Complete Network Isolation

Each VPC is a private address space. Instances inside are invisible to the internet until you explicitly expose them.

Subnets, routers, and floating IPs

Segment a network, attach a router, add ports, and expose only the instances that need a floating IP.

VPNaaS for site connectivity

Connect an office, a datacenter, or another private environment to your cloud network without exposing every service on the public internet.

Layer 4 Security Groups

Stateful firewall rules scoped per instance. Allow only the ports and protocols your application actually needs.

Included operations

Private subnets and VPCs
Custom routing tables
Security groups
Floating IP addresses
Network routers
Site-to-site VPNaaS
Network isolation

Useful for

Multi-tier applicationsHybrid cloud setupsSecure environmentsMicroservices

Private networks, subnets, VPNaaS, and access rules to separate environments and limit public exposure.

Technical Specifications

VPCs per organization: No fixed limit
Subnets per VPC: Up to 100
Private IP ranges: RFC 1918, /8 through /28
Floating IPs: Elastic public addresses
VPNaaS: Site-to-site connectivity
Routers: Create and attach per network
Ports: Managed for topology and network mapping

Ready to put this service into a first deployment?

Apply for access

How It Works

Create a VPC

Define your IP address range and the availability zone for the private network.

Add subnets

Segment your address space into subnets for each tier: web, application, database.

Attach instances

Connect compute instances and services to the appropriate subnet with private IPs.

Configure security and exposure

Set firewall rules, attach a router, and assign floating IPs only where public access is actually useful.

Common Use Cases

Multi-Tier Architecture

Separate web, application, and database tiers into isolated subnets with controlled inter-tier traffic policies.

3-tier web applicationsMicroservice meshesInternal API gateways

Controlled public exposure

Expose only the entry points that need it and keep the rest on a private network.

Bastion plus private networkPublic API with private databaseExposed web front with isolated internal services

Site-to-site interconnection

Connect a remote site or an existing network to your VPC so you can extend an existing system without exposing every service individually.

Office-to-cloud connectivityLink to an existing information systemNetwork extension toward a private cluster

Compliance Isolation

Keep sensitive services in private subnets with no direct exposure and explicit network rules.

PCI-DSS scoped network zonesGDPR service isolationNIS2 audit-ready environments

Often Used With

Compute Instances: Virtual machines on demand; →
Load Balancers: One entry point for several instances; →
Managed Kubernetes: Managed clusters available at launch; →

Next step

Not sure which service comes first?

Send the current workload and the target outcome. We help you choose the smallest service set that can run it.

Apply for access Read pricing

Private, Isolated Networking for Your Infrastructure