What Is Virtual Private Cloud?

Overview

The Virtual Private Cloud (VPC) service enables you to provision logically isolated and private virtual networks for cloud resources, such cloud servers, containers, and databases. You can customize subnets, security groups, network ACLs, and assign EIPs and bandwidths. With Direct Connect or Virtual Private Network (VPN), you can connect your VPCs to an on-premises data center.

The VPC service uses network virtualization technologies, such as link redundancy, distributed gateway clusters, and multi-AZ deployment, to ensure network security, stability, and availability.

Product Architecture

The product architecture consists of the VPC components, security features, and VPC connectivity options.

Figure 1 Architecture

VPC Components

Each VPC consists of a private CIDR block, route tables, and at least one subnet.

Private CIDR block: When creating a VPC, you need to specify the private CIDR block used by the VPC. The VPC service supports the following CIDR blocks: 10.0.0.0 – 10.255.255.255, 172.16.0.0 – 172.31.255.255, and 192.168.0.0 – 192.168.255.255
Subnet: Cloud resources, such as cloud servers and databases, must be deployed in subnets. After you create a VPC, divide the VPC into one or more subnets. Each subnet must be within the VPC. For more information, see Subnet.
Route table: When you create a VPC, the system automatically generates a default route table. The route table ensures that all subnets in the VPC can communicate with each other. If the routes in the default route table cannot meet application requirements (for example, an ECS without an elastic IP address (EIP) bound needs to access the Internet), you can create a custom route table. For more information, see Example Custom Route in a VPC and Example Custom Route Outside a VPC.

Security Features

Security groups and network ACLs ensure the security of cloud resources deployed in a VPC. A security group acts as a virtual firewall to provide access rules for instances that have the same security requirements and are mutually trusted in a VPC. For more information, see Security Group Overview. A network ACL can be associated with subnets that have the same access control requirements. You can add inbound and outbound rules to precisely control inbound and outbound traffic at the subnet level. For more information, see Network ACL Overview.

VPC Connectivity

HUAWEI CLOUD provides multiple VPC connectivity options to meet diverse requirements. For details, see Application Scenarios.

VPC Peering allows two VPCs in the same region to communicate with each other using private IP addresses.
Elastic IP or NAT Gateway allows ECSs in a VPC to communicate with the Internet.
Virtual Private Network (VPN), Cloud Connect, or Direct Connect can connect a VPC to your data center.

Accessing the VPC Service

You can access the VPC service through the management console or using HTTPS-based APIs.

Management console
You can use the console to directly perform operations on VPC resources. To access the VPC service, log in to the management console and select Virtual Private Cloud from the console homepage.
API
If you need to integrate the VPC service provided by the cloud system into a third-party system for secondary development, you can use APIs to access the VPC service. For details, see the Virtual Private Cloud API Reference.