Private Networking and VPNs for Cloud Infrastructure

Private networks between your own servers

Every provider offers a private network within a region. Instances get a private address and communicate over it without touching the internet.

• Traffic within one zone is usually free; cross-zone often is not.
• It is faster, since it stays within the provider network.
• It is not automatically encrypted — it is private, not confidential. Use TLS for anything sensitive.
• Firewall rules still apply and still matter. Treat the private network as semi-trusted, not trusted.

The last point is worth internalising. Lateral movement after an initial compromise is exactly what internal firewall rules limit.

Reaching private resources

Session managers — connecting through the provider’s control plane with IAM-based authorisation and full audit logging — are the strongest option where available, because no SSH port is exposed at all.

WireGuard and mesh VPNs

WireGuard is fast, simple and built into modern Linux kernels. Mesh products built on it create an encrypted private network across machines regardless of which provider they sit in.

• Works across providers, which plain provider networking does not.
• Each machine gets a stable private address that survives address changes.
• Authentication can tie into your existing identity provider.
• Access can be scoped per user and per machine, which a flat VPN cannot do.

For a small team spanning several providers, this is often simpler and better than building peering and VPN gateways.

Private endpoints for provider services

By default, calls from your instances to object storage, managed databases and provider APIs go over the internet or through a NAT gateway. Private endpoints keep that traffic inside the provider network.

1. Lower latency, since the path is shorter.
2. Lower cost, because NAT processing charges are avoided.
3. Better security, since the traffic never traverses the internet.
4. Often required for compliance, and easy evidence to produce.

For estates with significant traffic to object storage, this frequently pays for itself in avoided NAT charges alone.

A sound default layout

• Load balancer in a public subnet — the only thing with a public address.
• Application servers in a private subnet, reachable only from the load balancer.
• Database in a private subnet, reachable only from application servers.
• Outbound access through NAT, or private endpoints where available.
• Administrative access through a session manager or a bastion, never direct SSH from the internet.
• Firewall rules between each tier, not only at the perimeter.

This is the standard three-tier layout and it is standard because it works. Anything holding data has no route from the internet.

Common questions

Where to go next

See cloud networking basics and security groups and firewalls.