2001:db8:2::/56']],
+            ]],
+            ['i-dual'],
+            'eu-west-1',
+        );
+
+        $this->assertSame('172.31.0.0/16', $networks[0]->cidr);
+        $this->assertSame('172.31.0.5', $networks[0]->members[0]->ip);
+    }
+
+    public function test_aws_mapper_falls_back_to_vpc_id_when_untagged(): void
+    {
+        $connection = ServerProvider::factory()->create([
+            'user_id' => $this->user->id,
+            'provider' => AWS::id(),
+            'credentials' => ['key' => 'k', 'secret' => 's'],
+        ]);
+
+        /** @var AWS $provider */
+        $provider = $connection->provider();
+
+        $networks = $provider->mapPrivateNetworks(
+            [['Instances' => [['InstanceId' => 'i-1', 'VpcId' => 'vpc-9', 'PrivateIpAddress' => '10.0.0.2']]]],
+            [['VpcId' => 'vpc-9', 'CidrBlock' => '10.0.0.0/16']],
+            ['i-1'],
+            'us-east-1',
+        );
+
+        $this->assertSame('vpc-9', $networks[0]->name);
+    }
+
+    /**
+     * @return array<string, array{0: ?string}>
+     */
+    public static function untrustedAddresses(): array
+    {
+        return [
+            'command substitution' => ['10.0.0.2 $(id)'],
+            'command chaining' => ['10.0.0.2; rm -rf /'],
+            'backticks' => ['`whoami`'],
+            'newline injection' => ["10.0.0.2\nsudo ufw disable"],
+            'ipv6 with metacharacters' => ['fd00::1; id'],
+            'ipv6 with prefix' => ['fd00::1/64'],
+            'not an address' => ['not-an-ip'],
+            'empty' => [''],
+        ];
+    }
+
+    #[DataProvider('untrustedAddresses')]
+    public function test_member_addresses_that_are_not_literal_addresses_are_dropped(?string $address): void
+    {
+        Http::fake([
+            'api.hetzner.cloud/v1/networks*' => Http::response([
+                'networks' => [['id' => 1, 'name' => 'n', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+            'api.hetzner.cloud/v1/servers*' => Http::response([
+                'servers' => [['id' => 101, 'private_net' => [['network' => 1, 'ip' => $address]]]],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+        ]);
+
+        /** @var Hetzner $provider */
+        $provider = $this->hetznerConnection()->provider();
+
+        $networks = $provider->privateNetworks(['101'], []);
+
+        $this->assertNull(
+            $networks[0]->members[0]->ip,
+            'Member addresses reach an unquoted shell interpolation in the ufw template.'
+        );
+    }
+
+    public function test_valid_member_address_survives_normalisation(): void
+    {
+        Http::fake([
+            'api.hetzner.cloud/v1/networks*' => Http::response([
+                'networks' => [['id' => 1, 'name' => 'n', 'ip_range' => '10.0.0.0/16', 'servers' => [101]]],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+            'api.hetzner.cloud/v1/servers*' => Http::response([
+                'servers' => [['id' => 101, 'private_net' => [['network' => 1, 'ip' => '10.0.0.42']]]],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+        ]);
+
+        /** @var Hetzner $provider */
+        $provider = $this->hetznerConnection()->provider();
+
+        $this->assertSame('10.0.0.42', $provider->privateNetworks(['101'], [])[0]->members[0]->ip);
+    }
+
+    /**
+     * IPv6 ranges are supported and canonicalised like IPv4 ones; only ranges that are
+     * malformed — no prefix, out-of-range prefix, or not an address — are dropped, because
+     * they reach a shell template through the rules derived from them.
+     */
+    public function test_ipv6_ranges_are_kept_and_malformed_ranges_are_dropped(): void
+    {
+        Http::fake([
+            'api.hetzner.cloud/v1/networks*' => Http::response([
+                'networks' => [
+                    ['id' => 1, 'name' => 'v6', 'ip_range' => 'fd00::/64', 'servers' => [101]],
+                    ['id' => 2, 'name' => 'junk', 'ip_range' => 'not-a-cidr', 'servers' => [101]],
+                    ['id' => 3, 'name' => 'noprefix', 'ip_range' => '10.0.0.0', 'servers' => [101]],
+                    ['id' => 4, 'name' => 'ok', 'ip_range' => '10.5.0.0/16', 'servers' => [101]],
+                    ['id' => 5, 'name' => 'v6noncanonical', 'ip_range' => 'fd00:1:2:3:4::5/48', 'servers' => [101]],
+                    ['id' => 6, 'name' => 'v6overlong', 'ip_range' => 'fd00::/129', 'servers' => [101]],
+                    ['id' => 7, 'name' => 'v4overlong', 'ip_range' => '10.0.0.0/33', 'servers' => [101]],
+                ],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+            'api.hetzner.cloud/v1/servers*' => Http::response([
+                'servers' => [['id' => 101, 'private_net' => []]],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+        ]);
+
+        /** @var Hetzner $provider */
+        $provider = $this->hetznerConnection()->provider();
+
+        $cidrs = array_map(fn ($n): ?string => $n->cidr, $provider->privateNetworks(['101'], []));
+
+        $this->assertSame(
+            ['fd00::/64', null, null, '10.5.0.0/16', 'fd00:1:2::/48', null, null],
+            $cidrs
+        );
+    }
+
+    public function test_ipv6_member_address_survives_normalisation(): void
+    {
+        Http::fake([
+            'api.hetzner.cloud/v1/networks*' => Http::response([
+                'networks' => [['id' => 1, 'name' => 'n', 'ip_range' => 'fd00::/64', 'servers' => [101]]],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+            'api.hetzner.cloud/v1/servers*' => Http::response([
+                'servers' => [['id' => 101, 'private_net' => [['network' => 1, 'ip' => 'fd00::5']]]],
+                'meta' => ['pagination' => ['next_page' => null]],
+            ]),
+        ]);
+
+        /** @var Hetzner $provider */
+        $provider = $this->hetznerConnection()->provider();
+
+        $networks = $provider->privateNetworks(['101'], []);
+
+        $this->assertSame('fd00::5', $networks[0]->members[0]->ip);
+    }
+}
diff --git a/tests/Feature/UniqueQueueTest.php b/tests/Feature/UniqueQueueTest.php
new file mode 100644
index 000000000..efe7bda05
--- /dev/null
+++ b/tests/Feature/UniqueQueueTest.php
@@ -0,0 +1,64 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Traits\UniqueQueue;
+use Illuminate\Contracts\Queue\Job as JobContract;
+use Illuminate\Foundation\Queue\Queueable;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Mockery;
+use RuntimeException;
+use Tests\TestCase;
+
+class UniqueQueueTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function makeJob(callable $callback): object
+    {
+        return new class($callback)
+        {
+            use Queueable;
+            use UniqueQueue;
+
+            /** @var callable */
+            private $callback;
+
+            public function __construct(callable $callback)
+            {
+                $this->callback = $callback;
+            }
+
+            public function execute(): void
+            {
+                $this->run('unique-queue-test', $this->callback);
+            }
+        };
+    }
+
+    public function test_transient_database_lock_is_released_for_retry(): void
+    {
+        $job = $this->makeJob(fn () => throw new RuntimeException('SQLSTATE[HY000]: General error: 5 database is locked'));
+
+        $queueJob = Mockery::mock(JobContract::class);
+        $queueJob->shouldReceive('attempts')->andReturn(1);
+        $queueJob->shouldReceive('release')->once();
+        $queueJob->shouldReceive('fail')->never();
+        $job->setJob($queueJob);
+
+        $job->execute();
+    }
+
+    public function test_non_transient_error_fails_the_job(): void
+    {
+        $job = $this->makeJob(fn () => throw new RuntimeException('something else broke'));
+
+        $queueJob = Mockery::mock(JobContract::class);
+        $queueJob->shouldReceive('attempts')->andReturn(1);
+        $queueJob->shouldReceive('fail')->once();
+        $queueJob->shouldReceive('release')->never();
+        $job->setJob($queueJob);
+
+        $job->execute();
+    }
+}
diff --git a/tests/Unit/Actions/Service/UninstallTest.php b/tests/Unit/Actions/Service/UninstallTest.php
index 9ee667b66..6b7a6f3cf 100644
--- a/tests/Unit/Actions/Service/UninstallTest.php
+++ b/tests/Unit/Actions/Service/UninstallTest.php
@@ -2,7 +2,9 @@
 
