Cloud Networking and Connectivity

Introduction

Cloud computing depends on networking. Compute instances, databases, containers, storage services, users, administrators, and external systems communicate through networks that are logical rather than physically owned by a single customer. Cloud networking therefore combines familiar networking principles—IP addressing, routing, DNS, firewalls, and load balancing—with programmable, virtualized infrastructure.

A well-designed cloud network must provide connectivity, performance, availability, security, and operational control. It should allow legitimate traffic to reach its destination while limiting unnecessary exposure. It must also support growth, failure recovery, monitoring, and compliance. This chapter introduces the principal components used to design cloud networks and explains how private, hybrid, and internet-based connectivity are implemented.

Learning Objectives

By the end of this chapter, you should be able to:

• Explain virtual networks, subnets, addressing, and routing.
• Describe the roles of DNS, load balancers, firewalls, and gateways.
• Distinguish internet, private, VPN, and hybrid connectivity.
• Explain how content delivery networks improve application delivery.
• Apply basic cloud-network design principles to a practical scenario.
• Identify security, governance, availability, and operational concerns.

1. The Cloud Networking Model

A cloud provider operates physical data centers containing switches, routers, fiber, servers, and security appliances. Customers usually interact with a software-defined network (SDN): a logical network whose configuration is controlled through APIs, consoles, or infrastructure-as-code tools. The provider implements the requested configuration on shared physical infrastructure while maintaining logical isolation between customers.

A typical application network contains several layers:

1. Physical infrastructure: data-center links, switches, routers, and provider edge networks.
2. Virtual network: an isolated customer-defined address space.
3. Subnets: smaller network segments associated with availability zones or regions.
4. Routing: rules that determine where packets are forwarded.
5. Security controls: firewalls, security groups, network access control lists, and inspection services.
6. Application services: DNS, load balancing, proxies, and content delivery.

Cloud networking is commonly regional. A virtual network may exist in one geographic region, while subnets are placed in separate availability zones within that region. Cross-region communication normally requires explicit routing, peering, transit services, or encrypted tunnels.

2. Virtual Networks and Subnets

A virtual network is a logically isolated network created within a cloud provider. Different providers use different names, but the function is similar: the customer selects an IP address range, creates subnets, defines routes, and attaches network interfaces to resources.

A subnet is a subdivision of an IP network. Subnets help organize workloads, apply different policies, limit broadcast or failure domains, and separate public-facing components from internal services. A common architecture places web servers in a public or edge subnet, application servers in private subnets, and databases in more restricted data subnets.

A subnet is not automatically secure merely because it is called “private.” A private subnet generally lacks a direct route to the public internet, but its resources may still be reachable from other networks. Security depends on routes, firewall rules, identity controls, and application configuration.

Public and private subnets

A public subnet is one whose route table provides a path to an internet gateway, and whose resources may have publicly routable addresses or be accessed through a public-facing service. A private subnet normally has no direct inbound route from the internet. It may still use a network address translation gateway for controlled outbound access.

Typical placement is:

Addressing and CIDR notation

Cloud networks use IPv4, IPv6, or both. IPv4 addresses contain 32 bits and are commonly written in dotted-decimal form, such as 192.168.10.0. CIDR notation expresses a network and its prefix length, for example 192.168.10.0/24. The “/24” indicates that 24 bits identify the network and 8 bits remain for addresses within it.

The number of IPv4 addresses in a CIDR block is:

where N is the number of addresses and p is the prefix length. This calculation assumes a conventional IPv4 CIDR block. For a /24 network, N = 2^(32−24) = 256 addresses. Cloud platforms reserve some addresses for network, broadcast, gateway, or platform functions, so the number assignable to customer resources may be smaller.

For IPv6, the corresponding address count is:

IPv6 has a much larger address space and does not use IPv4-style broadcast. Exact subnet reservations and assignment behavior depend on the provider and service.

Address planning

Address planning should allow for growth, mergers, additional regions, overlapping networks, and future connectivity to offices or data centers. For example, if an organization uses 10.0.0.0/16 for a regional virtual network, it might allocate /20 subnets to availability zones and smaller ranges to application tiers. Overlapping ranges should be avoided because they complicate routing, VPNs, and network peering.

3. Routing and Network Paths

Routing determines the next destination for a packet. A route usually contains a destination prefix and a next hop or target. A route table may contain entries such as:

The route with the most specific matching prefix generally takes precedence. This is called longest-prefix matching. For example, a packet destined for 10.20.5.7 matches both 10.0.0.0/8 and 10.20.0.0/16; the /16 route is more specific and is selected.

Routing must be considered in both directions. A request may reach a server successfully but fail on the return path if the server’s subnet lacks a route back to the client. This is a common cause of asymmetric connectivity failures.

