Cloud networking basics: VPCs, VNets, subnets, route tables and gateways
In short: A virtual network such as an AWS VPC or Azure VNet is your own private address space inside the provider. You split it into subnets, steer traffic with route tables, and attach gateways for internet, NAT and private connectivity. Most network ideas you already know still apply.
Virtual networks in plain terms
In a data centre you buy switches and routers and plan IP ranges. In the cloud you create a virtual network: AWS calls it a Virtual Private Cloud (VPC), Azure calls it a Virtual Network (VNet), and Google Cloud also uses VPC. It is a software-defined network isolated from other customers. You choose its address range in CIDR notation, for example 10.0.0.0/16, using private RFC 1918 space.
Plan the range carefully. If two networks overlap you cannot easily peer them or link them to your office later. The subnet calculator and the CIDR tool help you split ranges.
Subnets and route tables
A subnet is a slice of the network's range. In AWS a subnet lives in a single availability zone; in Azure a subnet spans the region. A subnet is not "public" because of its name. It is public because its route table sends internet-bound traffic (0.0.0.0/0) to an internet gateway.
| Subnet | Example range | Default route | Typical contents |
|---|---|---|---|
| Public | 10.0.1.0/24 | Internet gateway | Load balancers, bastion, NAT gateway |
| Private app | 10.0.2.0/24 | NAT gateway | Application servers |
| Private data | 10.0.3.0/24 | None (local only) | Databases |
Every route table also has a local route so subnets in the same network can reach each other. Filtering between them is done by security groups and network ACLs, not by routing.
Gateways and connectivity
- Internet gateway: lets resources with public IP addresses talk to the internet in both directions.
- NAT gateway: lets private resources start outbound connections (for patches, APIs) while blocking inbound ones. It is the cloud version of NAT on your office router.
- Peering: connects two virtual networks privately. It is not transitive: if A peers with B and B with C, A cannot reach C through B.
- Transit hub: AWS Transit Gateway or an Azure hub VNet connects many networks and on-premises links in a hub-and-spoke design.
- VPN and dedicated links: connect your office or data centre; see hybrid connectivity.
- Private endpoints: reach provider services such as storage over private IPs instead of the internet.
Example and common mistakes
A quick way to create a network and subnet with the AWS CLI:
aws ec2 create-vpc --cidr-block 10.0.0.0/16
aws ec2 create-subnet --vpc-id <vpc-id> --cidr-block 10.0.2.0/24 --availability-zone eu-west-2aCommon mistakes:
- Choosing a range that overlaps with the office LAN or another VPC.
- Making subnets too small; providers reserve some addresses in every subnet (AWS keeps five).
- Putting databases in public subnets "just for testing".
- Forgetting that a single NAT gateway is a single point of failure in one zone.
Practice
What makes a subnet public?
A server in a private subnet cannot download updates. What should you check?
VPC A is peered with VPC B, and B with C. Can A reach C?
Key takeaways
- A VPC or VNet is your isolated, software-defined network in the cloud.
- Route tables, not names, decide whether a subnet is public.
- NAT gateways give private resources outbound-only internet access.
- Plan non-overlapping CIDR ranges before you build.
- Peering is not transitive; use a transit hub for many networks.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.