use private subnet instead of ips