VPC Fundamentals
Virtual Private Clouds (VPCs) are the foundation of cloud networking. They provide isolated, logically-defined networks in the cloud with full control over IP addressing, routing, and security.
What is a VPC?
A VPC is a virtual network dedicated to your cloud account, isolated from other customers. You define:
- IP address range (CIDR block)
- Subnets (public/private)
- Route tables
- Gateways (Internet, NAT)
- Security (NACLs, Security Groups)
- Connectivity (Peering, VPN, Transit Gateway)
VPC Core Components
| Component |
Purpose |
| VPC CIDR |
IP range for the entire VPC (e.g., 10.0.0.0/16) |
| Subnets |
Subdivisions of VPC CIDR, placed in Availability Zones |
| Route Tables |
Define where traffic from subnets goes |
| Internet Gateway (IGW) |
Allows internet access for public subnets |
| NAT Gateway/Instance |
Allows outbound internet from private subnets |
| Security Groups |
Stateful firewall at instance level |
| Network ACLs (NACLs) |
Stateless firewall at subnet level |
| Elastic IP |
Static public IP address |
Public vs Private Subnets
| Type |
Route to Internet |
Use Case |
| Public Subnet |
Has route to IGW |
Load balancers, bastion hosts, NAT gateways |
| Private Subnet |
Routes through NAT Gateway or no internet |
Application servers, databases, internal services |
Typical Architecture
Internet → IGW → Public Subnet (ALB) → Private Subnet (App) → Private Subnet (DB)
↓
NAT Gateway (for outbound)
Security Groups vs NACLs
| Feature |
Security Group |
Network ACL |
| Level |
Instance/ENI level |
Subnet level |
| State |
Stateful (return traffic allowed automatically) |
Stateless (must allow both directions) |
| Rules |
Allow rules only |
Allow and deny rules |
| Evaluation |
All rules evaluated |
Rules evaluated in order (lowest first) |
| Scope |
Applied to instances |
Applied to all instances in subnet |
| Default |
Deny all inbound, allow all outbound |
Allow all inbound/outbound |
Route Table Example
Public subnet route table:
| Destination | Target |
|---|---|
| 10.0.0.0/16 | local (VPC internal) |
| 0.0.0.0/0 | igw-xxxxx (internet) |
Private subnet route table:
| Destination | Target |
|---|---|
| 10.0.0.0/16 | local |
| 0.0.0.0/0 | nat-xxxxx (outbound internet) |
VPC Connectivity Options
| Option |
Use Case |
Notes |
| VPC Peering |
Connect two VPCs |
Same region/account or cross-account, no transitive routing |
| Transit Gateway |
Connect many VPCs/on-prem |
Hub-and-spoke, transitive routing, scalable |
| Site-to-Site VPN |
Connect to on-prem over internet |
Encrypted, uses public internet |
| Direct Connect |
Dedicated connection to on-prem |
Private, consistent, more expensive |
| VPC Endpoints |
Private access to AWS services |
Avoid going through internet (Gateway/Interface endpoints) |
VPC Design Best Practices
| Practice |
Rationale |
| Use multiple AZs |
High availability and fault tolerance |
| Separate public/private |
Minimize attack surface |
| Plan CIDR carefully |
Avoid overlaps for peering/VPN |
| Use smallest subnets needed |
Leave room for growth |
| Enable VPC Flow Logs |
For troubleshooting and security analysis |
| Use Security Groups properly |
Least privilege access |
| NAT Gateway per AZ |
HA for NAT in each AZ |
| Avoid 0.0.0.0/0 to IGW for private |
Keep private truly private |
VPC for AI/Agent Systems
| Consideration |
Approach |
| Model endpoints |
Private subnets with VPC endpoints or NAT |
| GPU instances |
Private subnets, controlled egress |
| Vector DB |
Private, only accessible from app subnets |
| MCP servers |
Internal or exposed via API Gateway |
| Egress control |
Use NAT Gateway + monitoring for cost/control |
| Service mesh |
Consider for complex microservices |
Troubleshooting
| Issue |
Checks |
| Instance can't reach internet |
Subnet route to IGW? Public IP assigned? Security group allows outbound? NACL allows? |
| Can't reach private instance |
Security group rules, NACLs, route tables, instance in right subnet |
| VPC peering not working |
Route tables updated both ways? CIDR overlap? Security groups/NACLs allow |
| NAT Gateway issues |
Elastic IP attached? Route from private subnet to NAT? NAT in public subnet |
Sources
- AWS VPC User Guide
- AWS Well-Architected Framework - Security/Reliability Pillars
- Azure Virtual Network docs
- GCP VPC docs
- Kurose & Ross - Computer Networking
