Moving to a different VM will update the pfSense NAT rule immediately.
The internal IP of the target VM on your project network.
Firewall / Security Groups
Security GroupsPer-VM firewall rules — control inbound and outbound traffic
🛡
Select a VM above
Choose a VM to manage its firewall rules
🛡️
No firewall enabled for this VM
Enable a security group to control inbound and outbound traffic with custom rules.
Inbound Rules0
No inbound rules — all incoming traffic is blocked
Outbound Rules0
No outbound rules — all outgoing traffic is allowed by default
Network ACLs & Cross-Project PeeringAllow traffic between two of your project networks
By default all project networks are fully isolated from each other. Add a peering to allow VMs in different projects to communicate directly over your private network.
Source Project
Destination Project
Protocol
Port
Created
Port Forwarding & NATForward public ports to private VMs, or map a whole WAN IP 1:1
Type
WAN IP
WAN Port
Target IP
Target Port
Protocol
Description
Add Inbound Rule
Choose what type of traffic to allow:
🌐
Web traffic (HTTP & HTTPS)
Ports 80 and 443
🔑
SSH access
Terminal access — port 22
🗄️
MySQL database
Port 3306
🐘
PostgreSQL database
Port 5432
🎮
Minecraft server
Port 25565
⚙️
Custom port / ICMP
Specify protocol, port, and source
🌍 Anyone
Open to the internet
🏠 Specific IP / CIDR
Restrict to an address
Add Network Peering
Choose which of your other projects to peer with. Both networks must have a VLAN provisioned.
Add NAT / Port Forward Rule
↪ Port Forward
Forward a specific port on a public IP to a private VM
⇄ 1:1 NAT
Map an entire public IP directly to a private VM
VPN Access
WireGuard VPN
Create a personal VPN account to connect directly into your project networks from anywhere.
You'll receive a .conf config file — import it into the WireGuard app on any device.
WireGuard VPN active
Username:
VPN IP:
Created:
Your WireGuard config
Save this config now — your private key is only shown once.
ISO Library
Available images
—
platform templates
Platform OS images
Name
Format
Size
SSH Keys
How SSH key injection works
Add your public key here, then select it when launching an instance.
It will be injected automatically via cloud-init — your instance will be ready to SSH into
as soon as it boots. No passwords needed.
Your keys
Name
Fingerprint
Added
Actions
Account Settings
Change PasswordUpdate your login password
Two-Factor AuthenticationProtect your account with an authenticator app
2FA is not enabled. Add an extra layer of security using Google Authenticator, Authy, or any TOTP app.
Scan this QR code with your authenticator app, then enter the 6-digit code to confirm.
Can't scan? Enter this key manually:
2FA enabled! Save these backup codes
If you lose access to your authenticator, use one of these codes to log in. Each code works once.
ActiveYour account is protected with two-factor authentication.
Enter your password and current 2FA code to disable two-factor authentication.
Change EmailUpdate the email address associated with your account
Delete AccountPermanently close your account and delete all data
This will permanently delete your account, all organisations you solely own, all servers, and all associated data. This action cannot be undone.
Your billing records will be retained for 6 years as required by HMRC. All other data will be removed within 30 days.
Recent ActivityYour last 50 account actions
Time
Action
Resource
IP
Loading…
Support Tickets
Open
—
In Progress
—
Waiting on you
—
Resolved
—
Subject
Status
Priority
Category
Replies
Updated
Loading…
New Support Ticket
API Keys
Use API keys to authenticate programmatic requests. Pass the key in the
X-API-Key
request header. Keys have org admin access. The secret is shown once at creation.
🔑
No API keys
Create a key to get started.
API Reference
api.baremeta.cloud
Billing & Usage
This month
—
estimated
CPU hours
—
this month
Bandwidth used
—
total
Active servers
—
running now
Usage by server
💳
No usage data yet
Usage is recorded hourly.
Monthly spending cap
No spending cap set. Your account will not be throttled based on spend.
Estimated spend this month0%
£0.00£0.00 cap
Spending cap reached — VMs throttled to 1 Mbps until the next billing cycle.
