Cloud Networking Basics

A cloud application needs a network as well as computers. A virtual network is a private network defined in software. You choose its addresses and connections without installing switches or cables. Separate networks can keep production work apart from testing.

Read the addresses

AWS calls its network an Amazon VPC; Microsoft uses Azure Virtual Network, or VNet; Google Cloud uses VPC network. An AWS VPC or Azure VNet has an overall address range. Its subnets take smaller ranges from it. A Google Cloud VPC has no overall range: each subnet gets its own.

The notation 10.0.0.0/16 is CIDR notation. The number after the slash counts the fixed leading address bits. A smaller number means a larger range. This /16 covers 10.0.0.0 through 10.0.255.255: 65,536 addresses. The private blocks are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. The public internet does not route these private addresses.

A subnet supplies addresses to one part of a network. For example, 10.0.3.0/24 covers 10.0.3.0 through 10.0.3.255. A database in it might receive 10.0.3.20. Separate web, application and database subnets let teams apply different routes and security rules. Subnet ranges in one network must not overlap. Providers reserve addresses for network services: AWS and Azure reserve five per subnet; Google Cloud reserves four in a primary subnet range. A 256-address subnet therefore leaves 251 addresses on AWS or Azure.

Place resources across zones

Consider an AWS shop using 10.0.0.0/16. In zone A it puts web servers in 10.0.1.0/24, application servers in 10.0.2.0/24, and its database in 10.0.3.0/24. To keep serving during a zone outage, it repeats the tiers in zone B using 10.0.11.0/24, 10.0.12.0/24 and 10.0.13.0/24. The subnets separate roles; using two zones separates failure locations. Creating several subnets in one zone alone would not do that.

Connect networks deliberately

Virtual networks provide logical isolation from other customers and other networks. Communication needs a network path and permission. A peering connection lets two networks communicate by private address over the provider's network. Peering can cross regions and account, subscription or project boundaries, but the address ranges must not overlap.

Check office and partner ranges before choosing cloud ranges. If both an office and a VPC use 10.0.0.0/16, a destination such as 10.0.3.20 could belong to either side. Choosing 10.1.0.0/16 for the cloud avoids that conflict. Fixing an address plan after deploying servers can disrupt them.

Peering is not transitive. If A peers with B and B peers with C, A still needs its own connection to C. Also, a private path does not encrypt data: use encryption for that purpose. Creating the virtual network itself is free on these providers; gateways, public IPv4 addresses and data transfer can add charges.

A destination address tells a network where traffic is trying to go. A route table tells it the next place to send that traffic. Routing supplies a path; security rules decide whether traffic may use it.

Choose the matching route

Each route pairs a destination range with a target. A local route connects subnets inside the same virtual network. The IPv4 default route, 0.0.0.0/0, matches every address, but a more specific matching route takes priority. A larger prefix number after the slash means a more specific range.

Suppose an AWS application subnet uses these routes:

A request from 10.0.2.15 to database 10.0.3.20 matches both ranges. The /16 is more specific than /0, so the request stays local. A request to update server 203.0.113.50 matches only the default route and goes to the NAT gateway. Security rules must allow each connection.

Allow public access deliberately

On AWS, an internet gateway joins a VPC to the internet. A subnet with a default route to that gateway is a public subnet. Its address range may still be a private range such as 10.0.1.0/24. “Public” describes its routing, not its address notation.

To reach a server from the internet, three things must line up: an internet path, a public IP address on the server or a load balancer in front of it, and security rules allowing the connection. An AWS subnet can be public while a particular server in it has no direct public access.

Azure and Google Cloud provide built-in internet paths without an AWS-style internet gateway that you create. Their security rules and public addressing still matter. A private subnet, in the general sense, gives internet users no direct path to its resources. That makes it useful for databases and internal application servers.

Give private servers outbound access

A NAT gateway lets a private server start an internet connection. It replaces the private source address with a public address, tracks the connection, and delivers the reply to the correct server. It does not accept a new connection started by an internet user toward that private server.

On AWS, a public NAT gateway sits in a public subnet. The private application's default route points to it, and the NAT gateway's subnet has a route to the internet gateway. The application can fetch updates while its database subnet, with only a local route, has no internet path. Azure NAT Gateway attaches to a subnet; Google Cloud offers Cloud NAT. NAT services have running-time and data-processing charges.

