---
name: logs-router-vpe-connection
title: Using virtual private endpoints for VPC to privately connect to IBM Cloud Logs Routing
description: IBM Cloud® Virtual Private Endpoints (VPE) for VPC enables you to connect to IBM Cloud Logs Routing from your VPC network by using the IP addresses of your choosing, allocated from a subnet within your VPC.
last-updated: 2025-11-17
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/logs-router?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Using virtual private endpoints for VPC to privately connect to IBM Cloud Logs Routing
{: #vpe-connection}

IBM Cloud® Virtual Private Endpoints (VPE) for VPC enables you to connect to IBM Cloud Logs Routing from your VPC network by using the IP addresses of your choosing, allocated from a subnet within your VPC.
{: shortdesc}

VPEs are virtual IP interfaces that are bound to an endpoint gateway created on a per service, or service instance, basis (depending on the service operation model). The endpoint gateway is a virtualized function that scales horizontally, is redundant and highly available, and spans all availability zones of your VPC. Endpoint gateways enable communications from virtual server instances within your VPC and IBM Cloud® services on the private backbone. VPE for VPC gives you the experience of controlling all the private addressing within your cloud. For more information, see [About virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown).

VPE for VPC provides private connectivity to IBM services such as IBM Cloud Logs Routing, but within the VPC network of your choosing.

IBM® Cloud Logs Routing provides API endpoints for both management functions, such as creating (onboarding) as a tenant, and ingestion of logs. These API endpoints are separate endpoints that are accessed by using specific URLs in each supported region. You can find the endpoints for each supported region [here](https://cloud.ibm.com/docs/logs-router?topic=logs-router-endpoints&format=markdown).

To connect to IBM Cloud Logs Routing in a region through private endpoints, you must define a VPE for managing the service and a different VPE for ingesting logs into the service so that you can connect to IBM Cloud Logs Routing within the VPC network of your choosing.
{: note}


## Before you begin
{: #vpe-connection-prereqs}

Before you target a virtual private endpoint for IBM Cloud Logs Routing, you must complete the following tasks:

* Ensure that a [Virtual Private Cloud is created](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown).
* Make a plan for your [virtual private endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-planning-considerations&format=markdown).
* Ensure that [correct access controls](https://cloud.ibm.com/docs/vpc?topic=vpc-configure-acls-sgs-endpoint-gateways&format=markdown) are set for your virtual private endpoint.
* Understand the [limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-limitations&format=markdown) of VPC.
* Understand how to [view details](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown) about a virtual private endpoint.



## Setting up a VPE for VPC
{: #vpe-connection-setup}

To configure a virtual private endpoint in a region to enable connectivity to the IBM Cloud Logs Routing service, follow these steps:

1. Select the **Menu** icon ![Menu icon](../icons/icon_hamburger.svg "Menu"), and click **Infrastructure > VPC Layout > Network > Virtual private endpoint gateways**. Then, click **Create**.

    The **New virtual private endpoint gateway for VPC** page is displayed.

2. Enter the details of the gateway.

    - Enter a name.

    - Choose a resource group. By default, `default` is selected.

    - Add any tags and access management tags.

    - Select the Virtual Private Cloud that the gateway is attached to.

3. In the *Security groups* section, select at least one and at most five security groups to control traffic at the networking level.

4. In the *request connection to a service*, complete the following steps:

    - Select the *Cloud service offering* `IBM Cloud Logs Routing`.

    - Select a region. The VPE gateway region and the *Cloud service region* must be the same. For more information, see [Locations](https://cloud.ibm.com/docs/logs-router?topic=logs-router-locations&format=markdown).

    - Select an endpoint. You can configure a management and an ingestion VPE for IBM Cloud Logs Routing per region.

        For example, you can select `ingester.private.us-east.logs-router.cloud.ibm.com` to allow routing of logs within this region by using this VPE endpoint.

        When you create a VPE gateway by using the CLI or API, you must specify a [Cloud Resource Name (CRN)](https://cloud.ibm.com/docs/account?topic=account-crn&format=markdown) for IBM Cloud Logs Routing. Review the following tables for the available CRNs by region. You can configure a management and an ingestion VPE for IBM Cloud Logs Routing per region. For more information on CRN values, see [Cloud Resource Name (CRN) for IBM Cloud Logs Routing](https://cloud.ibm.com/docs/logs-router?topic=logs-router-vpe-connection-crn&format=markdown).

5. [Bind a reserved IP address](https://cloud.ibm.com/docs/vpc?topic=vpc-bind-unbind-reserved-ip&format=markdown) to the endpoint gateway.

6. View the created VPE gateway that is associated with the IBM Cloud Logs Routing. For more information, see [Viewing details of an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown).

Now from your VPC, you can access IBM Cloud Logs Routing privately through the gateway.

For more information, see [Create an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway&format=markdown).


## Using your VPE for IBM Cloud Logs Routing
{: #vpe-connection-using}

After you create an endpoint gateway for IBM Cloud Logs Routing, follow these steps to connect to IBM Cloud Logs Routing:

### Using the VPE with the IBM Cloud Logs Routing API
{: #vpe-connection-using-api}
{: api}

After creating an endpoint gateway for the IBM Cloud Logs Routing service, use the service endpoints FQDN `private.us-east.logs-router.cloud.ibm.com` in the URL to access the service.

For example:

```sh
curl -X GET -H "Authorization: Bearer ${IAM_TOKEN}" https://management.private.us-east.logs-router.cloud.ibm.com:443/v1/tenants
```
{: pre}


### More resources
{: #vpe-connection-other-resources}

- [Planning for virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-planning-considerations&format=markdown)
- [VPE connectivity patterns](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown#vpe-connectivity-patterns)
- [Creating an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway&format=markdown)
- For further assistance, see the [FAQ for virtual private endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-faqs-vpe&format=markdown).
- For troubleshooting VPE gateways, see other documentation  such as

    - [How to fix communications issues here](https://cloud.ibm.com/docs/vpc?topic=vpc-troubleshoot-cannot-communicate&format=markdown).

    - [Why can't my endpoint gateway reach the target IBM Cloud service?](https://cloud.ibm.com/docs/vpc?topic=vpc-troubleshoot-cannot-reach-target&format=markdown)

    - [Accessing your virtual private endpoint after setting up your endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-accessing-vpe-after-setup&format=markdown)