Skip to content
Knowledge Hub/Article
Article

What Is a VPC (Virtual Private Cloud)? Subnets and Security

We explain how a VPC builds an isolated network in the cloud, subnets and routing, security groups versus network ACLs, and peering and VPN links.

Oğuzhan Gerçek··11 min read
What Is a VPC (Virtual Private Cloud)? Subnets and Security

Short answer: A VPC (virtual private cloud) is a virtual network that you define inside a cloud provider's infrastructure, logically isolated from other customers. Its address range is a CIDR block; the network is split into subnets, route tables decide where traffic goes, and security groups and network ACLs decide what is allowed through. An internet gateway and a NAT gateway connect it to the internet, peering or a transit gateway to other VPCs, and a site-to-site VPN or a private line to your on-premises network.

What is a VPC?

In AWS's definition, Amazon VPC lets you launch AWS resources in a logically isolated virtual network that you define, one that closely resembles a traditional network you would operate in your own data center. Google Cloud describes a VPC network as a virtual version of a physical network, and at Microsoft the same job is done by Azure Virtual Network (VNet).

The scope differs by provider. In AWS, a VPC spans all of the Availability Zones in a Region; in Azure, virtual networks and their subnets span all availability zones in a region; in Google Cloud, a VPC network is global while its subnets are regional. We cover cloud models in our cloud computing article, and there is a short definition in our glossary.

CIDR blocks and subnets: public and private

In CIDR notation, the number after the slash, as in /16, is according to RFC 4632 (August 2006) the number of significant bits that form the network part of the address. In AWS, a VPC's IPv4 block can range from /16 (65,536 addresses) to /28 (16 addresses), and AWS recommends the RFC 1918 private ranges we list in our LAN article. A subnet is a range of IP addresses in the VPC, and in AWS it must sit entirely within one Availability Zone. The basic distinction comes down to routing:

  • Public subnet: Has a direct route to an internet gateway.
  • Private subnet: Has no such route and needs a NAT device to reach the internet. AWS recommends private subnets to protect your resources.

Every subnet loses a few addresses to the provider: AWS and Azure reserve the first four addresses and the last one, and Google Cloud the first two and the last two.

Route tables, internet gateways and NAT gateways

As AWS puts it, a route table contains a set of rules, called routes, that determine where network traffic from your VPC is directed. A subnet that is not explicitly associated with another table uses the main route table, and every route table contains a local route for communication within the VPC (see our router article).

An internet gateway is a horizontally scaled, redundant VPC component that allows communication between your VPC and the internet. What makes a subnet public is a route to that gateway; the instance also needs a public IPv4 address or an Elastic IP address. For instances in private subnets, a NAT gateway is created in a public subnet: the instances can connect out, but external services cannot initiate a connection to them (see our NAT article). To reach AWS services without an internet gateway or a NAT device, you use a VPC endpoint.

Security groups vs network ACLs

AWS's comparison separates the two layers like this:

  • Security group: Acts as a virtual firewall at the instance level and takes allow rules only. It is stateful: the response to an allowed request gets through automatically.
  • Network ACL: Works at the subnet level, takes both allow and deny rules, and evaluates them in ascending order until one matches. It is stateless: return traffic must be explicitly allowed.

The cost of being stateless shows up in ephemeral ports. According to AWS, the client's operating system chooses the range: many Linux kernels use 32768-61000, while Windows Server 2008 and later use 49152-65535. Responses to connections that an instance starts come back to these ports, so if the network ACL does not allow that range, they never reach the subnet (see our port article). The default network ACL, for its part, allows all traffic in and out. In Azure, network security groups are stateful, and so are VPC firewall rules in Google Cloud (see our firewall article).

VPC peering and transit gateways

According to AWS, a VPC peering connection routes traffic between two VPCs using private IP addresses, and the two VPCs can belong to different accounts and Regions. Its limits shape the design: VPCs with overlapping CIDR blocks cannot be peered, each owner has to add routes manually, and peering is not transitive, so a VPC cannot reach its peer's peer through it.