Check the provider's defaults

AWS default VPC subnets are public and normally assign public addresses to new instances. A VPC you create yourself needs an internet gateway added. Reserved static public addresses keep a stable address; AWS calls one an Elastic IP. Automatically assigned addresses can change after stopping and starting a machine. Since February 2024, AWS charges for every public IPv4 address, including ones in use.

Azure uses “private subnet” specifically for a subnet with default outbound access turned off. It needs an explicit outbound method, such as NAT or an assigned public IP, and that setting alone does not block inbound traffic. The portal defaults to private subnets. For the API version released after March 31, 2026, new virtual networks also default to private subnets; earlier API versions retain the old behavior, and existing networks are unchanged.

A managed service may run outside your virtual network. An endpoint is the address clients use to reach it, usually through a DNS name. The endpoint's network path and the service's data permissions solve different problems.

Separate public reach from data access

A public endpoint resolves to a public IP address. Internet clients can try to connect, but that does not make the stored data public. Credentials and permissions normally control access. Some services also allow anonymous access when configured to do so; an object storage permission mistake can expose files.

Use HTTPS, which uses TLS encryption, for service traffic. Where supported, require HTTPS and restrict which addresses or networks may connect. Public reachability, access permission and encryption are separate settings. An authorized application can use a public endpoint securely, while a poorly configured service can still leak data on a private network.

Add a private address

A private endpoint gives a supported service a private address inside your network. The provider creates a network interface in a subnet, and traffic to that address stays on its network.

Office systems can also reach private endpoints through a VPN or dedicated connection. Peered networks can reach them when routing, DNS and security settings support the path.

Make the service name find the endpoint

Applications usually connect using a service name, not a hard-coded IP address. Private DNS makes that name resolve to the endpoint's private address inside the network. For example, an internal client might resolve its storage service name to 10.0.2.40. Outside clients may still receive the public address.

Creating the endpoint alone does not change every client's DNS answer. If an internal client keeps resolving the public address, it keeps taking the public path. Link the private DNS zone to the network and provide DNS forwarding for on-premises clients. To require private access, also disable or restrict the service's public endpoint. Creating a private endpoint leaves public access settings in place.

Recognize related options

An AWS gateway endpoint reaches S3 or DynamoDB through a route-table entry. It does not create the private network interface used by an interface endpoint, and it has no additional endpoint charge. An Azure service endpoint identifies an allowed subnet and carries its service traffic over Microsoft's network, but the service still has a public IP address. Private Google Access lets machines with internal addresses reach Google APIs and services.

Consider an analytics server reading 500 GB of regional object storage each day. Sending those reads through NAT makes the NAT service process all 500 GB. On AWS, a suitable S3 gateway endpoint takes that service traffic through the endpoint route with no additional gateway endpoint fee. Interface and private endpoints have their own fees, so compare the complete path and its charges. The endpoint changes connectivity; TLS still supplies encryption in transit.

A server may have a route to another network and still reject its traffic. A security group acts as a virtual firewall for resources. Inbound rules control traffic arriving at a resource; outbound rules control traffic leaving it.

Read a rule

For TCP or UDP, read the protocol, port and source or destination together. The rule “allow TCP 443 from 198.51.100.7/32” allows HTTPS traffic from one address. The source 0.0.0.0/0 means every IPv4 address. An inbound source can also identify a security group, so access follows a server's role when its IP address changes.

Useful ports include SSH 22, RDP 3389, HTTP 80, HTTPS 443, DNS 53, MySQL 3306, PostgreSQL 5432 and Microsoft SQL Server 1433. ICMP, used by ping, has message types instead of TCP or UDP ports.

Understand stateful filtering

A stateful filter remembers allowed connections. If an inbound rule allows a new HTTPS connection, replies are allowed back out without a separate outbound rule for them. This does not allow the server to start any unrelated outbound connection. New connections still need their own permission.

AWS security groups attach to network interfaces. Several resources can share a group, and a resource can have several groups. Their allow rules combine: traffic passes if an applicable rule allows it. Rule order has no effect, and there is no explicit deny rule to override a broad allow. A newly created group allows no inbound traffic and permits outbound traffic until changed.

