Skip to main content

How the network works

Networking inside a VDC is built around Virtual Networks (VNets)Virtual Network: a private network inside a VDC, defined by a CIDR and divided into subnets.. A VNet is a private network that you divide into subnets, connect to the internet when needed, and protect with firewall rules. This page explains the pieces and how they fit together.

Virtual Networks (VNets)​

A VNet is a private network defined by a CIDRNotation for an IP address range, such as 10.0.0.0/16. block, such as 10.0.0.0/16. That block is the address space from which all of the VNet's subnets are carved. A VDC can hold more than one VNet, and each VNet is isolated from the others unless you connect them.

A VNet also has a default DNS domain (for example, network.local) used for internal name resolution.

Subnets​

A VNet is split into one or more subnetsA range within a VNet, defined by its own CIDR, to which VMs connect., each with its own CIDR inside the VNet's range. Subnets cannot overlap. Every subnet has a gateway address and assigns IPs to VMs either by DHCP or as a static IP.

When you create a VM, each of its network adapters (NICs) connects to a subnet.

The subnet assigns an address automatically from its range. This is the simplest choice for most VMs.

Type a CIDR to see the address range a subnet would cover:

Network address
10.0.1.0
Netmask
255.255.255.0
Usable range
10.0.1.1 to 10.0.1.254
Broadcast
10.0.1.255
Usable hosts
254
Total addresses
256

Internet access​

A VNet can be isolated (no internet access at all) or connected to the internet through an internet gatewayA public IP that acts as a VNet egress point to the internet., which is a public IP that acts as the egress point. Internet access is controlled per subnet, so you can keep some subnets private while others reach the internet.

Advanced: changing internet access later

A VNet's isolation setting can be changed after it is created. Internet access is also toggled per subnet, so a subnet reaches the internet only when its gateway is enabled, even within a connected VNet.

Public IPs​

A public IPA routable external address from the VDC pool, attached to a VM or used as an internet gateway. is a routable external address from your VDC's pool. You can:

  • attach it to a VM's network adapter, so the VM is reachable from the internet, or
  • use it as a VNet's internet gateway.

A public IP that is not in use stays free in the pool until you assign it.

Internal DNS​

Within a VNet you can create static DNS records that map a hostname to an internal IPv4 address (an A record). Combined with the VNet's default domain, this lets VMs reach each other by name instead of by IP.

Connecting and protecting the network​

  • Firewall: rules are defined per VNet under a default-deny policy. Traffic that is not explicitly allowed is blocked. See What is a firewall.
  • VPNs and Direct Connect: connect your on-premises networks to a VNet through OpenVPN, IPsec, or a dedicated Direct Connect link.