Delete a subnet or VPC

You can delete a single subnet, or a whole VPC with everything it owns. Both are refused while something still uses the network, and the refusal names what is in the way.

Before you begin

The URN of the subnet or VPC.
Terminate the instances in it, or move your workload elsewhere. See Terminate an instance.
Delete every NAT gateway in it. A NAT gateway holds one of your Floating IPs and is billed until you delete it, so it’s never deleted with its subnet or VPC. See NAT gateways.

What a deletion removes

Deleting a subnet removes the subnet and any unattached network interfaces in it.

Deleting a VPC removes every subnet in it, its route tables, network ACLs, security groups and Internet Gateway. It doesn’t delete the VPC’s DNS policy, because a policy belongs to the project and can serve other VPCs. Delete the policy separately if you no longer need it; see Manage DNS policies.

Delete a subnet

Delete the subnet:
terminal
```
origin network delete-subnet --subnet-urn <subnet-urn>
```
If the command is refused, the message names the network interface or NAT gateway that blocks it. Remove that and run the command again.

Verify that the subnet no longer appears:

terminal

origin network list-subnets --project-urn <project-urn>

Deleting a subnet doesn’t return its range to the VPC, even if it was the VPC’s last subnet. A new subnet in the same VPC gets a different range.

Delete a VPC

Delete the VPC:
terminal
```
origin network delete-vpc --vpc-urn <vpc-urn>
```
The refusal names the subnet and network interface, or each NAT gateway, that blocks it. A blocking interface can be in any of the VPC’s subnets.

Verify that the VPC no longer appears:

terminal

origin network list-vpcs --project-urn <project-urn>

What happens to the address ranges

The VPC’s private IPv4 range is free for your next VPC right away. The VPC’s IPv6 range goes back to the platform, which holds it back for one day before assigning it to another VPC. That gives DNS records and allow-lists that still name the old addresses time to expire.

Other “still in use” refusals

The same rule applies elsewhere in Network. Each of these is refused, with a message naming the reason, until you remove the dependency:

Deleting a network interface that’s attached, or that a Floating IP is still associated with
Deleting a network ACL that a subnet still uses
Deleting a security group that a network interface still carries
Deleting a route table that a subnet still uses
Deleting a DNS policy that a VPC is still attached to
Releasing a Floating IP that’s still associated