The network
A virtual private cloud (VPC) is your own private network inside a cloud provider’s data centres. You choose its address range, here 10.0.0.0/16: 65,536 private addresses that no other customer’s network can see.
You cut the VPC into subnets, smaller ranges for different jobs. The public subnet 10.0.1.0/24 holds what the internet may reach. The private subnet 10.0.2.0/24 holds the servers, which get no public address at all.
Each subnet follows a route table. Both send 10.0.0.0/16 to “local”, so everything inside can talk. For everything else (0.0.0.0/0) the public table points at the internet gateway, the private one at the NAT gateway. That one route is what makes a subnet public.
Serving visitors
A visitor, 192.0.2.7, asks for the web site at 203.0.113.20. The internet gateway, the VPC’s door to the internet, maps that public address to the load balancer’s private address 10.0.1.10 and lets the request in.
The load balancer shares the requests between the servers so no single one is overloaded. Taking turns, request 1 goes to Server A, request 2 to Server B, request 3 to A again. Need more capacity? Add a server.
Each server wears a security group: a stateful firewall attached to the server itself. Its rule lets in TCP port 80 only from the load balancer’s group. Because it remembers the connection, the server’s replies go back out without a rule of their own.
A network ACL (access control list) guards the whole private subnet at its edge. It is stateless: it reads numbered rules, lowest first, and forgets every packet. So it must allow the replies too, as outbound TCP to ports 1024 to 65535.
On a timer, the load balancer asks each server for /health. Server B stops answering. After two misses in a row it counts as unhealthy, and every new request goes to Server A until B passes its checks again.
Reaching out
Server A wants a software update from 198.51.100.80. Its route table sends it to the NAT (network address translation) gateway, which swaps the private source for its own public address, 203.0.113.30. Replies come back, but nobody outside can start a connection in.
An admin in the office, 192.168.1.25, reaches Server B over a site-to-site VPN (virtual private network): an encrypted tunnel across the internet. The private route table sends 192.168.1.0/24 into the tunnel. Joined networks’ ranges must not overlap, or routes would clash.
Routes, rules and packets, field by field
;; step 1/10 · vpc · space ;; at vpc VPC 10.0.0.0/16 (RFC 1918 private range) size: 2^(32-16) = 65,536 addresses the provider runs many customers on the same hardware; each VPC is walled off from the others in software other customers may use 10.0.0.0/16 too: private ranges repeat, and that is fine until two networks must be joined names: AWS and Google Cloud say VPC, Azure says virtual network
The terms are the common ones. AWS and Google Cloud say VPC, Azure says virtual network; Google Cloud has no separate internet gateway object (a default route to the internet does the job); Azure’s nearest thing to a security group is a network security group. The ideas are the same. Clouds reserve a few addresses in every subnet for their own use (on AWS the first four and the last), so not every address in a range can be given to a server.