How OCI network charges work (simplified)
| Traffic | Typical charge |
|---|---|
| Inbound data | Free |
| Outbound to internet | A monthly free allowance per tenancy, then per GB by region group |
| Within an availability domain / region between your resources | Generally free |
| Cross-region (remote peering, replication) | Charged per GB |
| FastConnect | Port-hour charge; no per-GB data transfer charge on FastConnect itself |
| Network Firewall | Per hour + data processed |
Check the current price list for your regions. Allowances and rates change.
1. Break down the bill
Cost Analysis → filter service Networking (and Network Firewall), group by SKU and compartment. The SKU names tell you whether it's internet egress, cross-region transfer, FastConnect ports or firewall processing.
2. Use the service gateway for Oracle services
Instances in private subnets reaching Object Storage or other Oracle Services Network endpoints through a NAT gateway is an extra hop and unnecessary egress. A service gateway keeps it private:
oci network service list --query 'data[?contains(name, `All`)].{id:id, name:name}'
oci network service-gateway create --compartment-id $C --vcn-id $VCN \
--services '[{"serviceId": "<all-services-ocid>"}]'
Add a route rule in the private subnets' route table: destination All <region> Services In Oracle Services Network → service gateway. Bucket policies or IAM conditions that check source IPs may need updating (request.vcn.id conditions are an option).
3. Internet egress
| Source of egress | Fix |
|---|---|
| Users downloading large files directly from instances/buckets | Use a CDN in front, compress, cache |
| Backups or data sent to another provider | Is the copy needed? Compress and deduplicate |
| Chatty integrations calling external APIs | Cache responses, batch calls |
| Package and image downloads on every boot | Internal mirrors, custom images, OCIR |
4. Cross-region traffic
- Object Storage replication, block volume cross-region replication, Data Guard to another region: keep for DR-tier systems; review for lower tiers.
- Logs or metrics shipped to a "central" region: consider regional collection with local archives.
- Remote peering between regions for app traffic: keep chatty tiers in the same region.
5. Network Firewall and hub traffic
Routing all east-west traffic between spokes through the Network Firewall adds per-GB processing. Inspect where it adds security value (north-south, sensitive zones), and allow trusted, high-volume flows more directly where your security model permits. Document every exception.
6. FastConnect vs VPN
For steady, high data volumes to on-premises, FastConnect's port-hour model (no data charge on the circuit) can be cheaper and more predictable than internet-based transfers. Size the port to measured traffic, plus redundancy.
7. Make it visible
Monthly: network cost by SKU and compartment, top talkers from VCN flow logs (when enabled for investigation), owners for each large flow.
Tip
Many tenancies never use their full free egress allowance. Check whether network cost is significant at all before spending time on it. Firewall processing and cross-region replication are usually the bigger items.
Checklist
- Network cost broken down by SKU and compartment
- Service gateway for Oracle Services Network traffic
- Internet egress sources reviewed
- Cross-region transfers justified by DR or business need
- Firewall inspection scope reviewed
- FastConnect sized for steady volumes