# Network

A network in Managed Nebula is one [overlay network](/docs/glossary/overlay-network/): a set of [hosts](/docs/glossary/host/) that share an IP address range and can reach each other, as far as their [firewall rules](/docs/glossary/firewall-rules/) allow. An account can have more than one network. Hosts on different networks can't communicate, but every network in an account uses the same [roles](/docs/glossary/role/) and [tags](/docs/glossary/tag/).

Networks live under [Settings > Networks](https://admin.defined.net/settings/networks) in the [admin panel](/docs/glossary/admin-panel/). When you add one, Managed Nebula generates its IPv6 range for you, and you can also give it an IPv4 range, which makes it dual-stack. A network holds at most one IPv4 range. Once a range is set it can't be changed, so read [Choosing a CIDR](/docs/get-started/choosing-a-cidr/) before you pick one. The form also has these settings:

- **Use managed lighthouses**: Defined Networking runs a [managed lighthouse](/docs/glossary/managed-lighthouse/) for the network. It's on by default.
- **Use self-hosted lighthouses as relays**: lighthouses you run yourself also act as [relays](/docs/glossary/relay/).
- **Use P-256 elliptic curve cryptography**: signs the network's certificates with ECDSA P-256 instead of Ed25519. This can't be changed after the network is created.

Editing a network adds a **Host advanced config** section, which applies [config overrides](/docs/glossary/config-override/) to every host, lighthouse, and relay in it.

Each host belongs to one network, chosen when the host is created. It can't be moved afterward, so changing a host's network or address range means [migrating to a new network](/docs/guides/migrating-between-networks/). A network can't be deleted while it still has hosts, lighthouses, relays, an endpoint SSO provider, or a [join key](/docs/glossary/join-key/) that uses it.

Networks created before IPv6 support are IPv4-only and use version 1 [Nebula certificates](/docs/glossary/nebula-certificate/). Their **Edit network** page has an **Update network** button that makes them dual-stack and moves them to version 2 certificates.