Introduction
A Virtual Private Cloud, or VPC, is an isolated, customer-defined virtual network carved out of a cloud provider's shared physical infrastructure. Within a VPC, you decide the IP address range, how it is subdivided into subnets, and how traffic flows in and out. It is the foundation on which almost every other networking service, from load balancers to managed databases, is built.
Cricket analogy: Like a franchise getting its own fenced-off section of a shared training complex where it decides how many nets to build and who can walk in, a VPC is an isolated, customer-defined network carved from shared cloud infrastructure, and it's the foundation load balancers and databases are built on.
Explanation
When you create a VPC, you assign it a CIDR block, a range of IP addresses expressed in Classless Inter-Domain Routing notation, such as 10.0.0.0/16, which provides roughly 65,000 addresses. You then divide that block into smaller subnets, each pinned to a specific availability zone for fault tolerance. Subnets are classified as public or private based on their route table, not on any inherent property of the subnet itself. A public subnet has a route table entry sending internet-bound traffic (0.0.0.0/0) to an internet gateway, making it directly reachable from and able to reach the internet. A private subnet has no such route; it either has no internet path at all, or it routes outbound-only traffic through a NAT gateway sitting in a public subnet, so instances can fetch updates or call external APIs without accepting inbound connections from the internet.
Cricket analogy: Like assigning a block of 65,000 seat numbers (10.0.0.0/16) to a stadium and dividing them into sections pinned to specific gates, a VPC's CIDR block splits into subnets by availability zone, with 'public' sections opening straight onto the street (internet gateway) and 'private' sections reachable only through a controlled corridor (NAT gateway).
This public/private split lets you place internet-facing components, like load balancers or bastion hosts, in public subnets, while keeping application servers and databases in private subnets where they cannot be directly attacked from outside. VPCs can also be connected to each other via peering, or to on-premises networks via VPN or dedicated interconnects, extending the isolated network without exposing it to the open internet.
Cricket analogy: Like putting the ticket office and gate stewards (load balancers, bastion hosts) at the stadium's public entrance while keeping the players' dressing room (databases) deep inside where fans can't wander in, VPCs also let two grounds peer their private tunnels, or connect to a home ground via a dedicated corridor, without exposing either to the open street.
Example
VPC CIDR: 10.0.0.0/16 (65,536 addresses)
Public subnet: 10.0.1.0/24 (256 addresses)
route table: 10.0.0.0/16 -> local
0.0.0.0/0 -> Internet Gateway
Private subnet: 10.0.2.0/24 (256 addresses)
route table: 10.0.0.0/16 -> local
0.0.0.0/0 -> NAT Gateway (sits in public subnet 10.0.1.0/24)
Analysis
In this worked example, the /16 VPC block is split into two /24 subnets, each with 256 addresses, leaving plenty of address space for additional subnets across other availability zones. The key distinction is the route table: the public subnet's default route (0.0.0.0/0) points to the internet gateway, while the private subnet's default route points to a NAT gateway that itself lives in a public subnet. This means database or application instances in 10.0.2.0/24 can still reach out to download packages or call third-party APIs, but nothing on the internet can initiate a connection to them directly.
Cricket analogy: Like splitting a 65,000-seat allocation into two 256-seat blocks - one block (10.0.1.0/24) with gates opening straight onto the street, the other (10.0.2.0/24) reachable only through a single monitored gate that lets stewards step out for supplies but stops anyone from walking in uninvited, with room left for more blocks at other grounds.
Key Takeaways
- A VPC is an isolated, customer-defined network with its own CIDR block.
- Whether a subnet is public or private is determined by its route table, not by naming.
- Public subnets route 0.0.0.0/0 to an internet gateway.
- Private subnets have no direct internet route, or route outbound-only traffic through a NAT gateway.
- Splitting subnets across availability zones improves fault tolerance.
Practice what you learned
1. In the VPC 10.0.0.0/16 subdivided into 10.0.1.0/24 and 10.0.2.0/24, what makes 10.0.1.0/24 a public subnet?
2. How do instances in a private subnet typically get outbound-only internet access?
3. What does the CIDR block 10.0.0.0/16 represent?
4. Why is it good practice to place a database server in a private subnet?
Was this page helpful?
You May Also Like
Cloud Networking Basics
Learn the core building blocks that connect and isolate resources in the cloud: VPCs, subnets, route tables, and gateways.
Cloud Security Fundamentals
Learn the core principles of securing cloud environments, including the shared responsibility model and defense-in-depth.
High-Availability Design
Design systems that stay up through redundancy and automatic failover, and understand what each additional 'nine' of uptime really costs.
Microservices in the Cloud
See how managed containers, serverless platforms, service discovery, and API gateways make cloud-native microservices practical to build and operate.