AWS's multi-VPC networking whitepaper notes that a full mesh of 100 VPCs takes 4,950 peering connections. A transit gateway, by contrast, is a central hub that interconnects VPCs and on-premises networks: according to the whitepaper, each VPC connects only to it, and its route tables isolate traffic where needed. Azure and Google Cloud offer network peering as well, and Google's version does not provide transitive routing either.

Connecting to on-premises networks: site-to-site VPN and private lines

According to AWS, an IPsec Site-to-Site VPN connection consists of two tunnels between a virtual private gateway or transit gateway on the AWS side and a customer gateway device in your data center, and the two tunnels can be used simultaneously for high availability (see our VPN article).

On a private line, traffic stays off the internet. AWS Direct Connect links your internal network to a Direct Connect location over a standard Ethernet fiber-optic cable, bypassing internet service providers in your network path; in Azure, an ExpressRoute connection is private as well. Private does not mean encrypted, though: according to AWS, Direct Connect does not encrypt traffic in transit by default, so you either run a Site-to-Site VPN over the line or use MACsec up to the Direct Connect location. We handle connectivity design in our network and traffic engineering service.

Flow logs

According to AWS, VPC Flow Logs captures information about the IP traffic going to and from network interfaces in your VPC. A record holds the source and destination addresses and ports, the protocol, packet and byte counts, and whether the traffic was accepted or rejected (ACCEPT or REJECT). A flow log can be created for a VPC, a subnet or a network interface; it is not a real-time stream, and because the data is collected outside the path of your traffic, it does not affect throughput or latency. Google Cloud's flow logs, by contrast, are built from sampled packets and do not capture every packet.

The March 2024 NSA and CISA guidance on network segmentation and encryption in the cloud says traffic flow logs should be enabled because they are useful for threat hunting. We cover retention in our log article and correlation in our SIEM and SOC article.

VPC vs private cloud vs VLAN

In NIST's SP 800-145 (September 2011), a private cloud is infrastructure provisioned for exclusive use by a single organization, while a public cloud is provisioned for open use by the general public. A VPC lives inside the second model, and its isolation is logical. We explain the difference in our private cloud article and what it means for banks in Türkiye in our BDDK article; there is a short definition in the glossary.

A VLAN, on the other hand, lives in switching infrastructure: according to RFC 7348, its 12-bit VLAN ID divides a Layer 2 network into separate broadcast domains (see our VLAN article). A VPC has no broadcast domain in that sense: AWS, Azure and Google Cloud do not support broadcast in their virtual networks.

Common VPC design mistakes

  1. Overlapping IP blocks: According to Microsoft, you can link a virtual network to other virtual networks and to on-premises networks only as long as the CIDR blocks don't overlap; in AWS, too, overlapping VPCs cannot be peered. Plan your blocks together with your on-premises networks.
  2. Overly broad rules: According to AWS, allowing SSH or RDP access from anywhere is acceptable for a short time in a test environment but unsafe in production, and MITRE ATT&CK lists both among the services commonly targeted by password guessing (see our brute force article). Instead of an IP range, a rule can reference another security group as its source.
  3. Putting everything in public subnets: The subnets of the default VPC that AWS provides in each Region are public, and AWS describes that VPC as suitable for getting started quickly and for simple public workloads such as a blog. Resources such as databases belong in private subnets (see our DBaaS article).

NSA and CISA advise that if two applications do not need to communicate, there should be no communication path between them (see our network security article). We handle the rules in our network security service and VPC operations in our cloud platforms service.

Frequently asked questions

What does VPC stand for? Virtual private cloud: a virtual network that you define in the cloud, logically isolated from other customers.

What is an AWS VPC? Amazon VPC is the virtual networking service of AWS. A VPC spans all the Availability Zones in a Region, while each subnet sits in a single zone.

What is a subnet? A range of IP addresses inside a VPC. A subnet with a route to an internet gateway is public; one without such a route is private.

What is a security group? A stateful virtual firewall for instances that takes allow rules only. A network ACL, by contrast, applies at the subnet level and is stateless.

What is VPC peering? A connection that links two VPCs over private IP addresses. VPCs with overlapping CIDR blocks cannot be peered, and peering is not transitive.

What does a NAT gateway do? It lets instances in a private subnet connect to services outside the VPC, while external services cannot initiate connections to them.

Sources