Networking
What to know
A VCN is a regional CIDR block subdivided into regional subnets, each with its own route table and security lists. Traffic control has three layers: route tables decide where packets go (internet gateway, NAT gateway, service gateway, DRG, LPG), security lists filter at the subnet level, and network security groups (NSGs) filter at the VNIC level. Both filters are stateful, so return traffic is automatically allowed. A subnet is 'public' only because its route table points to an internet gateway; assigning a public IP is a separate decision.
Know the gateways: internet gateway for bidirectional public traffic, NAT gateway for outbound-only, service gateway for private access to OCI services such as Object Storage, DRG for on-premises VPN/FastConnect and transit routing, and LPG for direct VCN peering (non-transitive). Load balancers, bastion service, private endpoints, and DNS resolver rules complete the picture.
Traps
- Building a 'public' subnet with no 0.0.0.0/0 route to an internet gateway, then wondering why it is unreachable.
- Assuming LPG peering is transitive - it is not; use a DRG for hub-and-spoke or transit.
- Using security lists when per-instance rules are needed (use NSGs) or confusing the two in scenarios.
- Forgetting that a NAT gateway never accepts inbound connections.
Worked example
A private application subnet needs package downloads and Object Storage access. Create a route table with 0.0.0.0/0 to the NAT gateway for internet egress and a rule for the OCI Services CIDR to the service gateway. Attach an NSG allowing only the required outbound ports. No internet gateway is involved, so the subnet stays private.