diff --git a/core/installer/welcome/env-manager-tmpl/form.html b/core/installer/welcome/env-manager-tmpl/form.html
index c0f0d4a..297a426 100644
--- a/core/installer/welcome/env-manager-tmpl/form.html
+++ b/core/installer/welcome/env-manager-tmpl/form.html
@@ -11,7 +11,7 @@
 	<div style="border-width: 1px; border-right-style: solid;">
 		As part of provisioning new dodo instance you will have to update DNS records at your domain registrar, so that it points to the nameservers running on your newly created dodo. Please first get familiar with your domain registrar documentation, and only then proceed with provisioning.
 		<label for="accept" style="padding-top: 1rem;">
-			<input type="checkbox" name="accept" id="accept" form="create-form" required tabindex="5">
+			<input type="checkbox" name="accept" id="accept" form="create-form" required tabindex="6">
 			<strong>I understand</strong>
 		</label>
 	</div>
@@ -28,6 +28,16 @@
 					tabindex="1"
 				/>
 			</label>
+			<label for="private-network">
+				private network subdomain (optional)
+				<input
+					type="text"
+					id="private-network-subdomain"
+					name="private-network-subdomain"
+					placeholder="configure to create private network"
+					tabindex="2"
+				/>
+			</label>
 			<label for="contact-email">
 				contact email
 				<input
@@ -35,7 +45,7 @@
 					id="contact-email"
 					name="contact-email"
 					required
-					tabindex="2"
+					tabindex="3"
 				/>
 			</label>
 			<label for="admin-public-key">
@@ -45,7 +55,7 @@
 					id="admin-public-key"
 					name="admin-public-key"
 					required
-					tabindex="3"
+					tabindex="4"
 				/> <!-- TODO(gio): remove-->
 			</label>
 			<label for="secret-token">
@@ -54,7 +64,7 @@
 					id="secret-token"
 					name="secret-token"
 					required
-					tabindex="4"
+					tabindex="5"
 				></textarea>
 			</label>
 			<button type="submit" tabindex="6">provision</button>
diff --git a/core/installer/welcome/env.go b/core/installer/welcome/env.go
index 949cbe0..4c084cd 100644
--- a/core/installer/welcome/env.go
+++ b/core/installer/welcome/env.go
@@ -239,11 +239,12 @@
 }
 
 type createEnvReq struct {
-	Name           string
-	ContactEmail   string `json:"contactEmail"`
-	Domain         string `json:"domain"`
-	AdminPublicKey string `json:"adminPublicKey"`
-	SecretToken    string `json:"secretToken"`
+	Name                    string
+	ContactEmail            string `json:"contactEmail"`
+	Domain                  string `json:"domain"`
+	PrivateNetworkSubdomain string `json:"privateNetworkSubdomain"`
+	AdminPublicKey          string `json:"adminPublicKey"`
+	SecretToken             string `json:"secretToken"`
 }
 
 func (s *EnvServer) readInvitations() ([]invitation, error) {
@@ -295,6 +296,9 @@
 		if req.Domain, err = getFormValue(r.PostForm, "domain"); err != nil {
 			return err
 		}
+		if req.PrivateNetworkSubdomain, err = getFormValue(r.PostForm, "private-network-subdomain"); err != nil {
+			return err
+		}
 		if req.ContactEmail, err = getFormValue(r.PostForm, "contact-email"); err != nil {
 			return err
 		}
@@ -385,11 +389,15 @@
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
+	privateDomain := ""
+	if req.PrivateNetworkSubdomain != "" {
+		privateDomain = fmt.Sprintf("%s.%s", req.PrivateNetworkSubdomain, req.Domain)
+	}
 	env := installer.EnvConfig{
 		Id:              req.Name,
 		InfraName:       infra.Name,
 		Domain:          req.Domain,
-		PrivateDomain:   fmt.Sprintf("p.%s", req.Domain),
+		PrivateDomain:   privateDomain,
 		ContactEmail:    req.ContactEmail,
 		AdminPublicKey:  req.AdminPublicKey,
 		PublicIP:        infra.PublicIP,
diff --git a/core/installer/welcome/env_test.go b/core/installer/welcome/env_test.go
index 4acc576..1c18470 100644
--- a/core/installer/welcome/env_test.go
+++ b/core/installer/welcome/env_test.go
@@ -297,11 +297,12 @@
 	go s.Start()
 	time.Sleep(1 * time.Second) // Let server start
 	req := createEnvReq{
-		Name:           "test",
-		ContactEmail:   "test@test.t",
-		Domain:         "test.t",
-		AdminPublicKey: "test",
-		SecretToken:    "test",
+		Name:                    "test",
+		ContactEmail:            "test@test.t",
+		Domain:                  "test.t",
+		PrivateNetworkSubdomain: "p",
+		AdminPublicKey:          "test",
+		SecretToken:             "test",
 	}
 	var buf bytes.Buffer
 	if err := json.NewEncoder(&buf).Encode(req); err != nil {