What networking options are available (VPC, private subnets)?
In Oracle Cloud Infrastructure (OCI), networking is built around the Virtual Cloud Network (VCN). If you are coming from AWS, a VCN is the direct equivalent of a VPC. It provides a private, isolated environment where you can run your rented servers.
As of 2026, here are the primary networking options and components available to you:
Within your VCN, you divide your IP address space into Subnets.
Public Subnets: Instances in these subnets can have Public IP addresses. They can communicate directly with the internet via an Internet Gateway. These are typically used for load balancers or "bastion" (jump) hosts.
Private Subnets: Instances here cannot have public IP addresses. They are invisible to the internet.
To let these servers download patches without being exposed, you use a NAT Gateway.
To let these servers talk to OCI services (like Object Storage) without using the internet, you use a Service Gateway.
Unlike other clouds where a subnet is locked to a single data center (Availability Zone), OCI defaults to Regional Subnets.
What it means: A single subnet spans across all Availability Domains in a region.
The Benefit: If one data center has an outage, your subnet configuration remains valid in the others, making high-availability architecture much simpler to manage.
OCI gives you two ways to control traffic at the packet level:
Security Lists (Subnet-level): These are the "traditional" firewalls that apply to every single server within a specific subnet.
Network Security Groups (Instance-level): These act more like "Security Groups" in AWS. You can apply specific rules to a single server (VNIC) regardless of which subnet it sits in. This allows for micro-segmentation (e.g., "Only allow the App Server to talk to the Database Server").
If you need to connect your rented cloud servers back to your on-premises office, you have three main tools:
Site-to-Site VPN: An encrypted tunnel over the public internet. It’s quick to set up and, in many cases, free for the first few tunnels.
FastConnect: A dedicated, private physical connection (like a "direct line") between your office and Oracle. It offers speeds up to 400 Gbps and has no data egress charges.
Dynamic Routing Gateway (DRG): Think of this as the "central router" for your VCN. It manages the traffic coming from your VPN, FastConnect, and other peered VCNs.
| Feature | Physical Data Center | OCI Virtual Cloud Network |
| Isolation | Physical Walls | Logical (VCN isolation) |
| Firewall | Rack-mounted appliance | Security Lists / NSGs / Network Firewall |
| Routing | Manual cable patching | Software-Defined Route Tables |
| Expansion | Buying/installing gear | API call / Console slider |
IPv6 Support: Fully supported across all regions, allowing you to run dual-stack (IPv4/IPv6) environments.
Intra-Region Peering: You can connect two different VCNs (even in different accounts) so they can talk over private IPs with zero latency penalty.
OCI Network Firewall: A managed, high-performance firewall powered by Palo Alto technology that sits directly in your VCN to inspect all incoming and outgoing traffic.