OCI Networking Explained: VCNs, Subnets, Gateways and Hybrid Connectivity
Networking is where OCI newcomers lose the most time. The concepts are logical once they click — a private data centre you define in software — but the gateways and routing catch everyone out. Here is the map.
The Virtual Cloud Network is your private network
A VCN (Virtual Cloud Network) is a software-defined private network in an OCI region — your own address space, divided into subnets. Subnets can be public (resources may have public IPs) or private (no direct internet exposure), and traffic is controlled by route tables plus stateful firewall rules in security lists or, more precisely, Network Security Groups (NSGs) attached to individual resources.
The gateways — and what each is for
- Internet Gateway — two-way internet access for resources in public subnets.
- NAT Gateway — lets private-subnet resources reach the internet outbound (for patches, APIs) without being reachable inbound.
- Service Gateway — private access to OCI services (like Object Storage) without traffic leaving Oracle's network — no internet path at all.
- Dynamic Routing Gateway (DRG) — the hub for connectivity to on-premises and to other VCNs.
Design principle: put workloads in private subnets by default. Use a NAT Gateway for outbound needs and a Service Gateway for OCI services. Only what genuinely must accept inbound internet traffic belongs in a public subnet, behind tight NSGs.
Connecting OCI to your data centre
Two options, via the DRG:
- Site-to-Site VPN — encrypted tunnels over the public internet. Quick to stand up, good for lower-bandwidth or backup links.
- FastConnect — a dedicated, private connection to OCI. Consistent latency and higher bandwidth, for production hybrid workloads that need it.
Most enterprise EBS-on-OCI and hybrid estates use FastConnect for the primary link with VPN as backup.
Related: networking is central to disaster recovery — see Oracle EBS disaster recovery on OCI, and the OCI knowledge hub for the full picture.
Designing your OCI network or hybrid link?
We design OCI VCNs, subnet and gateway topology, and FastConnect/VPN hybrid connectivity — secure by default, and built to carry production Oracle workloads.
Explore the OCI Knowledge Hub
