NetworkTools
Sign In
1VPC Design2Security Groups & NACLs3Virtual Routers4Hybrid Connectivity5Cloud Load Balancing6Cloud DNS & CDN7Container Networking
← Back to Cloud Networking

Learning Objectives

  • Design a VPC with public and private subnets
  • Size CIDR blocks for real-world requirements
  • Understand route tables, IGW, and NAT Gateway placement

What is a VPC?

A Virtual Private Cloud (VPC) is your own isolated network inside a public cloud. Think of it as a data center that exists entirely in software — you control the IP address range, subnets, route tables, and gateways. Every major cloud provider (AWS, Azure, GCP) offers VPCs as the foundation of their networking model.

CIDR Sizing for VPCs

When designing a VPC, the first decision is the CIDR block. Common ranges use the private IP space defined in RFC 1918:

| VPC Size | CIDR | Usable /24s | Use Case | |----------|------|-------------|----------| | Large | 10.0.0.0/8 | 65,536 | Enterprise, multi-region | | Medium | 10.0.0.0/16 | 256 | Typical production | | Small | 10.0.0.0/20 | 16 | Dev/test, single app | | Tiny | 10.0.0.0/24 | 1 | Prototype, sandbox |

Avoid overlapping CIDRs. If you ever need to connect VPCs (via peering or Transit Gateway), overlapping ranges force complex NAT translations or break connectivity entirely.

Public vs Private Subnets

A well-designed VPC divides subnets into two tiers:

Public subnets have a route to an Internet Gateway (IGW). They contain load balancers, bastion hosts, and NAT Gateways. These subnets should never hold application servers or databases.

Private subnets route through a NAT Gateway or VPC endpoint for outbound internet access. Application servers, workers, and databases live here. No direct inbound from the internet.

VPC with Public and Private Subnets

Internet routeInternet GatewayVPC 10.0.0.0/16Public Subnet A 10.0.1.0/24Public Subnet B 10.0.2.0/24NAT GatewayPrivate Subnet A 10.0.10.0/24Private Subnet B 10.0.11.0/24ALBApp ServersRDS

High-Availability Design

Deploy subnets in at least two Availability Zones (AZs). Each AZ gets its own public and private subnet. This ensures that if one AZ fails, your application continues serving from the other. Load balancers distribute traffic across AZs automatically.

Route Tables

Each subnet must be associated with a route table. The main route table handles VPC-local traffic (the local route is always present). Public subnets add a route 0.0.0.0/0 → IGW. Private subnets add 0.0.0.0/0 → NAT Gateway.

You need to design a VPC for three tiers: web (2 subnets, 32 addresses each), app (2 subnets, 64 addresses each), and database (2 subnets, 16 addresses each). All subnets must span 2 AZs. What is the smallest /xx prefix that fits all subnets?

CIDR Sizing

Which component allows private subnet instances to download updates from the internet?

What is the most important rule when choosing a VPC CIDR block?

Key Takeaways

  • A VPC is a software-defined data center — you control IPs, subnets, and routing
  • Always design subnets across multiple AZs for HA
  • Public subnets route to IGW; private subnets route through NAT Gateway
  • CIDR overlap is the #1 mistake — plan ahead for connectivity
  • The smallest prefix that fits your total address count is not always best; leave room for growth
NextSecurity Groups & NACLs