A method for traffic engineering of connectionless virtual private network (VPN) services that includes receiving physical connectivity data for a connectionless VPN. The data includes service nodes and links between the service nodes. One or more of the service nodes are also edge nodes. Logical connectivity data for the edge nodes is received. A restricted topology is created in response to the physical connectivity data and to the logical connectivity data. The restricted topology includes a single path between each pair of the edge nodes and each path includes a plurality of the service nodes and one or more of the links. A bandwidth requirement for each link in the restricted topology is calculated. The bandwidth requirement is reserved on each link in the restricted topology. The method further comprises directing routing software to force a packet received from an edge node through one of the paths in the restricted topology.