Build a chain of allowed roles

For a three-tier application, give each tier only its required inbound connections:

1. The load balancer allows TCP 443 from internet users.
2. The web servers allow TCP 443 from the load balancer's group. Administration on TCP 22 is limited to the administrator's office address.
3. The MySQL database allows TCP 3306 from the web-server group.

When a replacement web server joins the web-server group, it gains the intended database access without a new address-based rule. A direct internet request to the database fails because its source is not allowed. If a second attached group broadly allows the same database port, however, the broad permission still applies; there is no narrower deny in the first group to cancel it.

Compare provider filters

An Azure network security group, or NSG, can attach to a subnet, a network interface or both. Custom priorities run from 100 to 4096, ahead of built-in defaults at 65000, 65001 and 65500. Default inbound rules permit virtual-network traffic and Azure load-balancer traffic, then deny other inbound traffic. Google Cloud selects target machines using tags or service accounts; its implied rules deny inbound traffic and allow outbound traffic.

Apply least privilege: allow only the required ports from the smallest useful source set. Opening SSH or RDP to the entire internet exposes administrative login services to automated attacks. Managed access options include AWS Systems Manager Session Manager, Azure Bastion and Google Cloud Identity-Aware Proxy. A port filter cannot recognize an attack hidden inside allowed HTTPS traffic; application defenses and sign-in controls protect that layer.

An AWS network access control list, or network ACL, filters traffic crossing a subnet boundary. It applies to every resource in that subnet. Each subnet has one network ACL, and the same ACL can serve several subnets.

Follow the first matching rule

Network ACL rules can allow or deny traffic. AWS checks them from the lowest rule number upward and stops at the first match. A final * rule denies unmatched traffic. The VPC's default ACL allows inbound and outbound traffic; a newly created custom ACL denies traffic until you add allow rules.

Suppose rule 100 allows TCP 443 from every IPv4 address, while rule 110 denies traffic from 203.0.113.0/24. A request from 203.0.113.77 to port 443 matches rule 100 first and passes. The later deny never gets a turn. Move that deny to rule 90 to block the range before the broad HTTPS allow.

Trace the reply as a separate packet

An ACL is stateless: it does not remember that a connection was allowed. A web request uses the server's destination port 443, but the reply returns to the client's temporary, or ephemeral, port. That can be a high number such as 50432.

For a website with a working route and security group:

1. A client sends a request from its temporary port to server port 443.
2. The subnet ACL admits the inbound packet using its HTTPS rule.
3. The server replies to the client's temporary port.
4. The outbound ACL checks that destination port independently.

An outbound rule allowing only destination port 443 does not cover that reply. The reply needs an outbound allow covering its destination port; TCP 1024–65535 is a commonly used broad ephemeral range. The required range depends on the clients and traffic being supported. A stateful security group's permission does not bypass the ACL's separate decision.

Compare the two AWS layers

Inbound internet traffic must pass both layers. Traffic between two resources in the same subnet does not cross the subnet boundary, so that subnet's ACL does not filter it. Resource security groups still apply.

Use independent layers

Defense in depth limits the damage from one mistaken setting. Security groups give each application role precise permissions. ACLs add subnet-wide guardrails, such as denying a known malicious range. Operating-system firewalls, managed network firewalls, web application firewalls, TLS and identity checks address other parts of the path. Flow logs record allowed and rejected network flows; Amazon Inspector helps identify workload vulnerabilities and unintended exposure.

Azure has no separate AWS-style network ACL: subnet and interface NSGs provide those layers, and both are stateful. For inbound Azure traffic, the subnet NSG and then the interface NSG must allow it. Google Cloud uses stateful VPC firewall rules and broader firewall policies, including organization and folder policies.

People remember names such as www.example.com; computers send traffic to IP addresses. DNS, the Domain Name System, connects the two. Cloud providers host records through Amazon Route 53, Azure DNS and Google Cloud DNS.

Follow a name lookup

A client asks a resolver for an address. If the resolver has no cached answer, it asks a root server where to find the servers for .com. Those servers identify the domain's authoritative name servers. An authoritative server holds the domain's records and returns the answer, which the resolver caches for later clients. Route 53 assigns four authoritative name servers to a public hosted zone. The client then connects to the returned address. DNS does not carry the website's application traffic.