Routing components

• Internet gateway: Connects a virtual network to the provider’s internet edge. It does not automatically make every resource public.
• NAT gateway or NAT instance: Translates private source addresses for outbound IPv4 connections. It normally does not permit unsolicited inbound connections.
• Transit gateway or virtual router: Provides a hub for many virtual networks and on-premises connections.
• VPC/VNet peering: Connects two virtual networks through private provider infrastructure. Peering is often non-transitive: if A peers with B and B peers with C, A cannot necessarily reach C through B.
• Private service endpoint: Provides private access to selected provider services without traversing the public internet.

4. DNS and Service Discovery

The Domain Name System (DNS) maps names to records such as IP addresses. It allows users and applications to refer to services with stable names rather than changing numerical addresses.

Important record types include:

DNS resolution commonly involves a client resolver, a recursive resolver, and authoritative name servers. A time to live (TTL) value controls how long a response may be cached. A short TTL permits faster changes but causes more DNS queries; a long TTL reduces query load but delays changes.

Cloud DNS services often provide health checks and routing policies. They may direct users to the nearest region, distribute traffic by weight, or fail over from an unhealthy endpoint. DNS is useful for global traffic steering, but it is not a substitute for application-aware load balancing. Cached records do not change instantly, and DNS-based distribution may be uneven because different resolvers cache responses.

Service discovery is the process by which application components locate one another. In dynamic cloud environments, services may start, stop, or change address frequently. Internal DNS names, service registries, and orchestration platforms provide stable logical identities.

5. Load Balancing

A load balancer distributes client requests across multiple backend resources. It improves availability, supports horizontal scaling, and can centralize TLS termination, authentication integration, and health checking.

Types of load balancers

• Layer 4 load balancer: Operates primarily on TCP or UDP addresses and ports. It is fast and suitable for protocols that are not HTTP.
• Layer 7 load balancer: Understands HTTP or HTTPS and can route by hostname, URL path, headers, cookies, or application rules.
• Global load balancer: Directs users across regions or geographic endpoints, often using DNS, anycast, or provider edge networks.
• Internal load balancer: Provides private access to services within a virtual network or connected network.

Common distribution algorithms include round robin, weighted routing, least connections, and latency-aware routing. Health checks determine whether a backend should receive new traffic. A health check should test meaningful service readiness rather than merely whether a process responds to a network port.

A load balancer can terminate TLS at the edge, reducing certificate-management work on backend servers. However, organizations may require encryption from the load balancer to the backend as well. Session state should preferably be stored in a shared data store or represented in signed tokens; dependence on a single server’s local session state reduces flexibility.

6. Firewalls and Network Security

A firewall allows or denies traffic according to rules. Rules may evaluate source and destination addresses, protocol, port, direction, identity, application characteristics, or connection state.

Cloud platforms commonly provide several control types:

• Security groups or stateful rules: Usually attached to network interfaces or instances. Return traffic for an allowed connection is automatically permitted.
• Network access control lists: Often applied at subnet boundaries. They may be stateless, requiring explicit rules for both directions.
• Web application firewalls (WAFs): Inspect HTTP requests and help block attacks such as injection, malicious scripts, and abnormal request patterns.
• Next-generation firewalls: Add deep inspection, application identification, threat intelligence, and intrusion prevention.

The principle of least privilege requires allowing only necessary traffic. A database should accept connections from the application tier on its database port, not from the entire internet. Administrative access should use a controlled management path, identity-aware proxy, or secure remote-access system rather than exposing unrestricted SSH or remote desktop ports.

Firewall rules should be documented, reviewed, logged, and tested. Temporary exceptions need owners and expiration dates. Deny-by-default is a useful baseline, but overly restrictive rules can interrupt legitimate operations; effective security balances control with observability and operational practicality.

7. Gateways and Internet Access

A gateway connects networks that use different routing domains, protocols, or trust boundaries. In cloud architectures, gateways commonly include:

• Internet gateways for public connectivity.
• NAT gateways for controlled outbound IPv4 access.
• VPN gateways for encrypted tunnels.
• Transit gateways for hub-and-spoke connectivity.
• Application gateways or reverse proxies for HTTP traffic.
• Egress gateways for centralized outbound inspection and policy enforcement.

Public IP addresses are scarce and increase exposure. Resources should not receive public addresses unless a clear requirement exists. Outbound traffic may be routed through NAT or an egress firewall, logged, filtered, and restricted to approved destinations.

8. Content Delivery Networks

A content delivery network (CDN) uses distributed edge locations to cache and deliver content closer to users. A typical request is sent to an edge point of presence. If the requested object is cached, it is returned immediately; otherwise, the CDN retrieves it from an origin and may cache it according to policy.

CDNs are effective for static files such as images, video segments, software packages, stylesheets, and scripts. They can also accelerate dynamic applications through TLS optimization, connection reuse, compression, request routing, and edge computing. Cache-control headers determine whether and how content is cached.

