Cloud networking: VPCs, subnets, security groups, DNS, load balancers and HTTPS

Networking is where many cloud beginners get stuck. The good news: cloud networking uses the same ideas as normal networking (IP addresses, subnets, ports, DNS). If you need a refresher, see CIDR, ports and DNS.

The VPC: your private network in the cloud

A VPC (Virtual Private Cloud; called a VNet in Azure) is your own isolated network inside the provider's cloud. You choose its IP range, for example 10.0.0.0/16.

Inside it you create subnets:

• Public subnets: have a route to the internet (for load balancers and web servers).
• Private subnets: no direct internet access (for databases and internal services).

VPC 10.0.0.0/16
├── Public subnet  10.0.1.0/24  (zone A)  → load balancer
├── Public subnet  10.0.2.0/24  (zone B)  → load balancer
├── Private subnet 10.0.11.0/24 (zone A)  → app servers
├── Private subnet 10.0.12.0/24 (zone B)  → app servers
└── Private subnet 10.0.21.0/24 (zone A)  → database

Plan subnets with Python (run it)

import ipaddress

vpc = ipaddress.ip_network("10.0.0.0/16")
print("VPC:", vpc, "has", vpc.num_addresses, "addresses")

subnets = list(vpc.subnets(new_prefix=24))
print("It can hold", len(subnets), "subnets of /24")
for name, net in [("public-a", subnets[1]), ("public-b", subnets[2]), ("private-a", subnets[11]), ("db-a", subnets[21])]:
    hosts = list(net.hosts())
    print(f"{name:<10} {net}  usable {hosts[0]} - {hosts[-1]}")

print("Is 10.0.11.25 in private-a?", ipaddress.ip_address("10.0.11.25") in subnets[11])

Note: cloud providers reserve a few addresses in each subnet for their own use, so slightly fewer are usable than in normal networking.

Getting to and from the internet

Firewalls: security groups and network ACLs

• Security groups (AWS; similar "network security groups" in Azure, "firewall rules" in Google Cloud) are virtual firewalls on each server or service. They're stateful: if a request is allowed in, the reply is allowed out.
• Network ACLs are optional subnet-level rules.

Typical rules:

DNS: names to addresses

You point your domain to your load balancer or server with DNS records:

Providers have DNS services (Route 53, Azure DNS, Cloud DNS), or you can use your registrar or Cloudflare. See DNS records.

Load balancers

A load balancer spreads traffic across several servers and stops sending traffic to unhealthy ones (using health checks). Benefits: no single server failure takes the site down, and you can add servers when traffic grows.

• Layer 7 (application) load balancers understand HTTP: route /api to one group and / to another, and handle HTTPS certificates.
• Layer 4 (network) load balancers work with TCP/UDP: very fast, for non-HTTP traffic.

HTTPS everywhere

• Use HTTPS for every public site (free certificates from Let's Encrypt, or the provider's certificate manager).
• Terminate HTTPS at the load balancer or on the server with Nginx.
• Redirect HTTP to HTTPS.

Summary

• A VPC is your private network; split it into public and private subnets across zones.
• Internet and NAT gateways and route tables control internet access.
• Security groups are stateful firewalls: allow only what's needed; never expose SSH or databases to the world.
• DNS points names to load balancers; load balancers spread traffic with health checks; use HTTPS everywhere.