A zone is the managed collection of records for a domain. To use a new provider's public zone, set that provider's name servers at the domain registrar. Zone hosting and domain registration are separate services: Route 53 offers both, while Azure DNS hosts zones without selling domain registrations.

Choose the record

The zone apex is the bare domain, such as example.com. A standard CNAME cannot sit there because the apex also needs NS and SOA records. Route 53 alias records and Azure alias record sets can point supported apex records at cloud resources and follow changes to their addresses.

Allow for cached answers

A record's TTL, or time to live, states how many seconds a resolver can cache the answer. Suppose a resolver caches a 3,600-second answer at 9:55. Changing the record at 10:00 does not erase that copy: it can remain valid until 10:55. Lower a TTL to 300 seconds at least one old TTL before a planned move, so the old long-lived copies have time to expire. Lowering it at the instant of the move cannot shorten copies already cached.

DNS routing policies influence the answers to lookups. Simple routing gives a straightforward answer. Weighted routing gives answers in chosen proportions, such as 90% for the current version and 10% for a new version; latency routing favors the lowest measured latency; geolocation routing selects by user location; failover routing switches from a primary to a standby when health checks show a failure. Each Route 53 health checker normally sends a check every 30 seconds. Azure Traffic Manager and Google Cloud DNS offer DNS-based routing options too.

In a shop with a primary in Frankfurt and a standby in Ireland, a failed primary health check changes new answers toward the standby. Existing cached answers still last until expiry; a short TTL such as 60 seconds reduces that delay. Weighted routing likewise distributes DNS answers, not exact numbers of users or application requests: one cached answer can serve many users. A load balancer acts on incoming traffic at a different layer.

Resolve internal names

A private DNS zone supplies answers to linked virtual networks. It can map db.internal.example.com to a private database address or direct a service name to a private endpoint. On-premises clients need a suitable DNS forwarding path across their VPN or dedicated connection, using options such as Route 53 Resolver endpoints or Azure DNS Private Resolver. A working network tunnel alone does not teach an office resolver where to ask for the cloud's private names.

Route 53 and Azure DNS publish 100% availability SLAs for their DNS services. An SLA is a contractual service commitment; a cached answer can still point at an application server that is unavailable.

A content delivery network, or CDN, keeps temporary copies of content near users. Its origin holds the original files or produces the application responses. Amazon CloudFront, Azure Front Door and Google Cloud CDN provide this service through edge locations around the world.

Follow a request

The browser resolves the CDN name and connects to a nearby edge location. CloudFront can steer users with DNS answers; Azure Front Door and Google Cloud CDN use anycast addressing, where several locations announce the same IP address and routing brings users to a nearby one. An edge location is not a full cloud region, and providers operate many more edge locations than regions.

A cache hit occurs when the edge has a fresh usable copy and serves it. On a cache miss, the edge fetches content from the origin, returns it, and can cache it for later requests. Images, scripts, style sheets, downloads and video often work well because many users request the same content.

Measure the benefit

Long-distance requests take more time for each network round trip. A page viewed from Sydney needs four sequential round trips to its Frankfurt origin. At 250 ms per trip, it spends 1,000 ms waiting for those trips. At a Sydney edge taking 15 ms per trip, the four trips take 60 ms. This example measures the round-trip delay, not the complete page-loading time.

The cache hit ratio is:

With 9,200 hits out of 10,000 requests, the ratio is 92%. In this simple example, the 800 misses reach the origin. A high hit ratio reduces origin work and the data it sends, which helps during a sudden rise in visitors.

Control freshness

A CDN TTL controls how long content can be reused. The origin can send Cache-Control: max-age=86400, allowing one day of caching, or CDN settings can control the lifetime. Changing a file at the origin does not immediately replace fresh cached copies.

To publish an urgent correction, invalidate or purge the cached path. Another approach publishes a new filename, such as app.v2.js, and updates the page to request it. The new name identifies a different object. Keep personalized pages, such as an account page or shopping cart, from being shared as public cached content. Even when a response cannot be cached, the edge may improve delivery by ending TLS nearby and reusing connections toward the origin.

