Virtual Private Cloud & Subnets

Overview

A CloudNexus VPC (Virtual Private Cloud) provides a logically isolated section of the cloud where you can launch resources in a virtual network that you define. You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways.

Architecture & Components

CloudNexus VPCs are built with a modular, layered networking stack designed for performance, security, and scalability. Below is a high-level visualization of how components interact within a standard VPC deployment.

Core Components

Configuration Guide

When provisioning a VPC, you'll define the CIDR block, subnet ranges, DNS settings, and DHCP options. CloudNexus supports IPv4/IPv6 dual-stack and automatically provisions a DHCP server unless disabled.

CIDR Block Requirements

• IPv4 ranges must be between /16 (65,536 addresses) and /28 (16 addresses)
• Cannot overlap with existing VPCs in the same region
• Must not conflict with standard reserved ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) unless explicitly allowed

# CloudFormation / Terraform HCL Example
resource "cloudnexus_vpc" "production" {
  cidr_block           = "10.42.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
  instance_tenancy     = "default"
  tags = {
    Name    = "prod-app-vpc"
    Env     = "production"
    Managed = "terraform"
  }
}

Subnet Sizing Best Practices

Allocate subnets with sufficient headroom for growth. CloudNexus reserves 5 IP addresses per subnet (255, 0, and 3 system addresses). A /24 subnet (255 addresses) is recommended for most workloads, while /20 is preferred for high-density deployments.

Route Tables & Traffic Flow

Each subnet must be associated with exactly one route table. You can attach multiple subnets to a single route table, but not vice versa. Route tables contain rules that control how traffic leaves the VPC.

Security Groups & NACLs

CloudNexus uses a layered security model. Security Groups act as stateful virtual firewalls at the instance level, while Network ACLs provide stateless subnet-level filtering.

Security Group Rules

• Supports allow/deny (default: deny all inbound, allow all outbound)
• References IP ranges, security groups, or prefix lists
• Changes apply immediately without instance restart
• Stateful: return traffic is automatically allowed regardless of rules

# Example: Web Server Security Group
ingress_rules = [
  {
    from_port   = 443
    to_port     = 443
    protocol    = "TCP"
    cidr_blocks = ["0.0.0.0/0"]  # Public HTTPS
  },
  {
    from_port   = 5432
    to_port     = 5432
    protocol    = "TCP"
    source_sg   = "sg-app-tier"  # DB access from app servers
  }
]

Limits & Pricing

CloudNexus VPCs are free to provision. You only pay for the resources deployed inside them and optional networking add-ons.

Frequently Asked Questions