Cloud Networking Fundamentals: VPCs, Subnets, Routing and Security Groups

Begin with the packet path

Before changing any rule, describe the source, destination, protocol and port. A browser request to an application might travel through DNS, a public endpoint or load balancer, a subnet route, a traffic-control rule and finally the service listening on a virtual machine. The return path must also work.

Address ranges and CIDR notation

A virtual network starts with one or more IP address ranges, commonly written in CIDR notation. A CIDR such as 10.20.0.0/16 identifies a network prefix and leaves space that can be divided into smaller subnets. Plan ranges that do not overlap if networks may later connect through peering or VPN.

Subnets group resources and provide a boundary for routing and traffic controls. Use names that express purpose, such as web, application and database, while remembering that a name has no security effect by itself.

Public and private subnets

A public subnet has routing that can support internet connectivity. A private subnet does not provide a direct inbound internet route. Whether an individual resource is reachable also depends on its address, gateway or load balancer, security rules, operating-system firewall and whether the application listens on the expected interface and port.

Place only components that need direct public reachability on a public path. Databases and internal services usually belong on private paths with narrowly defined application access. Private resources may use a managed NAT service for outbound updates without accepting unsolicited inbound internet connections.

Route tables decide where traffic goes

A route maps a destination range to a next hop. Local routes handle traffic within the virtual network. Other routes may point towards an internet gateway, NAT service, VPN gateway, peering connection or network appliance. The most specific matching route generally wins, subject to platform rules.

A correct route does not guarantee access. Routing answers “where should this packet go?” Traffic controls answer “is this connection allowed?” Identity policies answer “may this caller perform the requested action?” Keep those questions separate during diagnosis.

Security groups, network security groups and ACLs

Cloud platforms provide stateful traffic controls attached to resources or network interfaces. AWS security groups and Azure network security groups both filter traffic, but their rule models and attachment options differ. Network-level access control lists provide another layer in some environments and may be stateless, requiring explicit return-path consideration.

Write rules from a requirement: “allow HTTPS from users through the load balancer” or “allow database traffic only from the application tier.” Avoid broad sources such as every IPv4 address for administrative ports. Record why each rule exists and remove temporary access.

DNS and load balancing

DNS translates a name into an address or service endpoint. If a site fails by name but works by address, verify the record, resolver response and expected target. DNS does not check whether the application behind the address is healthy.

A load balancer accepts traffic and forwards it to healthy targets. Check its listener, target port, health-check path and security rules. If targets are marked unhealthy, inspect the application response and network path rather than replacing the load balancer immediately.

Connecting networks

Peering connects selected virtual networks using private routing. VPNs create encrypted connections across another network, often between cloud and on-premises environments. Larger designs may use transit hubs. Before connecting anything, check for overlapping address ranges, required routes, DNS behaviour and the exact traffic that should cross the boundary.

Hybrid and multi-cloud designs add operational complexity. Use the multi-cloud versus hybrid-cloud decision framework to evaluate a real requirement instead of treating more providers as automatically better.

Observability for cloud networks

Useful evidence includes flow logs, firewall logs, load-balancer access logs, DNS query results, route views and application logs. A timeout may point to a route or traffic rule; a connection refusal may mean the host is reachable but the service is not listening; an HTTP error may come from the application after the network succeeds.

Hands-on project: public web tier and private data tier

Design a fictional product catalogue with a public web endpoint and a private database. Use non-overlapping address ranges and separate subnets. Allow web traffic only through the public endpoint, allow database traffic only from the application tier and keep administrative access restricted.

1. Draw the intended request and return paths.
2. Create the virtual network and subnets in the selected practice platform.
3. Configure routes and the minimum required traffic rules.
4. Test one allowed web request and one blocked database request.
5. Introduce a controlled mistake, such as a missing route or wrong port, then diagnose it using evidence.
6. Document the fix and remove the practice resources.

Your portfolio evidence should include a sanitized diagram, CIDR plan, rule-purpose table, test results and troubleshooting note. Never publish credentials, subscription or account identifiers, private keys or real customer data.

AWS and Azure terminology

Use the providers’ current documentation for exact behaviour: Amazon VPC operation and Azure Virtual Network overview. The comparison supports conceptual learning; it does not make the configuration syntax identical.

Frequently asked questions

For broader compute, storage, identity, database and monitoring foundations, continue with Softenant’s cloud computing training in Vizag. Choose the separate AWS or Azure course only when you want deeper provider-specific configuration.