Cloud Networking: VPCs, Load Balancing, DNS, and More
Your application is deployed, users are arriving, and then the calls start. Some users in Southeast Asia report loading times of over twelve seconds. Others in South America cannot reach the site at all. You check the dashboards and see that all traffic routes through a single load balancer in Northern Virginia. The problem is not your application code, it is your network architecture. Cloud networking determines how users experience your application, and getting it wrong erases every other optimization you have made.
Cloud networking builds on the same TCP/IP foundations that have powered the internet for decades, but the implementation differs fundamentally from on-premises networking. Virtualization, software-defined constructs, and API-driven management replace physical routers, switches, and cables. Understanding cloud computing basics provides the foundation for grasping these software-defined networking concepts and how they create both new capabilities and new failure modes.
Virtual Private Cloud
The Virtual Private Cloud is the fundamental networking construct in every major cloud provider. A VPC creates an isolated virtual network within the cloud provider’s infrastructure. You control the IP address range, subnets, route tables, and network gateways. Resources inside the VPC can communicate with each other, but traffic between VPCs or between the VPC and the internet requires explicit configuration.
Each VPC is assigned a CIDR block, a range of IP addresses from which subnets are allocated. The CIDR block must be chosen carefully because it cannot be changed after creation. Overlapping IP ranges cause connectivity problems when VPCs are connected through peering or VPN. The standard practice is to use RFC 1918 private address space, typically a /16 network such as 10.1.0.0/16, which provides 65,536 addresses.
Subnets and Availability Zones
Subnets segment a VPC into smaller networks, typically aligned with availability zones. A subnet in one availability zone remains isolated from failures in other zones. Placing resources in multiple subnets across different availability zones provides high availability without a single point of network failure.
Subnets can be public or private. Public subnets have a route to an internet gateway and can host resources that need direct internet access, such as load balancers and bastion hosts. Private subnets have no direct internet route and host internal resources such as databases and application servers. Traffic between private subnets and the internet flows through a Network Address Translation gateway in a public subnet.
Load Balancing
Load balancers distribute incoming traffic across multiple targets to improve availability and performance. Cloud providers offer managed load balancing services that handle health checks, SSL termination, and automatic scaling. AWS Elastic Load Balancing, Azure Load Balancer, and Google Cloud Load Balancing provide similar capabilities with slight differences in feature sets.
Application Load Balancers
Application load balancers operate at Layer 7 of the OSI model and make routing decisions based on HTTP request attributes. They can route traffic based on URL path, host header, HTTP method, and query parameters. This capability enables sophisticated traffic management patterns such as canary deployments, A/B testing, and path-based routing to different backend services.
An e-commerce platform might route requests to /api/* to a microservice cluster and requests to /static/* to a CDN origin. The same load balancer can direct five percent of traffic to a new version of the checkout service while sending ninety-five percent to the stable version. These routing rules are updated through the cloud provider’s API or infrastructure-as-code templates without any downtime.
Network Load Balancers
Network load balancers operate at Layer 4 and handle TCP, UDP, and TLS traffic. They offer lower latency and higher throughput than application load balancers because they do not inspect packet contents. Network load balancers are ideal for workloads that require extreme performance, such as real-time gaming, trading platforms, and DNS services.
A network load balancer can handle millions of requests per second while maintaining single-digit millisecond latency. Each load balancer node in each availability zone receives a static IP address, which simplifies firewall rules and DNS configuration.
DNS and Traffic Management
DNS translates human-readable domain names into IP addresses. Cloud providers offer managed DNS services such as Amazon Route 53, Azure DNS, and Google Cloud DNS that provide global resolution with low latency and high availability.
DNS-based traffic management enables sophisticated routing policies. Latency-based routing directs users to the region with the lowest latency. Geolocation routing directs users based on their physical location. Weighted routing distributes traffic across multiple endpoints according to specified proportions.
CDN Integration
Content Delivery Networks cache static and dynamic content at edge locations close to users. Cloud CDN, Amazon CloudFront, and Azure CDN integrate with cloud storage and compute services to accelerate content delivery. A well-configured CDN reduces latency by caching responses at hundreds of points of presence worldwide.
