4.1 Virtual networks and subnets

What this is and why it exists

A virtual network is your own private slice of the provider's network: address ranges you choose, subnets you divide them into, and rules about what can reach what. It is the difference between a database that is protected by a password and a database that is not reachable at all — and the second is the one that survives the password being leaked. Most cloud data leaks are network mistakes, and this is where they are prevented.

The vocabulary

• Virtual network — your isolated network inside the provider. Amazon calls it a VPC, Azure calls it a Virtual Network or VNet, Google calls it a VPC Network.
• Subnet — a slice of the network's address range, usually placed in one availability zone.
• Public subnet — one whose route table sends internet-bound traffic to an internet gateway.
• Private subnet — one with no such route, so nothing in it is reachable from the internet.
• Route table — the list of rules saying which traffic leaves by which door.
• Internet gateway — the door between a virtual network and the internet, in both directions.
• NAT gateway — a one-way door: machines in a private subnet can reach out, nothing can reach in.
• Address space — the CIDR block the whole network occupies, chosen at creation and painful to change.

The mental model

"Public" and "private" are not a checkbox on a machine. They are a property of the subnet's route table, and that is the single most useful sentence in this topic. A machine is reachable from the internet because the subnet it sits in has a route to an internet gateway and it has a public address; it is unreachable because that route does not exist. Nothing about the machine itself changes.

From that follows the standard three-tier layout, which you should be able to draw from memory. A public subnet holds only the things that must face the world — a load balancer, perhaps a bastion host. A private subnet holds the application servers. Another private subnet holds the database. Traffic enters at the load balancer, is passed inward, and the database is reachable only from the application tier. If a credential leaks, the attacker still has to be inside the network to use it, and that is a very different afternoon from one where the database answers the whole internet.

The NAT gateway is what makes the private tier practical. Private machines still need outbound access — to fetch operating-system updates, to call an external interface — and NAT gives them exactly that: connections they start can go out and receive replies, while connections started from outside have nowhere to arrive. Two things are worth knowing about it. It costs money, both per hour and per gigabyte, and it is a common surprise on a first bill. And it is a single point of failure per zone unless you place one in each zone, which is exactly the sort of detail that turns one zone's bad day into a whole-system outage.

Then address planning, which is boring and permanent, so it is worth ten minutes now rather than a migration later. Choose a private range large enough for growth — a /16 gives you room for many /24 subnets — and divide it deliberately: a block per environment, a block per zone within that, and space left between them. Two rules save real pain. Never overlap with anything you might one day connect to: two networks with the same range cannot be joined, and this is how office networks, other accounts and acquired companies become month-long projects. And do not size subnets by today's machine count — the cost of a subnet larger than you need is nothing, and the cost of one too small is renumbering things that are already running.

What you should now be able to explain or do

Say what actually makes a subnet public, and why the answer is not on the machine. Draw a three-tier network and mark which tier holds which component and where traffic enters. Explain what a NAT gateway permits and forbids, and name its two costs. Choose an address range for a new network and defend the size, including one reason not to reuse a common range. Say what breaks when two networks you want to join have overlapping ranges.

Check yourself