 namespace Tests\Unit\Actions\Service;
 
+use App\Actions\Network\CreateNetwork;
 use App\Actions\Service\Uninstall;
+use App\Enums\ServerStatus;
 use App\Enums\ServiceStatus;
 use App\Facades\SSH;
 use App\Jobs\Service\UpdateVitoAgentConfigJob;
@@ -125,6 +127,39 @@ public function test_cannot_uninstall_mysql(): void
         app(Uninstall::class)->uninstall($this->server->database());
     }
 
+    public function test_cannot_uninstall_wireguard_when_server_is_network_member(): void
+    {
+        SSH::fake();
+        $this->server->update(['status' => ServerStatus::READY]);
+
+        app(CreateNetwork::class)->create($this->server->project, [
+            'name' => 'wg-net',
+            'type' => 'wireguard',
+            'servers' => [$this->server->id],
+        ]);
+
+        $this->expectException(ValidationException::class);
+
+        app(Uninstall::class)->uninstall($this->server->service('vpn'));
+    }
+
+    public function test_can_uninstall_wireguard_when_server_is_not_a_network_member(): void
+    {
+        SSH::fake();
+
+        $service = Service::factory()->create([
+            'server_id' => $this->server->id,
+            'name' => 'wireguard',
+            'type' => 'vpn',
+            'version' => 'latest',
+            'status' => ServiceStatus::READY,
+        ]);
+
+        app(Uninstall::class)->uninstall($service);
+
+        $this->assertDatabaseMissing('services', ['id' => $service->id]);
+    }
+
     /**
      * Cannot uninstall supervisor because some queues exist
      */