# VPC Fundamentals

Virtual Private Clouds (VPCs) are the foundation of cloud networking. They provide isolated, logically-defined networks in the cloud with full control over IP addressing, routing, and security.

## What is a VPC?

A VPC is a virtual network dedicated to your cloud account, isolated from other customers. You define:
- IP address range (CIDR block)
- Subnets (public/private)
- Route tables
- Gateways (Internet, NAT)
- Security (NACLs, Security Groups)
- Connectivity (Peering, VPN, Transit Gateway)

## VPC Core Components

| Component | Purpose |
|---|---|
| **VPC CIDR** | IP range for the entire VPC (e.g., 10.0.0.0/16) |
| **Subnets** | Subdivisions of VPC CIDR, placed in Availability Zones |
| **Route Tables** | Define where traffic from subnets goes |
| **Internet Gateway (IGW)** | Allows internet access for public subnets |
| **NAT Gateway/Instance** | Allows outbound internet from private subnets |
| **Security Groups** | Stateful firewall at instance level |
| **Network ACLs (NACLs)** | Stateless firewall at subnet level |
| **Elastic IP** | Static public IP address |

## Public vs Private Subnets

| Type | Route to Internet | Use Case |
|---|---|---|
| **Public Subnet** | Has route to IGW | Load balancers, bastion hosts, NAT gateways |
| **Private Subnet** | Routes through NAT Gateway or no internet | Application servers, databases, internal services |

### Typical Architecture
```
Internet → IGW → Public Subnet (ALB) → Private Subnet (App) → Private Subnet (DB)
                                        ↓
                                    NAT Gateway (for outbound)
```

## Security Groups vs NACLs

| Feature | Security Group | Network ACL |
|---|---|---|
| **Level** | Instance/ENI level | Subnet level |
| **State** | Stateful (return traffic allowed automatically) | Stateless (must allow both directions) |
| **Rules** | Allow rules only | Allow and deny rules |
| **Evaluation** | All rules evaluated | Rules evaluated in order (lowest first) |
| **Scope** | Applied to instances | Applied to all instances in subnet |
| **Default** | Deny all inbound, allow all outbound | Allow all inbound/outbound |

## Route Table Example

**Public subnet route table:**
| Destination | Target |
|---|---|
| 10.0.0.0/16 | local (VPC internal) |
| 0.0.0.0/0 | igw-xxxxx (internet) |

**Private subnet route table:**
| Destination | Target |
|---|---|
| 10.0.0.0/16 | local |
| 0.0.0.0/0 | nat-xxxxx (outbound internet) |

## VPC Connectivity Options

| Option | Use Case | Notes |
|---|---|---|
| **VPC Peering** | Connect two VPCs | Same region/account or cross-account, no transitive routing |
| **Transit Gateway** | Connect many VPCs/on-prem | Hub-and-spoke, transitive routing, scalable |
| **Site-to-Site VPN** | Connect to on-prem over internet | Encrypted, uses public internet |
| **Direct Connect** | Dedicated connection to on-prem | Private, consistent, more expensive |
| **VPC Endpoints** | Private access to AWS services | Avoid going through internet (Gateway/Interface endpoints) |

## VPC Design Best Practices

| Practice | Rationale |
|---|---|
| **Use multiple AZs** | High availability and fault tolerance |
| **Separate public/private** | Minimize attack surface |
| **Plan CIDR carefully** | Avoid overlaps for peering/VPN |
| **Use smallest subnets needed** | Leave room for growth |
| **Enable VPC Flow Logs** | For troubleshooting and security analysis |
| **Use Security Groups properly** | Least privilege access |
| **NAT Gateway per AZ** | HA for NAT in each AZ |
| **Avoid 0.0.0.0/0 to IGW for private** | Keep private truly private |

## VPC for AI/Agent Systems

| Consideration | Approach |
|---|---|
| **Model endpoints** | Private subnets with VPC endpoints or NAT |
| **GPU instances** | Private subnets, controlled egress |
| **Vector DB** | Private, only accessible from app subnets |
| **MCP servers** | Internal or exposed via API Gateway |
| **Egress control** | Use NAT Gateway + monitoring for cost/control |
| **Service mesh** | Consider for complex microservices |

## Troubleshooting

| Issue | Checks |
|---|---|
| **Instance can't reach internet** | Subnet route to IGW? Public IP assigned? Security group allows outbound? NACL allows? |
| **Can't reach private instance** | Security group rules, NACLs, route tables, instance in right subnet |
| **VPC peering not working** | Route tables updated both ways? CIDR overlap? Security groups/NACLs allow |
| **NAT Gateway issues** | Elastic IP attached? Route from private subnet to NAT? NAT in public subnet |

## Related Notes

- [[Security/Network-Security-Fundamentals.md]] — Security Groups vs NACLs
- [[Routing/Routing-Fundamentals.md]] — Routing concepts
- [[Automation-Observability/Packet-Analysis-Wireshark.md]] — VPC Flow Logs analysis
- [[../AgenticEngineering/Production/Deployment-Architecture.md]] — Deployment patterns

## Sources

* AWS VPC User Guide  
* AWS Well-Architected Framework - Security/Reliability Pillars  
* Azure Virtual Network docs  
* GCP VPC docs  
* Kurose & Ross - *Computer Networking*