Cloud Fundamentals
Intermediate 16 min read Cloud Fundamentals

Virtual Networks: VPCs & Subnets

A VPC is your private network inside the cloud. Learn CIDR planning, public and private subnets, internet gateways, NAT, route tables and how AWS, Azure and Google Cloud model the same concepts.

VPCsubnetCIDRroute tableinternet gatewayNAT gatewayavailability zonesecurity group
Prerequisites: Cloud Computing Fundamentals Virtualization & Containers
Introduction

What is this?

A Virtual Private Cloud (VPC) is an isolated, software-defined network inside a cloud region, defined by a CIDR block. You divide it into subnets (usually one per availability zone), attach internet gateways, and control traffic with route tables, NACLs and security groups. AWS calls the object a VPC, Azure calls it a virtual network (VNet), and Google Cloud offers a shared VPC across projects.

Motivation

Why do you need it?

  • Every resource you deploy — VMs, databases, load balancers, Kubernetes clusters — lives in a VPC and subnet.
  • Public versus private subnet design decides what can reach the internet and what can be reached from it.
  • Routing mistakes are the number one cause of 'it worked in dev, breaks in prod' cloud incidents.
  • Security in the cloud is largely network security: subnets, security groups and route tables are your blast-radius controls.
  • The three major providers model VPCs slightly differently; knowing the mapping lets you move between clouds.
Think about it

Mental model

Imagine

A gated office campus

Think of

A VPC

The campus fence is the VPC boundary. Streets are subnets, each block a range of addresses. The front gate is the internet gateway — the only way in or out. Guards at each door (security groups) decide who may enter a specific building, while signs (route tables) tell drivers which street to take. Rooms with no window to the street are the private subnets.

Mechanics

How it works

  • You pick a private CIDR block (RFC 1918) for the VPC, then carve it into subnets aligned to availability zones.
  • Each subnet gets its own route table; a route 0.0.0.0/0 to an internet gateway makes it public, and one to a NAT gateway gives outbound-only internet.
  • An internet gateway is the provider-managed gateway that translates and forwards traffic between your VPC and the internet.
  • A NAT gateway or NAT instance lets private-subnet resources make outbound calls while exposing no inbound entry points.
  • Stateful security groups filter traffic per instance or ENI at the boundary, while stateless NACLs filter at the subnet edge.

Public and private subnets inside a VPC.

VPC 10.0.0.0/16
Internet gateway
Public subnet 10.0.1.0/24
NAT gateway
Private subnet 10.0.2.0/24
Route tables + security groups
Reference

Key commands

terraform init

Download the providers and initialize the working directory.

terraform validate

Check the HCL configuration for syntax and internal consistency.

terraform plan

Show the diff between current state and what would be applied.

terraform apply -auto-approve

Create the VPC, subnets and routing resources.

ping -c 4 8.8.8.8

Verify outbound internet from a public-subnet host.

Hands-on

Examples

Define a VPC, subnets and routing in Terraform

Define a VPC, subnets and routing in Terraform
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
}
 
resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "us-east-1a"
  map_public_ip_on_launch = true
}
 
resource "aws_subnet" "private" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = "us-east-1b"
}
 
resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id
}
 
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }
}
 
resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}

The VPC gets a /16, the public subnet a /24 that assigns public IPs and routes 0.0.0.0/0 through the internet gateway, and the private subnet has no internet route — it would talk outbound only if a NAT gateway route were added. Everything is declarative and reproducible.

Real world

In production

  • Place web and load balancers in public subnets, and databases and workers in private subnets reachable only internally.
  • Spread subnets across availability zones so an AZ failure takes out only one slice of the app.
  • Peer VPCs or use transit gateways to connect environments while keeping each blast radius small.
  • Route private traffic to provider-managed services (databases, queues) over service endpoints instead of the public internet.
Guidelines

Best practices

  • Reserve generous CIDR blocks up front — growing a VPC later means renumbering everything.
  • Keep at least two subnets per tier, spread across availability zones.
  • Default to private subnets; only public resources get direct internet routes.
  • Do networking in infrastructure as code and review it like application code.
Watch out

Common mistakes

  • Using overlapping CIDRs between VPCs that later need to be peered.
  • Attaching a route table to a subnet but forgetting the association, so traffic falls back to the main table.
  • Putting a database in a public subnet because the dev team needs to connect from home.
  • Assuming security groups apply at the subnet level — they attach to instances or ENIs.
Root cause analysis

Common issues

Error
Instance cannot reach the internet from a 'public' subnet
Root cause

No 0.0.0.0/0 route to an internet gateway, no public IP, or the gateway is missing.

Fix

Confirm a public IP is assigned, the subnet route table has 0.0.0.0/0 -> IGW, and the internet gateway exists.

Error
Database in a private subnet cannot make outbound calls
Root cause

Private subnet has no NAT route, so outbound-only traffic has nowhere to go.

Fix

Create a NAT gateway in a public subnet and add 0.0.0.0/0 -> NAT to the private subnet's route table.

Error
Two instances in the same VPC cannot talk to each other
Root cause

The security group attached to the target blocks the source, or both are in different subnets without a route.

Fix

Check security group rules allow the source's group or IP, and verify subnet route tables cover the path.

When things break

Debugging tips

  • Trace the path: ping the instance's private IP, then the NAT or gateway, then the public internet.
  • Check both the subnet route table and the main route table — associations are easy to miss.
  • Test TCP, not just ICMP; many cloud firewalls drop ping but allow the service port.
  • Read the route table for 0.0.0.0/0 — if it points at the wrong target, all outbound traffic fails.
Interviews

Interview checkpoint

Practice

Hands-on lab

Provision a VPC and Subnet with Terraform
30 min · intermediate
In progress
Objectives
  • Write a Terraform config declaring a VPC, subnet and route
  • Initialize and validate the configuration
  • Review the plan before applying
  • Apply the change and confirm success

Provision a VPC and Subnet with Terraform

30 min · intermediate

0/6 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/3
1

Which resource controls how traffic leaving a subnet is routed?

2

Which of these CIDR blocks is a private (RFC 1918) range suitable for a VPC?

3

A subnet becomes public when its route table has a route to an internet gateway.

Quick reference

Cheat sheet

VPC building blocks
VPC 10.0.0.0/16Regional private network, your address space
Subnet 10.0.1.0/24One per tier, mapped to an availability zone
Internet gateway0.0.0.0/0 route target for public traffic
NAT gatewayOutbound-only internet for private subnets
Route tableMaps destination CIDRs to next hops
Provider equivalents
AWS VPCVPC + subnets + IGW + NAT + security groups
Azure VNetVirtual network + subnets + NSGs
GCP VPCShared VPC with regional subnets + firewall rules
CIDR planningAlways leave room: /16 minimum, subnets /24 or /20
Go deeper

Official documentation

AWS: What Is Amazon VPC?
docs
AWS: VPCs and Subnets
docs
Azure: Virtual Network Overview
docs
Google Cloud: VPC Networks
docs
Classless Inter-Domain Routing — RFC 4632
rfc