£
At 80%: receive an email warning. At 100%: all VMs throttled to 1 Mbps for the rest of the month.
Payment method
Autopay on
No card saved. Add a card to enable autopay — invoices will be charged automatically each month.
Visa ending 4242 · 12/27
InvoicesMonthly invoices — click Pay Now to settle via card
🧾
No invoices yet
Invoices are generated on the 1st of each month.
Bandwidth policy
Starter
10 TB
included/mo
Small
10 TB
included/mo
Medium
10 TB
included/mo
Large
10 TB
included/mo
After your allowance is exceeded, port speed is throttled to 10 Mbps until the next billing cycle. No overage charges.
Platform Admin
Server Resources
vCPUs used
—
of — allocated
RAM used
—
of — allocated
VMs running
—
— total
Active orgs
—
with at least 1 VM
vCPU ratio (bar fills at 2×)—
RAM allocation—
Host Health—
Loading…
Users
Loading…
Beta Invite CodesGenerate and manage invite codes for beta access
Generate new codes
New codes — copy now
🔑
No invite codes yet
Generate codes above to invite beta users.
Audit Log
Time
User
Action
Resource
Detail
IP
Loading…
Scheduled Maintenance Windows
Loading…
Incidents & Maintenance (historical)
Loading…
Support Tickets
Loading…
Post Incident
Schedule Maintenance Window
Announce an upcoming downtime window to customers. Windows become active automatically at the start time.
Create API Key
Copy your API key — it won't be shown again
Use in requests: X-API-Key: <your key>
📸 Snapshots —
Snapshot limit reached (max 2 per VM). Delete an existing snapshot to create a new one.
Loading…
Export Disk Image
Download a single .qcow2 file of this VM's disk — bootable on any KVM host.
Good for off-site backups or migrating elsewhere.
Consistency note: The export runs while the VM is running.
For a strictly consistent image, stop the VM first. Large disks can take several minutes;
the download link appears once conversion completes.
Loading recent exports…
Backups
Nightly encrypted backups to off-host storage. Restore any backup as a new VM in one click.
Backups not enabled for this VM. Enable them during VM creation (£4.99/mo) to start protecting your data.
Best for: high-traffic sites, busy multiplayer servers
£22.00/mo
£0.0301/hr
⚙️ Custom build
Specify exact CPU, RAM and storage
Configure →
vCPUs2 vCPU
1481632
RAM4 GB
512MB16GB32GB64GB128GB
Storage50 GB
10GB500GB1TB2TB
Estimated cost
£9.99/mo
£0.014/hr
Loading images…
💡 Your OS choice is permanent — switching distributions later means rebuilding the server.
Monthly
No discount
3 months
Save 5%
6 months
Save 10%
12 months
Save 15%
🛡 Automated daily backups
Nightly encrypted off-host backup with 7-day rolling retention. Restore to a new VM with one click.
£4.99/mo
🌐
Network
1 Gbps port · 10 TB/mo outbound included · throttled to 10 Mbps after the allowance, never billed for overage.
10 Gbps coming in Phase 2.
🇬🇧 Birmingham, UK · ⏱️ Typical ready time: about 1 minute. You'll get an email when it's live.
Assign Public IP
Leave on auto to let the platform pick the next available address.
Upload ISO
Max 12 GB · .iso files only · 10 ISOs per organisation
Add SSH Public Key
Get your public key: cat ~/.ssh/id_ed25519.pub
SSH Terminal
Instance Console
Server Metrics
CPU Activity
RAM Usage
Monthly Bandwidth
0 GB used0%
10 TB included/mo
No metrics data yet — data is collected hourly.
Reset Instance Password
Uses QEMU guest agent — works without network access.
Requires the BareMeta agent to be installed inside the instance.
Resize Server
Changes take effect on next start. VM must remain stopped.
GB
Current: — GB. Filesystem will be expanded on next boot.
🚀 Launching
Your VM is booting now. SSH usually accepts connections within 1–2 minutes. You can safely close this window — the server keeps launching in the background.
0%
✅ Server is ready — save these credentials
Use these credentials to log in via the browser console or SSH. The password won't be shown again.
ubuntu
Change this password after first login with: passwd