Skip to content

VCN and networking

Every OCI compute instance lives inside a Virtual Cloud Network (VCN). Before you provision anything, build a simple VCN and one public subnet.

The shape you're building

VCN (10.0.0.0/16)
└── Public subnet (10.0.0.0/24)
    ├── Route table → Internet Gateway (default route to internet)
    ├── Security list (ingress: SSH, HTTP, HTTPS)
    └── Instances (assigned public IPs)

One VCN, one public subnet, one internet gateway, one route table, one security list. This is deliberately the simplest thing that works — no private subnets, no NAT gateway, no bastion. Every instance gets a public IP and sits directly on the internet.

Trade-off: each instance is directly reachable from anywhere. That's fine for a lab — Ubuntu with SSH keys and nftables is not soft. It would not be fine for a production application with sensitive data.

Use the VCN Wizard

Hamburger menu → Networking → Virtual Cloud Networks → Start VCN Wizard.

Pick Create VCN with Internet Connectivity. This does most of the work for you:

  • Creates the VCN
  • Creates a public subnet and a private subnet
  • Creates and attaches an Internet Gateway
  • Creates a NAT Gateway (⚠️ we'll delete this)
  • Creates a Service Gateway
  • Wires up the route tables

Fill in:

Field Value
VCN Name lab-vcn (or whatever)
Compartment root
VCN CIDR Block 10.0.0.0/16 (default is fine)
Public Subnet CIDR 10.0.0.0/24 (default)
Private Subnet CIDR leave default (you'll delete it)
DNS Resolution ✓ Use DNS hostnames in this VCN

Click Next, then Create.

Delete what you don't need

The wizard creates two things you don't need and one thing that costs money if you're not careful:

Delete the private subnet. You're not using it. Networking → VCN → Subnets → the private one → Terminate.

Delete the NAT Gateway. ⚠️ This one matters — the NAT Gateway is not always-free. It's fine that it exists (nothing uses it, so nothing routes through it, so it costs $0), but delete it to be safe. Networking → VCN → NAT Gateways → Terminate.

Delete the Service Gateway. Not needed for a lab that isn't using OCI's internal object storage. Networking → VCN → Service Gateways → Terminate.

You should now have: - 1 VCN - 1 public subnet - 1 Internet Gateway - 1 route table (routes 0.0.0.0/0 → Internet Gateway) - 1 security list (default; we'll edit)

Ingress rules

The security list is the VCN's stateful firewall — the primary line of defense before packets even hit your instance's own iptables/nftables.

Open the security list: Networking → VCN → Security Lists → Default Security List for lab-vcn (or the name yours got).

Under Ingress Rules, you need three:

Source IP Protocol Source Port Dest Port Notes
0.0.0.0/0 TCP (all) 22 SSH
0.0.0.0/0 TCP (all) 80 HTTP (Let's Encrypt HTTP-01 fallback)
0.0.0.0/0 TCP (all) 443 HTTPS

The wizard-created security list has 22 from 0.0.0.0/0 already. Add 80 and 443.

Optionally: restrict SSH source

For extra safety, restrict the SSH ingress rule to just your home IP (or your VPN's IP). Set the source to <your-ip>/32. Fine while it's stable; painful if your ISP rotates you. Fail2ban (covered in SSH and hardening) is the more resilient protection.

Egress — the default rule (0.0.0.0/0 all protocols) is what you want. Leave it alone.

Public IP allocation

Each compute instance gets exactly 1 free public IP. You have two choices when you provision:

  • Ephemeral IP (default): assigned when the instance boots, released when the instance terminates. Simpler; usually what you want for a lab.
  • Reserved IP: allocated independently, attached to the instance, can be detached and reattached (e.g., moving from one instance to another).

Recommendation: provision with ephemeral IPs first. Once everything works, if you want the IP to survive an instance rebuild, convert the ephemeral IP to a reserved IP after the fact. See instructions in Oracle's docs — it's a two-click operation.

Sanity check

Before you provision any instance, verify:

Networking → VCN → Subnets → Public subnet

Should show:

  • Public subnet: ✓
  • Route Table: default (with a 0.0.0.0/0 → Internet Gateway rule)
  • Security List: default (with your three ingress rules)
  • DHCP Options: default

Networking → VCN → Route Tables → the one attached to the public subnet.

Should show one rule: Destination CIDR 0.0.0.0/0, Target Type Internet Gateway.

If any of those are wrong, fix them before you proceed. Instances with a misconfigured route table look "up" from OCI's perspective but are unreachable from the internet — a confusing failure mode.

Next

Head to Provision the AMD Micro to spin up your first instance.