1. An on-demand, self-configured virtual network comprising: a central on-demand virtual network (VN) configuration server, for authenticating a subscriber in a plurality of subscribers, receiving a configuration request from a subscriber to add a new node to a plurality of nodes in a virtual network from the subscriber; a VN configuration database storing virtual-network configurations for a plurality of virtual networks for the plurality of subscribers; a virtual-network configuration process on the central on-demand VN configuration server, the virtual-network configuration process updating a virtual-network configuration for the subscriber in response to the configuration request; a VN configuration controller generating an updated virtual-network configuration when the VN configuration database is updated by the virtual-network configuration process, the VN configuration controller broadcasting the updated virtual-network configuration to a plurality of virtual-machine nodes in a virtual network for the subscriber; a plurality of nodes in the virtual network, the plurality of nodes including physical nodes and virtual-machine nodes located at multiple physical locations and connected to multiple physical local networks coupled together by an Internet; wherein each node in the plurality of nodes in the virtual network comprises: a virtual network management daemon that receives the updated virtual-network configuration broadcast by the VN configuration controller; a VN switch table storing network entries for all nodes in the plurality of nodes on the virtual network, the VN switch table storing virtual network addresses and physical network addresses; wherein the virtual network management daemon updates the VN switch table with the updated virtual-network configuration; a network stack that receives data and a virtual network address from an application and generates a virtual frame from the data and the virtual network address; a network interface controller (NIC) that transmits a physical frame over a physical local-area network to a physical network address; and a VN device driver shim that intercepts the virtual frame from the network stack, searches the VN switch table for the virtual network address, generates a physical header with the physical network address generated using translation information from the VN switch table, and sends the physical frame to the NIC by attaching the physical header to the virtual frame, whereby subscribers configure their own virtual networks that span multiple physical networks and the Internet.