VPC Networking Basics: Subnets, Security Groups and the Private Path

A surprising proportion of cloud security incidents come down to one sentence: something was reachable from the internet that had no reason to be.

Virtual private cloud networking is how you make that structurally impossible rather than relying on remembering to configure a firewall.

The building blocks

VPC / VNet / private network — an isolated network inside the provider's infrastructure with an address range you choose, typically from RFC 1918 space such as 10.0.0.0/16.

Subnets divide that range. A subnet is public if its route table sends internet-bound traffic to an internet gateway, and private if it does not. That routing decision, not a label, is what makes the difference.

Route tables decide where traffic goes. They are the mechanism behind public and private.

Internet gateway allows two-way traffic between a public subnet and the internet.

NAT gateway allows outbound-only traffic from a private subnet — instances can fetch updates, nothing can reach them. This is billed hourly and per gigabyte on the hyperscalers, and is frequently a larger line item than expected.

Security groups are stateful, instance-level firewalls. Allow a connection inbound and the response is permitted automatically.

Network ACLs are stateless, subnet-level rules where inbound and outbound must both be permitted explicitly.

The pattern that solves most problems

A three-tier layout covers the majority of applications:

The critical detail is the third column. Rules referencing security groups rather than IP ranges stay correct when instances are replaced, scaled or re-addressed. A rule allowing the app security group to reach the database on port 5432 keeps working forever; a rule allowing 10.0.1.47 breaks the first time that instance is rebuilt.

Under this layout the database has no public address at all. It is not firewalled off from the internet — it is not on the internet.

The single highest-value change

If you take one thing from this: move datastores off public addresses and reach them over private networking.

Most VPS providers give this for free. DigitalOcean's VPC, Linode's VPC, Hetzner's private networks, UpCloud's SDN — all allow instances in the same region to talk privately, usually without counting against bandwidth allowances.

A database with no public interface cannot be scanned, cannot be brute-forced and cannot be reached by a credential-stuffing bot. That is a category of risk removed rather than mitigated.

Security group hygiene

• Never leave 0.0.0.0/0 on SSH or RDP. Use a bastion, a VPN, or the provider's session manager equivalent.
• Reference groups, not addresses, wherever the platform supports it.
• One group per role, not one shared group for everything.
• Egress rules matter too. Default-allow-all outbound is convenient and is also how data leaves during an incident.
• Name and describe every rule. An unexplained rule will never be removed, because nobody will dare.

Private connectivity to managed services

On the hyperscalers, traffic to managed services such as object storage leaves the VPC by default and travels over public endpoints, even though it stays within the provider's network.

VPC endpoints or private service connect keep that traffic on private paths. They improve the security posture and often reduce NAT gateway charges substantially, because the traffic no longer passes through it. On a storage-heavy workload this can pay for itself immediately.

Address planning

Plan ranges before you need them:

• Leave room to grow. A /16 costs nothing and a /24 will run out.
• Do not overlap ranges between environments. The day you need to peer production and staging, overlapping CIDRs make it impossible without renumbering.
• Reserve distinct ranges for on-premises networks you may connect later.
• Document the allocation somewhere a future colleague will find it.

Renumbering a live network is among the least enjoyable operations available, and it is entirely avoidable with ten minutes of planning.

Frequently asked questions

What makes a subnet public? Its route table having a path to an internet gateway. Nothing else.

Do I need a NAT gateway? Only if private instances need outbound internet access for updates or external APIs. Some providers offer cheaper alternatives, and VPC endpoints can remove much of the need.

Are security groups enough without network ACLs? For most architectures, yes. ACLs add a coarse second layer that is useful for broad subnet-level denials.

Can VPCs span regions? No. They are regional. Cross-region private connectivity needs peering or a tunnel, and usually incurs transfer charges.

The hardening checklist covers network review as part of taking over any environment.

Private networking is available on every provider in the RunCloudMarket catalogue, usually at no extra cost.