VPC Basics
Your private network, carved out of the cloud
A Virtual Private Cloud is your isolated slice of the cloud's network. CIDR, subnets, gateways and routing define what your resources can reach and who can reach them.
What you will learn
- Explain what a VPC is and why it exists
- Design a CIDR plan that leaves room to grow
- Map subnets, gateways and route tables to a workload
A VPC is a private network in the cloud: choose an IP range (CIDR), break it into subnets, wire gateways and route tables, and decide where traffic is allowed. Everything you deploy lives inside it.
What is this?
A VPC (AWS) / VNet (Azure) / VPC (GCP) is a software-defined private network inside a cloud region. You pick an IP range (e.g. 10.0.0.0/16), allocate subnets for public/private workloads, and control traffic with route tables, gateways (Internet Gateway, NAT, VPN) and security layers (security groups / NSGs / firewall rules). GCP's VPCs are global; AWS/Azure VNets are regional and need peering for cross-region.
Why do you need it?
- Every instance, database and function lives on a network — the network is the perimeter you actually control.
- Design mistakes here (overlapping CIDRs, open rules) ripple into every later failure.
- Interview architecture questions reduce to a VPC diagram.
- Egress and data-transfer costs are network decisions, not compute decisions.
Mental model
An office building with a sign and gates
A VPC network
The building's address and floors (CIDR), entrance doors (gateways), and who may pass each door (routing + security) are all your decisions. A misconfigured door is an intrusion vector.
How it works
- You allocate a private CIDR for the VPC; AWS/Azure reserve a few addresses per subnet.
- Subnets segment the VPC by zone and function: public (with gateways) vs private (no inbound internet).
- Route tables direct packets: local subnets route internally, 0.0.0.0/0 goes to a gateway.
- Internet Gateway / NAT / VPN provide egress and hybrid paths.
- Security groups/NSGs/firewall rules filter by resource or subnet, defaulting to deny.
Anatomy of a VPC.
In production
- A web app puts an ALB in public subnets, app servers in private subnets, and RDS in isolated subnets with no internet path.
- A data platform peers a hub VPC to spoke VPCs for shared monitoring and NVA inspection.
- A compliance workload uses private subnets with VPC endpoints so nothing leaves the AWS backbone.
Best practices
- Plan CIDR ranges before building; reserve room for growth and avoid overlap with on-prem.
- Start with least access: private subnets, outbound-only egress, closed security groups.
- Name subnets by function+zone (app-us-east-1a) so diagrams stay readable.
- Put state near compute in the same region/AZ to keep latency low.
Common mistakes
- Using default subnets and default security groups, inheriting openness.
- Overlapping CIDRs between VPCs that must peer/VPN later.
- One giant subnet with no segmentation — security groups drift and audits fail.
- Private subnets with no egress path, then surprise firewall errors.
Common issues
No connectivity between two subnetsRoute table gap, NACL/NSG deny, or peering not wired
Verify both route tables have entries for the other CIDR and security allows the port.
Internet calls from private subnet time outNo NAT and no egress route
Route 0.0.0.0/0 through a NAT gateway in a public subnet, or add VPC endpoints.
Debugging tips
- Walk the path: route table → gateway → security group → resource's listener.
- Use VPC reachability/flow analyzers to name the blocking rule instead of guessing.
- Check whether traffic is denied at network layer (timeout) vs resource layer (connection reset).
- Confirm DNS resolution/private DNS is configured before blaming routing.
Interview checkpoint
Hands-on lab
- Allocate a VPC CIDR with headroom
- Carve subnets across tiers
- Validate the plan with an IP calculator
Plan a VPC CIDR and Subnet Layout
25 min · beginner
Quick quiz
What does a route table entry '0.0.0.0/0 → Internet Gateway' express?
A subnet in a VPC automatically has internet access unless you remove it.