A media company serving video content to a global audience might use CloudFront with origin shielding, which aggregates cache requests from multiple edge locations to reduce load on the origin server. Cache hit rates above ninety percent are common for static content, dramatically reducing origin server costs and improving user experience.
Hybrid Connectivity
Many organizations maintain a hybrid architecture with workloads running both on-premises and in the cloud. Hybrid connectivity establishes secure, reliable network connections between the two environments.
VPN Connections
Site-to-site VPN connections encrypt traffic between an on-premises VPN gateway and a cloud VPN gateway over the public internet. VPN connections are quick to set up and suitable for development environments, management traffic, and workloads that tolerate internet latency variability.
The trade-off is that VPN performance depends on internet conditions. Throughput is limited by the VPN gateway specifications, typically one to several gigabits per second. For higher bandwidth or more consistent performance, dedicated connections are preferable.
Direct Connect and ExpressRoute
Dedicated network connections provide private, high-bandwidth connectivity between on-premises data centers and cloud providers. AWS Direct Connect, Azure ExpressRoute, and Google Cloud Dedicated Interconnect offer throughput from one gigabit per second to one hundred gigabits per second.
A dedicated connection bypasses the public internet entirely, providing more consistent latency and higher throughput. Financial services firms that process high-frequency trading data rely on dedicated connections for the deterministic network performance they require.
Security Groups and Network ACLs
Cloud networking security relies on two layers of access control. Security groups act as virtual firewalls at the instance level, controlling traffic allowed to and from individual resources. Network Access Control Lists operate at the subnet level, providing stateless filtering of traffic entering and exiting subnets.
Security groups are stateful, meaning that if you allow inbound traffic on a port, the response traffic is automatically allowed regardless of outbound rules. Network ACLs are stateless and require explicit rules for both inbound and outbound traffic. The recommended practice is to use security groups for most access control and reserve network ACLs for broad subnet-level rules such as blocking specific IP ranges.
A well-designed cloud security guide applies these networking controls alongside identity and access management policies to create defense in depth. Security groups should follow the principle of least privilege, allowing only the specific traffic required for each resource to function.
Global Accelerators and Anycast
Global accelerators improve application performance for users worldwide by directing traffic to the optimal endpoint using the AWS Global Accelerator or Azure Front Door. These services use anycast IP addresses announced from multiple edge locations. When a user sends a request, the request arrives at the nearest edge location where the anycast IP is advertised, reducing network hops and latency.
A travel booking platform with users across North America, Europe, and Asia deployed AWS Global Accelerator and observed a forty percent reduction in average response time. The service also provided static IP addresses that functioned as a fixed entry point even as the underlying infrastructure changed, simplifying firewall configuration for customers with stringent network security requirements.
FAQ
What is a VPC and why do I need one? A VPC is a virtual private network in the cloud that isolates your resources from other customers. It provides IP address management, subnet segmentation, and network access control. Every cloud deployment should use a VPC to establish network boundaries and control traffic flow.
How do I choose between ALB and NLB? Use an Application Load Balancer when you need HTTP-based routing, path-based routing, or WebSocket support. Use a Network Load Balancer when you need extreme performance, static IP addresses, or support for non-HTTP protocols such as TCP, UDP, or TLS.
Can I connect on-premises networks to the cloud? Yes. VPN connections provide quick, cost-effective connectivity over the internet. Dedicated connections such as AWS Direct Connect provide higher bandwidth and more consistent performance for production workloads.
How do I improve performance for global users? Use a CDN for static and dynamic content caching, deploy resources in multiple regions, and use global accelerators with anycast IP addresses. Latency-based DNS routing directs users to the nearest healthy endpoint.
What is the difference between security groups and network ACLs? Security groups are stateful firewalls at the instance level that automatically allow response traffic. Network ACLs are stateless firewalls at the subnet level that require explicit inbound and outbound rules. Use security groups for granular access control and network ACLs for broad subnet-level rules.