Tech in Diagrams

Cloud Networking Basics

Cloud networking gives you a private, software-defined network with explicit rules about what may talk to what.

Intermediate 5 min Cloud Computing
One boundary, two kinds of subnet
  • Inbound
  • East-west
  • Outbound via NAT
  • Blocked
VIRTUAL NETWORK — VPC / VNETYour private, software-defined networkInternetVisitors, bots, scanners —all untrusted by defaultEDGEInternetgatewayThe one crossingpoint, both waysPUBLIC SUBNETReachable from outsideENTRY POINTWeb tierAccepts visitor requests andpasses them further insideNAT egressOutbound only — replies allowed, new inbound is notPRIVATE SUBNETNo inbound routeBACKENDApplication tierBusiness logic — called by the web tier onlyDatabaseThe most restricted resourceEast-west trafficDirect hit on private resourcesNo route, no rule — it never landsROUTE TABLEWhere may this go?SECURITY RULESIs it allowed at all?Routing says where. Filtering says whether.
Routes decide where a packet may travel; security rules decide whether it may pass. Public subnets have a path to the gateway, private ones reach the internet only outbound through NAT.

Hover the internet, gateway, a subnet, the route table or the security rules to isolate the relevant path; click any component for a short explanation.

Next conceptRegions & Availability ZonesA region is a geographic location; availability zones are physically separate data centre groups inside it.