OCI networking: security lists, NSGs, the DRG and the gateway you will forget
A VCN looks like a VPC until you meet the four gateway types and two firewall models. Here is the layout we build and the specific choices that avoid rework.
Oracle Cloud's networking is close enough to a VPC that people move fast and close enough to be different that they get caught. The VCN, subnets and route tables behave as expected. The gateways and the two firewall models do not.
Four gateways, and what each is for
- Internet Gateway — bidirectional internet access for public subnets. Attach it, route
0.0.0.0/0to it, and resources with public IPs are reachable. - NAT Gateway — outbound-only internet for private subnets. What you want for almost every compute resource.
- Service Gateway — private access to OCI services (Object Storage, Autonomous Database and the rest) without traversing the internet or the NAT gateway. This is the one people forget, and forgetting it means your backup traffic to Object Storage goes out through NAT and gets billed as egress. It is free. Attach it in every VCN that talks to OCI services and route the service CIDR label to it.
- Dynamic Routing Gateway (DRG) — the hub for VPN, FastConnect and VCN-to-VCN routing. The modern DRG supports attachments with their own route tables, which makes it a proper transit hub rather than just a VPN terminator.
Security lists or network security groups: use NSGs
OCI has two firewall models and they both apply, which is a genuine source of confusion.
Security lists attach to a subnet and apply to everything in it. Network security groups attach to VNICs and can reference other NSGs as a source — the same pattern that makes security groups maintainable on AWS.
Use NSGs. An NSG rule saying "allow 5432 from the app-nsg" survives every subnet change, whereas a security list rule with a CIDR needs revisiting each time the topology moves. Keep the default security list minimal — it applies to everything in the subnet and it is the thing that silently permits traffic you thought you had blocked.
The rule we apply everywhere: no 0.0.0.0/0 ingress except on the load balancer's HTTPS listener, and no SSH port open at all — use the OCI Bastion service, which creates a time-limited session rather than an open port.
The VCN layout
Standard three-tier per region:
- Public subnet — load balancers and the NAT gateway only.
- Private subnet — compute, application servers, OKE node pools.
- Database subnet — Autonomous Database private endpoints, DB systems, with no route to the internet gateway at all.
Regional subnets rather than AD-specific ones, unless you have a specific reason. Regional subnets span availability domains and make the high-availability story simpler.
Plan the CIDR from a documented allocation, not from the default. As on every cloud, an overlapping range is the mistake you cannot undo cheaply — the same trap as the VPC decisions you cannot undo. Check whether your target region has one availability domain or three before you design for AD redundancy, because several do not have three.
Connecting to on-premises and to other clouds
Site-to-site VPN over the DRG for modest bandwidth, with two tunnels for redundancy. Straightforward and fast to set up.
FastConnect for dedicated bandwidth. Three models: a colocation cross-connect, a partner connection through a telco, or a public peering for OCI services. The partner route is how most organisations do it and the lead time is measured in weeks, so start early if it is on the critical path for a migration.
FastConnect also supports direct private connectivity to other clouds through the interconnect arrangements, which is the mechanism behind most multicloud database-plus-application designs.
The cost lines to watch
Egress pricing is OCI's advantage — see why OCI bills look different — but three things still cost money and surprise people:
- NAT gateway data processing for traffic that should have gone through the service gateway.
- Cross-AD traffic between components that could have been co-located, the same issue as cross-AZ traffic elsewhere.
- FastConnect port hours for a circuit provisioned during a migration and never decommissioned.
Observability
Enable VCN flow logs to OCI Logging, set a sensible retention, and build the saved search before you need it. As everywhere, the value of flow logs appears during an incident and only if someone set them up in advance. Add the Network Path Analyzer to your toolkit — it traces a path through your route tables and firewall rules and tells you which rule blocks a connection, which turns a two-hour debugging session into a two-minute one.
We build this layout at the start of an OCI engagement, alongside the compartment structure, because both are hard to change once workloads land.
What to do this week
Check whether every VCN that talks to Object Storage has a service gateway with the right route rule. If any does not, that traffic is going through the NAT gateway and being billed as data processing for no reason. It is a ten-minute fix.