Cloud Networking Basics: VPCs, Subnets and Gateways

Cloud networking is a small number of concepts with different names on every platform. Learn the concepts once.

15 March 2026 3 min read

Every cloud platform gives you a private network, divides it into subnets, and provides gateways to the outside world. The names differ. The model does not.

The vocabulary

Concept	AWS	Azure	Google Cloud
Private network	VPC	Virtual Network	VPC network
Subdivision	Subnet	Subnet	Subnet
Outbound for private hosts	NAT Gateway	NAT Gateway	Cloud NAT
Internet entry point	Internet Gateway	Implicit	Default route
Instance firewall	Security Group	Network Security Group	Firewall rules
Private service access	VPC Endpoint	Private Endpoint	Private Service Connect

One structural difference worth knowing: AWS and Azure subnets are zonal or regional per subnet, while Google Cloud subnets span an entire region. It affects how you lay out a multi-zone design.

Public and private subnets

The distinction is entirely about routing, not about a setting called “public”.

Public subnet — has a route to an internet gateway. Instances with a public address are reachable from the internet.
Private subnet — no direct internet route. Instances reach out through a NAT gateway and cannot be reached inbound.

The standard layout: load balancers and bastion hosts in public subnets; application servers and databases in private ones. Nothing holding data should be publicly routable.

Plan the address space before you build

Choose a private range — 10.0.0.0/8 gives the most room.
Allocate a distinct block per environment, so production and staging never overlap.
Leave gaps between allocations for growth.
Avoid overlapping with anything you might later connect to — an office network, a partner, another cloud.
Size subnets generously. Growing them later ranges from awkward to impossible.
Write the plan down. Address allocation lives longer than most infrastructure decisions.

Overlapping address ranges is the mistake that surfaces years later when you try to connect two networks and cannot. It is trivial to avoid at the start and expensive to fix afterwards.

NAT gateways cost real money

A NAT gateway bills hourly plus per gigabyte processed. In a three-zone design with one per zone, running continuously, that becomes a meaningful line item — sometimes more than the instances behind it.

Use private endpoints for provider services, so that traffic bypasses NAT entirely.
Consider one NAT gateway shared across zones for non-critical workloads, accepting the availability trade.
For low-traffic private instances, a small NAT instance can be much cheaper than a managed gateway.
Check what is actually generating outbound traffic; it is often package downloads that could be cached.

Connecting networks

Method	Use for	Note
VPC peering	Two networks, same or different accounts	Not transitive
Transit gateway / hub	Many networks	Simplifies a mesh into a hub and spoke
VPN	Office or on-premises connectivity	Over the internet, encrypted
Direct connection	High bandwidth to on-premises	Dedicated circuit, higher cost
Private service connect	Provider services without internet	Reduces cost and exposure

Peering not being transitive catches people out: if A peers with B and B peers with C, A cannot reach C. That is what transit gateways exist to solve.

What VPS providers offer

Hetzner, DigitalOcean, Linode, UpCloud and others provide private networking that covers the common case well — a private network per region, instances communicating over private addresses, and a cloud firewall.

What is usually absent is the deeper machinery: transit gateways, sophisticated routing, private service endpoints. For a single-region application that is rarely a limitation.

Common questions

Do I need multiple subnets?

Yes, at minimum public and private, and ideally one of each per availability zone. Many managed services require subnets in at least two zones.

Can I change a VPC address range later?

Additional ranges can be added on most platforms; the primary range generally cannot be changed. Plan it once, properly.

Is private networking traffic free?

Within one availability zone, usually yes. Across zones it is often billed in both directions, which surprises people in multi-zone designs.

Do I need a bastion host?

It is the traditional approach. Provider session managers — connecting through the control plane rather than SSH — are increasingly better, since there is no exposed port at all.

Where to go next

See security groups and firewalls and private networking and VPNs.

AWS Google Cloud Microsoft Azure