A VPC (virtual private cloud) is an isolated network for your resources. It has one private IPv4 range and one IPv6 range, and you divide them into subnets. Every instance connects to exactly one subnet through its network interface. Instances in different VPCs can’t reach each other over their private addresses.
The following list shows what a VPC contains when you create it:
- A first subnet, with network interfaces attached to it
- A main route table
- A default network ACL
- A default security group
- An attachment to the project’s default DNS policy
A VPC you create has no Internet Gateway. Until you attach one, nothing in the VPC can reach the internet or be reached from it.
Default VPC and a VPC you create
Launching an instance without --subnet-urn uses the project’s default VPC, which the platform creates on first use. It is internet-facing from the start. A VPC you create is private until you attach an Internet Gateway.
| Property | Default VPC | A VPC you create |
|---|---|---|
| Created | By the platform, at the first launch without a subnet | By you, with origin network create-vpc |
| Internet Gateway | Attached from the start | None until you attach one |
| Public IPv4 for new instances | Assigned automatically (auto-assign public IP is on) | Only if you turn auto-assign on for the subnet, or associate a Floating IP |
| Default security group | Admits SSH, HTTP, HTTPS and ICMP from anywhere, and all traffic from members of the group | The same rules |
| Address ranges | A private IPv4 range and an IPv6 range | A private IPv4 range and an IPv6 range |
| Main route table and default network ACL | Yes | Yes |
See Default VPC and Attach and detach an Internet Gateway.
Key concepts
| Concept | Description |
|---|---|
| VPC | An isolated network in one project. Creating it gives you a first subnet, a main route table, a default network ACL that allows all traffic, a default security group, and an attachment to the project’s default DNS policy. |
| Subnet | A slice of the VPC’s IPv4 and IPv6 ranges. A VPC can have many subnets. Each subnet uses one route table and one network ACL, and has a setting that decides whether instances launched into it get a public IPv4 address automatically. |
| Addressing | The rules for VPC ranges, subnet sizes and reserved addresses, and what happens when address space runs out. See VPC and subnet addressing. |
| Default VPC | The VPC the platform creates for a project the first time you launch an instance without naming a subnet. See Default VPC. |
| Network interface | What holds an instance’s private addresses in a subnet and carries its security groups. See Network interfaces. |
What you can do
Limits and quotas
The number of VPCs per organization and project is limited. See Limits.