How do virtual networks work?

A VPC or VNet is a private address space inside a provider region. You choose a CIDR block, carve it into subnets, attach route tables, and decide which gateways or endpoints can reach it. Resources outside the network cannot route to it unless you explicitly connect them.

resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

resource "aws_subnet" "public_a" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "ap-south-1a"
}

Core building blocks

• CIDR block: the overall private range, sized with future growth in mind
• Subnets: smaller ranges in one AZ, usually split into public, private and isolated tiers
• Route tables: decide where traffic for each destination goes
• Gateways and endpoints: internet gateway, NAT, VPN, peering, private link or transit gateway
• Security controls: security groups, network ACLs, firewall policies and flow logs

Plan address space before you build. Overlapping CIDRs across VPCs, acquisitions or on-premises networks make peering and hybrid connectivity painful, and renumbering a live network is a major project.