Series: Setting up Oracle Cloud VM - II

Pratik Chandra

Pratik Chandra

— 2 min read

This is a continuation from: [[001 Signing up for new Oracle Cloud Account]]

✅ Step 2: Setup Virtual Cloud Network (VCN)

🎯 Goal:

Create a custom VCN with:

  • One public subnet (for your reverse proxy VM with Traefik)
  • One or more private subnets (for internal VMs like Keycloak, Supabase, Redis, etc.)
  • Allow internal communication and secure public access only where needed

🔹 2.1. Key Concepts (for certification + blog)

TermExplanation
VCN (Virtual Cloud Network)Your private, isolated cloud network in OCI
SubnetA logical division of a VCN (either public or private)
Internet Gateway (IG)Allows outbound/inbound access to the internet
NAT GatewayLets private subnet instances access the internet (outbound only)
Security List / NSGActs like a firewall – controls traffic rules
Route TableDetermines how traffic is routed within or outside the VCN
📘 DevOps Certification Tip: You're expected to know how to design and secure VCNs using subnets, gateways, and security lists.

🛠️ 2.2. Create VCN (with subnets, route table, gateways)

  1. Go to: ☰ Networking → Virtual Cloud Networks
  2. Click Create VCN
  3. Choose "VCN with Internet Connectivity"
  4. Fill details:
FieldValue
Namehomelab-vcn
CIDR block10.0.0.0/16
DNS labelhomelab (auto-filled)
Create Internet Gateway✅ Yes
Create NAT Gateway✅ Yes (for private subnet)
Enable DNS resolution✅ Yes
Create Service Gateway⬜ Skip (not needed for now)
    • Name: public-subnet
    • CIDR: 10.0.0.0/24
    • Subnet type: Regional
    • Route Table: attach with Internet Gateway
    • DHCP Options: default
    • DNS Label: public
  1. Create a private subnet:
    • Name: private-subnet
    • CIDR: 10.0.1.0/24
    • Subnet type: Regional
    • Route Table: attach with NAT Gateway
    • DNS Label: private

Create a public subnet:

🔐 2.3. Security Lists (Firewall rules)

For both public and private subnets:

  • Allow intra-VCN traffic (default rule)
  • Add custom ingress rules based on services (later, e.g., 8080 for Keycloak, 443 for Traefik)

Example: for public subnet

Source CIDR: 0.0.0.0/0
Protocol: TCP
Port Range: 80, 443
Description: Allow HTTP/HTTPS to Traefik

✅ What You Have After This

ResourceDescription
homelab-vcnMain VCN for project
public-subnetHosts Traefik reverse proxy
private-subnetHosts Keycloak, Postgres, Supabase, Redis
Internet GatewayPublic internet access
NAT GatewayAllows private subnet to fetch updates
Security ListsBasic firewall rules

✅ Summary

TaskStatus
Created custom VCN (homelab-vcn)✅
Set up public and private subnets✅
Configured route tables + gateways✅
Allowed minimal, secure firewall rules✅

See you in next part: [[003 Creating Traefik VM Instance]]

Read more