Applies toOCI Virtual Cloud Network, DRG, Network Path Analyzer
Which gateway for which traffic
| Traffic | Gateway | Route rule in the subnet's route table |
|---|---|---|
| Public instance ↔ internet | Internet Gateway | 0.0.0.0/0 → IGW. The instance also needs a public IP. |
| Private instance → internet (outbound only) | NAT Gateway | 0.0.0.0/0 → NAT |
| Private instance → OCI services (Object Storage, OCIR, Autonomous DB public endpoints, yum) | Service Gateway | All <region> Services in Oracle Services Network → SGW |
| VCN ↔ on-premises or other VCNs | DRG | <on-prem CIDR> → DRG |
| VCN ↔ VCN in the same region (legacy) | Local Peering Gateway | <peer CIDR> → LPG |
A private subnet usually has both a NAT route for internet and a service gateway route for OCI services.
Check the route table
oci network subnet get --subnet-id $SUBNET --query 'data.{rt:"route-table-id", sl:"security-list-ids", public:"prohibit-public-ip-on-vnic"}'
oci network route-table get --rt-id <rt-ocid> --query 'data."route-rules"[].{dest:destination,type:"destination-type",target:"network-entity-id"}' --output table
Security lists vs NSGs
- Security lists apply to every VNIC in the subnet. NSGs apply to the VNICs you attach them to. Both are evaluated, and traffic is allowed if either allows it.
- Rules are stateful by default. Stateless rules need explicit return-traffic rules, as with AWS NACLs.
- Don't forget the host firewall (
firewalldon Oracle Linux images, iptables on some Ubuntu images).
Network Path Analyzer
Console: Networking → Network Command Center → Network Path Analyzer. Enter the source (an instance, IP or on-premises CIDR), the destination and the port. It evaluates route tables, security lists, NSGs, gateways and DRG route tables, and shows the hop where traffic is dropped, without sending packets.
Common problems
- Instance in a public subnet can't reach the internet: no public IP assigned, or the route table points to a NAT gateway (NAT gateways don't serve public IPs).
- yum/dnf fails in a private subnet: there's no service gateway route, or the route uses the "Object Storage only" CIDR label when you need "All Services".
- On-premises can't reach the VCN: the DRG attachment's route table doesn't import the VCN, or the VCN route table has no route back to the DRG for the on-premises CIDR.
- Overlapping CIDRs between VCNs or with on-premises networks: they can't be routed. Plan your address space early.
Tip
Create a route table per subnet tier (public, app, data) with clear names. Shared "default" route tables edited by several teams are where outages come from.