Separate caching from other network services

Load balancers can be regional or global. Global Accelerator supplies fixed anycast addresses and can suit game or voice traffic that does not benefit from web-content caching.

The edge can also apply HTTPS certificates and web application firewall rules. Its large network absorbs many DDoS attacks; CloudFront includes AWS Shield Standard. Origin restrictions, such as CloudFront origin access control for S3, can keep users from bypassing the CDN. Charges mainly follow delivered data and request counts. Users already close to the origin, or applications with almost entirely unique responses, gain less from caching. Edge copies are temporary and can be evicted, so the origin still needs its own reliable storage and backup.

An office may need to use an application at a private cloud address. A hybrid network joins on-premises networks with cloud networks. A VPN, or virtual private network, carries that traffic in an encrypted tunnel across the public internet.

Choose what connects

A site-to-site VPN connects a whole office or data center network. A VPN-capable router or firewall handles the tunnel for that site. A point-to-site, or client, VPN connects an individual device running client software. AWS Client VPN and Azure VPN Gateway point-to-site connections support remote users.

Site-to-site VPNs use IPsec. The tunnel ends authenticate each other, often using a shared key or certificates. IKE, Internet Key Exchange, agrees on encryption keys; IPsec then protects packets through the tunnel. A VPN uses a shared internet path even though its contents are encrypted.

Identify both ends

On AWS, a virtual private gateway attaches to one VPC; a transit gateway can serve multiple VPCs. Azure deploys its VPN gateway into a dedicated subnet named GatewaySubnet. Google Cloud offers HA VPN gateways. At the office, a router or firewall with a public address provides the other end; AWS calls it the customer gateway device.

The gateways also need routes. These can be configured statically or learned with BGP, Border Gateway Protocol. BGP lets routers exchange the address ranges they can reach. An encrypted tunnel without the right routes does not give an application a usable end-to-end path.

Follow a private request

Take an office using 192.168.10.0/24 and an AWS VPC using 10.0.0.0/16:

1. The team creates the cloud gateway and configures the office router for the VPN.
2. The office route for 10.0.0.0/16 points into the tunnel.
3. The cloud route for 192.168.10.0/24 points back through the VPN gateway.
4. The application's security group permits the required office traffic.

Office device 192.168.10.25 can now connect to application 10.0.2.15. Its traffic is encrypted between the VPN ends. The non-overlapping ranges let each side tell local destinations from remote ones. Private service names additionally need DNS forwarding; the tunnel does not configure that automatically.

Remove single points of failure

An AWS Site-to-Site VPN connection supplies two tunnels to different AWS endpoints. Configure both so one can carry traffic during maintenance or failure. Azure supports active-active gateways. Google Cloud HA VPN can provide a 99.99% availability SLA with the required redundant tunnel configuration across both interfaces. A second office router and a second internet provider protect against failures that two cloud-side tunnels alone cannot fix.

VPNs can usually be set up in hours using existing internet access. Costs mainly include connection time and data transfer. Internet congestion and distance affect latency and throughput; a standard AWS tunnel supports up to 1.25 Gbps, not a guaranteed sustained transfer rate. A VPN often provides initial access while a dedicated circuit is being installed and later remains as an encrypted backup path. A public website already intended for internet users does not need a site-to-site VPN for those visitors.

Some organizations need a cloud link with steadier performance than an internet path offers. A dedicated private connection joins the organization's network to the provider without crossing the public internet. The services are AWS Direct Connect, Azure ExpressRoute and Google Cloud Interconnect.

Follow the physical path

Cloud providers meet customers and telecom networks at colocation facilities, data centers where many networks have equipment. If the customer's router is already there, a cross-connect, a short physical cable, joins it to the provider's equipment. Otherwise, a telecom or connectivity partner extends a circuit from the office or data center to that meeting point.

Buying the cloud-side port does not remove the need to reach that facility. Installation can involve a letter of authorization, a cross-connect order, a telecom circuit and coordinated testing. Expect weeks of preparation. Charges can include the port, the partner's service, the telecom circuit and transferred data.

