# OCI Service: OCI Networking Core (VCN, Subnets, Gateways)
# Last verified: 2026-03

service:
  name: "OCI Networking Core"
  id: networking_core
  category: infrastructure

description: "Foundational networking bundle covering Virtual Cloud Networks (VCN), subnets, and gateways. Every OCI deployment depends on these components for connectivity, segmentation, and traffic routing."

components:
  - name: "Virtual Cloud Network (VCN)"
    id: vcn
    description: "Software-defined private network in OCI. Provides the IP address space, DNS, and route table framework for all attached resources."
    when_to_use:
      - "Required for every OCI deployment — compute, database, Kubernetes, and managed services all reside in a VCN"

  - name: "Subnet (Public)"
    id: public_subnet
    description: "Subnet where instances can receive public IP addresses and are reachable from the internet via an Internet Gateway."
    when_to_use:
      - "Load balancers, bastion hosts, or resources that must accept inbound internet traffic"
      - "Dev/test instances needing direct internet access"

  - name: "Subnet (Private)"
    id: private_subnet
    description: "Subnet with no public IP assignment. Resources communicate outbound via NAT Gateway and access OCI services via Service Gateway."
    when_to_use:
      - "Application servers, databases, and backend services that should not be internet-facing"
      - "Any workload subject to security or compliance restrictions on public exposure"

  - name: "Internet Gateway (IGW)"
    id: igw
    description: "Provides a path for inbound and outbound internet traffic to/from resources in public subnets."
    when_to_use:
      - "Public-facing load balancers or bastion hosts need internet connectivity"

  - name: "NAT Gateway"
    id: nat_gateway
    description: "Enables outbound-only internet access for resources in private subnets. No inbound initiation from the internet."
    when_to_use:
      - "Private subnet resources need to pull OS patches, container images, or call external APIs"

  - name: "Service Gateway"
    id: service_gateway
    description: "Private pathway from a VCN to supported OCI services (e.g., Object Storage, Autonomous Database) without traffic traversing the internet."
    when_to_use:
      - "Any private subnet workload that needs to reach OCI Object Storage, streaming, or other supported services"
      - "Backup traffic from databases or compute that should stay on the Oracle backbone"

  - name: "Dynamic Routing Gateway (DRG)"
    id: drg
    description: "Virtual router that connects a VCN to on-premises networks (via FastConnect or IPSec VPN), other VCNs, or remote regions."
    when_to_use:
      - "Hybrid cloud connectivity to on-premises data centers"
      - "VCN-to-VCN peering across regions or tenancies"
      - "Hub-and-spoke network topologies"

  - name: "Local Peering Gateway (LPG)"
    id: lpg
    description: "Connects two VCNs in the same region for private traffic exchange without traversing the internet or a DRG."
    when_to_use:
      - "Intra-region VCN-to-VCN peering when a DRG hub is not needed"
      - "Simple two-VCN peering scenarios"

design_rules:
  - "Allocate a /16 CIDR block per VCN to allow room for future subnet expansion"
  - "Plan CIDR ranges for growth — adding non-overlapping CIDRs later is supported but the original CIDR cannot be changed"
  - "Avoid CIDR overlap with on-premises networks and other VCNs that will be peered"
  - "Create separate subnets per tier (web, app, database) and per availability domain when needed for fault isolation"
  - "Prefer Network Security Groups (NSGs) over Security Lists — NSGs are attached to individual resources and are easier to manage at scale"

gotchas:
  - id: vcn_cidr_immutable
    severity: HIGH
    description: "A VCN's original CIDR block cannot be modified or removed after creation. Additional non-overlapping CIDRs can be added, but plan the initial range carefully."

  - id: security_rule_limit
    severity: MEDIUM
    description: "Each security list supports a maximum of 200 rules (ingress + egress combined). For complex environments, use multiple NSGs instead of overloading a single security list."

  - id: service_gateway_required
    severity: HIGH
    description: "Resources in private subnets cannot reach OCI services (Object Storage, Autonomous Database, etc.) without a Service Gateway and corresponding route rule. This is a common misconfiguration."

  - id: drg_required_hybrid
    severity: MEDIUM
    description: "A DRG is required for FastConnect, IPSec VPN, and cross-VCN peering via transit routing. Plan DRG attachment early — retrofitting routing later adds complexity."

references:
  documentation: "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/overview.htm"
  vcn_best_practices: "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/bestpractices.htm"

changelog:
  - date: "2026-03-14"
    contributor: { name: "Diego Cabrera", team: "Field Architecture" }
    change: "Initial creation with VCN, subnets, gateways, DRG design rules and gotchas"