Home / OCI

OCIHow-toIntermediate

OCI network foundation: hub-and-spoke with DRG, Network Firewall and private DNS

Connect spoke VCNs and on-premises through a Dynamic Routing Gateway, route traffic through a hub VCN firewall, and set up private DNS views and resolvers for hybrid name resolution.

Deepak Bhardwaj2 min read

Applies toOCI VCN, Dynamic Routing Gateway (DRG v2), OCI Network Firewall, OCI DNS private resolvers

Layout

On-premises ── FastConnect / IPSec ──┐
                                     ▼
                                    DRG ──── remote peering (DR region DRG)
                         ┌───────────┼───────────┐
                    hub-vcn      spoke-app-vcn   spoke-db-vcn
               (Network Firewall)

1. CIDR plan

Non-overlapping ranges for every VCN, on-premises and the DR region (for example 10.10.0.0/16 Mumbai, 10.20.0.0/16 Hyderabad). VCN CIDRs can be extended later but not shrunk.

2. DRG attachments and route tables

  • Attach the hub and spoke VCNs to the DRG.
  • DRG route tables: spokes' attachments use a route table that sends everything to the hub VCN attachment (where the firewall is). The hub attachment's table imports spoke and on-premises routes.
  • VCN ingress route table on the hub's DRG attachment sends incoming traffic to the Network Firewall private IP.
oci network drg-attachment list --drg-id ocid1.drg.oc1.ap-mumbai-1.aaaa... --query "data[].{name:\"display-name\",type:\"network-details\".type}" --output table

3. Subnet routing in spokes

Spoke subnet route table: 0.0.0.0/0 → DRG (or specific prefixes), so traffic goes to the hub for inspection. Services traffic (Object Storage, OCIR) can go via a service gateway in each VCN to avoid firewall load, if your security policy allows.

4. Security lists vs NSGs

Prefer network security groups attached to VNICs (rules reference other NSGs, like "app-nsg may reach db-nsg on 1521"). Keep security lists minimal.

5. Private DNS

  • Each VCN has a private DNS resolver and default view.
  • Create private zones in a shared view and attach the view to every VCN's resolver.
  • For hybrid DNS: resolver listening endpoint (on-premises → OCI) and forwarding endpoint with rules (OCI → on-premises domains).

6. HA and DR

  • FastConnect: two virtual circuits on two providers/locations; IPSec: two tunnels per connection, BGP preferred.
  • DRG is a regional, highly available service.
  • Remote peering connection (RPC) between the primary and DR region DRGs carries replication traffic (Data Guard, block volume replication) privately.
oci network remote-peering-connection list --compartment-id <cmp-network-ocid> --output table

Tip

When something can't connect in OCI, check four places in order: subnet route table, DRG route table (and import distribution), NSG/security list on both ends, and the OS firewall. Network Path Analyzer automates most of this.

Related fixes