Cloud Networking Architecture: VPCs, Subnets, Routing, and Gateways

Virtual Private Cloud (VPC) networking provides isolated, software-defined network topologies in public clouds (AWS, GCP, Azure). This guide covers CIDR subnetting mathematics, public vs. private subnets, Internet Gateways (IGW), NAT Gateways, Security Groups vs. Network ACLs, and multi-VPC Transit Hub architectures.

⚡ Quick Dive

Cloud Networking Primitives Matrix

Component Scope Layer Purpose
VPC Region L3 Network Isolated virtual network bound to a CIDR block (e.g. 10.0.0.0/16)
Subnet Availability Zone L3 Subnetwork Division of VPC CIDR (Public or Private)
Internet Gateway (IGW) VPC-wide L3 Gateway Enables direct, bidirectional public Internet communication
NAT Gateway Public Subnet L3/L4 Gateway Allows outbound-only Internet access for private subnets (no inbound)
Route Table Subnet-level L3 Routing Directs packet traffic matching CIDR ranges to gateways/interfaces
Security Group Instance / ENI L4 Stateful Firewall Filters traffic at VM/container level (default: deny all inbound)
Network ACL (NACL) Subnet-level L3/L4 Stateless Firewall Subnet perimeter boundary filtering

📖 Extended Guide

1. CIDR Subnetting Math & Cloud Reserved IPs

A CIDR (Classless Inter-Domain Routing) block defines a network prefix and bitmask: $$\text{Total Host IPs} = 2^{(32 - \text{prefix})}$$

CIDR Calculation Table:
- /16 ──► 65,536 Total IPs (Standard VPC root: 10.0.0.0/16)
- /20 ──►  4,096 Total IPs (Large application subnet)
- /24 ──►    256 Total IPs (Standard service subnet: 10.0.1.0/24)
- /28 ──►     16 Total IPs (Small database subnet)

[!NOTE] Cloud providers (like AWS) reserve the first 4 and last 1 IP address in every subnet (e.g., Network, Router Gateway, DNS, Future use, Broadcast). A /24 subnet provides 251 usable host IPs.

2. Standard 3-Tier Multi-AZ VPC Architecture

┌──────────────────────────────────────────────────────────────────────────┐
│ Virtual Private Cloud (VPC: 10.0.0.0/16)                                │
│                                                                          │
│ ┌────────────────────────┐                    ┌────────────────────────┐ │
│ │ Availability Zone A    │                    │ Availability Zone B    │ │
│ │                        │                    │                        │ │
│ │ [ Public Subnet A ]    │                    │ [ Public Subnet B ]    │ │
│ │ (10.0.1.0/24)          │                    │ (10.0.2.0/24)          │ │
│ │  ├─ Public ALB         │                    │  ├─ Public ALB         │ │
│ │  └─ NAT Gateway A ──┐  │                    │  └─ NAT Gateway B ──┐  │ │
│ │                     │  │                    │                     │  │ │
│ │ [ Private App Subnet]  │                    │ [ Private App Subnet]  │ │
│ │ (10.0.11.0/24)      │  │                    │ (10.0.12.0/24)      │  │ │
│ │  └─ EKS Pods / VMs ◄┘  │                    │  └─ EKS Pods / VMs ◄┘  │ │
│ │                        │                    │                        │ │
│ │ [ Isolated DB Subnet ] │                    │ [ Isolated DB Subnet ] │ │
│ │ (10.0.21.0/24)         │                    │ (10.0.22.0/24)         │ │
│ │  └─ PostgreSQL Primary │◄── Replication ───►│  └─ PostgreSQL Standby │ │
│ └────────────────────────┘                    └────────────────────────┘ │
└────────────────────────────────────┬─────────────────────────────────────┘
                                     │ (0.0.0.0/0 via Route Table)
                                     ▼
                        [ Internet Gateway (IGW) ]

3. Stateful Security Groups vs. Stateless NACLs

  • Security Groups (Stateful): If an inbound rule allows incoming traffic on port 443, return outbound traffic is automatically permitted regardless of outbound rules.
  • NACLs (Stateless): Inbound and outbound traffic are evaluated independently. Allowing inbound port 443 requires explicitly allowing outbound ephemeral ports ($1024-65535$) in the return rule.

4. Inter-VPC Connectivity: Peering vs. Transit Gateway

  • VPC Peering: Direct 1-to-1 connection between two VPCs. Non-transitive (A $\leftrightarrow$ B and B $\leftrightarrow$ C does NOT allow A $\leftrightarrow$ C). Scales poorly for dozens of VPCs ($O(N^2)$ mesh).
  • Transit Gateway (TGW) / Cloud Hub: Acts as a central cloud router connecting hundreds of VPCs, on-premises datacenters via Direct Connect/VPN, and shared service networks in a scalable hub-and-spoke topology.
⌂ All Guides