Match the service to the capacity

A dedicated port comes in large fixed capacities. AWS Direct Connect offers 1, 10, 100 and 400 Gbps dedicated connections. Partner-provided options, such as AWS hosted connections and Google Partner Interconnect, offer smaller capacity steps, starting at about 50 Mbps. ExpressRoute is commonly supplied through a connectivity provider.

A hosted 50 Mbps link has less capacity than a standard AWS VPN tunnel with a 1.25 Gbps limit. The word “dedicated” describes the connectivity arrangement; it is not a promise to beat every VPN on bandwidth. Compare the actual purchased capacity and measured throughput.

Separate privacy from encryption

Avoiding the shared internet improves performance consistency and supplies a private path. High-capacity circuits support large regular transfers, and private paths can meet requirements that traffic stay off the public internet. AWS data transfer out over Direct Connect also has lower per-gigabyte rates than internet transfer out, although fixed circuit costs still matter.

A private circuit is not encrypted by default. If confidentiality requires encryption, choose a suitable method: TLS in the applications, an IPsec VPN over the private link, or MACsec on supported dedicated ports. TLS protects application sessions; IPsec protects tunneled IP traffic; MACsec encrypts frames on supported links. A requirement to use a private path and a requirement to encrypt traffic must each be met.

Plan for a broken link

One physical circuit can fail because of a cut cable, router failure or facility outage. An ExpressRoute circuit has two connections to two Microsoft edge routers, but critical workloads still benefit from connections through two locations. Two links through the same facility retain that facility as a shared failure point.

A site-to-site VPN can provide a lower-cost backup if the private link fails. Its routes and permissions must be ready, and its lower or more variable throughput must be sufficient for essential traffic. The backup's internet path may not meet a strict requirement that traffic always remain off the internet; availability and path requirements both affect the choice.

Dedicated links reach virtual-network resources through private addressing. With additional configuration, they can also reach supported public cloud services, such as through an AWS public virtual interface or ExpressRoute Microsoft peering. They are network links to the cloud; the organization's existing servers remain where they are.

A connection choice begins with the work it must support. Identify who needs access, how much data moves, the deadline, the required consistency, the setup date, security requirements and the effect of an outage. Different answers lead to different links.

Narrow the choice

A company with 40 office staff and a next-week deadline can start with site-to-site VPN. For 300 employees working separately from home, client VPN gives each device access to internal tools. A bank moving terabytes daily may justify diverse dedicated connections and encryption. A manufacturer awaiting a circuit can use VPN initially and retain it as backup.

Check the transfer window

Bandwidth is link capacity; throughput is the rate actually achieved. Latency is the delay for a trip. A wide link can move a large file quickly while a long distance still makes each round trip slow.

Use decimal data units: 1 GB is one billion bytes and 1 TB is one trillion bytes. Each byte contains 8 bits. Keep the data amount and rate in matching bit units:

A 2 TB backup contains 16 trillion bits. At an effective 500 Mbps, divide by 500 million bits per second to get 32,000 seconds, about 8.9 hours. That misses an 8-hour window. At a sustained 10 Gbps, the calculation gives 1,600 seconds, about 27 minutes. Use effective throughput for a practical estimate; an advertised port speed alone does not account for protocol overhead, contention or a slow source disk.

For an unusually large one-time migration, a network may take too long even when fully used. Sending 500 TB over 1 Gbps takes 4,000,000 seconds, about 46 days. Physical transfer services such as Azure Data Box can move bulk data by shipping a filled device. Compare the whole migration schedule, not just the network transfer.

Check security and failure behavior

A VPN supplies encrypted transport across the internet. A dedicated link supplies a private path and needs encryption added when required. A requirement for both properties calls for both controls. If a dedicated link fails, a VPN backup restores a path but may not move the same data within the original window. Decide which applications must continue and what the backup can carry.

Whatever the transport, check non-overlapping address ranges, routes in both directions, resource firewall permissions and DNS forwarding for private names. A larger circuit cannot fix an address conflict or a missing return route. Likewise, a working tunnel cannot make a private name resolve without the appropriate resolver path.

For the final decision, connect each choice to a stated need. “VPN because the office needs private access tomorrow and traffic is modest” is a usable explanation. “Dedicated because it is faster” leaves out the purchased capacity, the transfer window, the lead time and the failure plan.