# VPCs and subnets

A VPC is an isolated network with its own address space, divided into subnets. Learn what a VPC comes with and how instances connect to it.

A VPC (virtual private cloud) is an isolated network for your resources. It has one private IPv4 range and one IPv6 range, and you divide them into subnets. Every instance connects to exactly one subnet through its network interface. Instances in different VPCs can’t reach each other over their private addresses.

The following list shows what a VPC contains when you create it:

- A first subnet, with network interfaces attached to it
- A main route table
- A default network ACL
- A default security group
- An attachment to the project’s default DNS policy

A VPC you create has no Internet Gateway. Until you attach one, nothing in the VPC can reach the internet or be reached from it.

## Default VPC and a VPC you create [#default-vpc-and-a-vpc-you-create]

Launching an instance without `--subnet-urn` uses the project’s default VPC, which the platform creates on first use. It is internet-facing from the start. A VPC you create is private until you attach an Internet Gateway.

| Property | Default VPC | A VPC you create |
| --- | --- | --- |
| Created | By the platform, at the first launch without a subnet | By you, with `origin network create-vpc` |
| Internet Gateway | Attached from the start | None until you attach one |
| Public IPv4 for new instances | Assigned automatically (auto-assign public IP is on) | Only if you turn auto-assign on for the subnet, or associate a Floating IP |
| Default security group | Admits SSH, HTTP, HTTPS and ICMP from anywhere, and all traffic from members of the group | The same rules |
| Address ranges | A private IPv4 range and an IPv6 range | A private IPv4 range and an IPv6 range |
| Main route table and default network ACL | Yes | Yes |

See [Default VPC](/docs/network/vpcs/default-vpc) and [Attach and detach an Internet Gateway](/docs/network/internet-access/internet-gateways).

## Key concepts [#key-concepts]

| Concept | Description |
| --- | --- |
| VPC | An isolated network in one project. Creating it gives you a first subnet, a main route table, a default network ACL that allows all traffic, a default security group, and an attachment to the project’s default DNS policy. |
| Subnet | A slice of the VPC’s IPv4 and IPv6 ranges. A VPC can have many subnets. Each subnet uses one route table and one network ACL, and has a setting that decides whether instances launched into it get a public IPv4 address automatically. |
| Addressing | The rules for VPC ranges, subnet sizes and reserved addresses, and what happens when address space runs out. See [VPC and subnet addressing](/docs/network/vpcs/addressing). |
| Default VPC | The VPC the platform creates for a project the first time you launch an instance without naming a subnet. See [Default VPC](/docs/network/vpcs/default-vpc). |
| Network interface | What holds an instance’s private addresses in a subnet and carries its security groups. See [Network interfaces](/docs/network/vpcs/network-interfaces). |

<Callout type="note">

Instances in different subnets of one VPC reach each other through the VPC’s router, which serves a VPC only while it has an Internet Gateway attached. In a VPC without an Internet Gateway, only instances in the same subnet can reach each other. To connect instances across subnets, attach an Internet Gateway; see [Attach and detach an Internet Gateway](/docs/network/internet-access/internet-gateways).

</Callout>

## What you can do [#what-you-can-do]

- [Create a VPC and subnets](/docs/network/vpcs/create)
- [Delete a subnet or VPC](/docs/network/vpcs/delete)

## Limits and quotas [#limits-and-quotas]

The number of VPCs per organization and project is limited. See [Limits](/docs/platform/reference/limits).

## Related [#related]

- [Internet access](/docs/network/internet-access)
- [Traffic control](/docs/network/traffic-control)
- [DNS](/docs/network/dns)
- [`origin network` commands](/docs/network/reference/cli)