Cloud Connectivity and VPCs

When you build in the public cloud, you do not just get servers, you get a network too. A VPC (Virtual Private Cloud) is a logically isolated section of a provider cloud where you place your resources. It is your private network in someone else data center.

Other tenants share the same physical hardware, but your VPC keeps your traffic and addressing separate from everyone else.

You define your VPC with a private IP address range using CIDR (Classless Inter-Domain Routing) notation, such as 10.0.0.0/16. This block becomes the address space for all resources you launch inside it.

Just like an on-premises network, you choose private ranges (10.x, 172.16-31.x, or 192.168.x) so the VPC can later connect cleanly to your office network without address conflicts.

Inside a VPC you carve out subnets, smaller address ranges that typically map to availability zones (separate data centers) for resilience.

• Public subnets: resources here can reach the internet.
• Private subnets: resources have no direct internet route, ideal for databases.

Placing web servers in public subnets and databases in private ones is a common, secure design.

An internet gateway connects a VPC to the public internet, giving public subnets inbound and outbound access. A NAT gateway lets private-subnet resources reach out to the internet (for updates) without allowing unsolicited inbound connections.

This pairing keeps back-end servers patched and able to call out while staying hidden from the internet, a key cloud security pattern.

Each subnet uses a route table that tells traffic where to go. A route pointing 0.0.0.0/0 (all destinations) at an internet gateway makes a subnet public; pointing it at a NAT gateway keeps it private.

Route tables are how the cloud reproduces traditional routing decisions in software. Misconfigured routes are a common reason cloud resources cannot reach the internet or each other.

Two firewall layers protect VPC traffic:

• Security groups: stateful firewalls attached to each instance; if you allow traffic out, replies are allowed back automatically.
• NACLs (Network Access Control Lists): stateless rules at the subnet level that filter traffic in both directions.

Together they let you control exactly which ports and sources can reach your cloud resources.

VPC peering connects two VPCs so resources can communicate using private addresses, as if on one network. It is useful for linking environments, teams, or regions privately without traffic crossing the public internet.

Peering is non-transitive: if VPC A peers with B, and B peers with C, A still cannot reach C directly. Each link must be made explicitly.

For heavy or sensitive traffic, providers offer dedicated private connections, like AWS Direct Connect or Azure ExpressRoute, that bypass the public internet entirely. They deliver consistent low latency, high bandwidth, and better security than an internet path.

Enterprises use these when reliability and predictable performance to the cloud are mission-critical, accepting the extra cost for a guaranteed link.

A common, lower-cost option is a site-to-site VPN: an encrypted tunnel over the public internet linking your office network to your VPC. Traffic is protected by encryption (often IPsec) as it crosses the internet.

It is cheaper and faster to set up than a dedicated circuit, though performance depends on the public internet rather than a guaranteed private path.

VPCs prove that cloud networking is still networking. You design subnets, write route tables, apply firewalls, and connect sites, just in software through a console or API. The familiar concepts of IP addressing, routing, and segmentation map directly onto cloud constructs.

A network technician who understands subnets and routing already understands most of what a VPC requires.

A VPC gives you a private address space split into public and private subnets, wired by route tables to internet and NAT gateways, and protected by security groups and NACLs. You link VPCs with peering and connect to your offices over site-to-site VPNs or dedicated circuits, recreating a full enterprise network entirely in the cloud.

Test your VPC knowledge.

A VPC is your isolated private network in the cloud, defined by a CIDR address range and split into public and private subnets. Route tables direct traffic to internet and NAT gateways, while security groups and NACLs filter it. You connect VPCs with peering and reach them over site-to-site VPNs or dedicated circuits.