The main design issues are cache invalidation, privacy, consistency, and cost. Sensitive or personalized responses must not be cached publicly. Cache keys should include relevant request attributes, and invalidation procedures must be tested. A CDN can reduce origin load and latency, but it does not eliminate the need for origin security, capacity planning, and application resilience.

9. VPN and Private Connectivity

A virtual private network (VPN) creates an encrypted logical connection across an untrusted network. Site-to-site VPNs connect a cloud virtual network to an office or data center. Client VPNs connect individual users or devices.

IPsec is widely used for site-to-site VPNs. A tunnel normally includes authentication, encryption, integrity protection, key exchange, and negotiated security parameters. Organizations should use modern algorithms and managed key rotation where possible.

VPN limitations include internet-dependent performance, variable latency, tunnel throughput limits, configuration complexity, and possible overlapping address ranges. Redundant tunnels and dynamic routing protocols can improve availability.

Dedicated private connectivity uses a provider or telecommunications circuit rather than the public internet. It can offer more predictable performance, lower exposure to internet routing, and higher bandwidth, but it normally costs more and may require longer provisioning. A common enterprise design uses dedicated connectivity as the primary path and VPN as a backup.

Hybrid connectivity links cloud resources with on-premises systems. It requires coordinated routing, DNS resolution, identity, monitoring, security policies, and failure procedures. Hybrid architecture is not simply a network tunnel; it is an operational relationship between two environments.

10. Availability, Performance, and Observability

Network availability improves when critical components are redundant across independent failure domains. Load balancers, VPN tunnels, NAT gateways, DNS endpoints, and circuits may need multi-zone or multi-region deployment. Redundancy is useful only when failover is tested.

Performance depends on latency, bandwidth, packet loss, congestion, protocol behavior, and application design. A useful relationship for data transfer is:

where T is ideal transfer time in seconds, D is data size in bits, and R is throughput in bits per second. The approximation assumes that throughput is sustained and ignores protocol overhead, latency, retransmissions, and congestion. For example, transferring 800 megabits over a 200 megabits-per-second link takes approximately 800 ÷ 200 = 4 seconds under ideal conditions.

Monitoring should include flow logs, DNS query logs, firewall decisions, load-balancer metrics, latency, error rates, packet loss, tunnel state, and route changes. Distributed tracing helps identify whether delay occurs at the client, CDN, load balancer, application, database, or external dependency.

11. Applied Case: Illustrative Online Retail Architecture

Background

An illustrative online retailer operates a web store serving customers in several countries. It has a public website, application services, a payment integration, and a database. The retailer expects seasonal traffic spikes and must protect customer information.

Problem

The original system runs several servers with public IP addresses. Traffic is uneven, database access is broadly permitted, and the company has no reliable disaster-recovery connectivity. A server failure causes interruption, and administrators connect directly over the internet.

Analysis

The main risks are excessive public exposure, a single failure domain, weak segmentation, unpredictable scaling, and inadequate monitoring. Payment traffic and customer data require strong access control, encryption, logging, and retention policies.

Approach and solution

The retailer creates a regional virtual network with non-overlapping private address space. Public edge subnets contain a CDN integration and redundant public load balancers. Application servers run in private subnets distributed across at least two availability zones. Databases operate in restricted subnets with inbound rules limited to the application tier.

DNS directs the store domain to the CDN or global traffic service. The CDN caches static assets and forwards dynamic requests to the load balancer. Health checks remove failed application instances. A NAT gateway provides controlled outbound access for patching, while private service endpoints are used where supported.

Administrative access uses an identity-aware management service rather than open inbound management ports. Flow logs, load-balancer logs, WAF logs, and application metrics are sent to a central monitoring platform. A site-to-site VPN connects the cloud network to the corporate office, and a second tunnel provides failover.

Outcome

The design reduces direct exposure, distributes failure risk, supports horizontal scaling, and gives the operations team visibility into traffic and security events. It does not guarantee security automatically: rules, certificates, patches, backups, incident procedures, and failover tests remain necessary.

Learning points

The case demonstrates that cloud networking is a system of coordinated controls. Subnets provide structure, routes provide reachability, firewalls provide restriction, load balancers provide distribution, DNS provides naming and steering, and monitoring provides evidence of actual behavior.

12. Governance, Ethics, and Contemporary Practice

Network logs can contain IP addresses, user identifiers, URLs, and other information that may be personal data. Organizations should define lawful collection, retention, access, and deletion practices. Security monitoring must be proportionate and protected from unauthorized use.

Cloud networking also raises governance issues concerning data residency, cross-border transfer, contractual responsibility, encryption-key ownership, and regulatory requirements. Responsibility is shared: the provider secures underlying infrastructure, while the customer remains responsible for configuration, identities, data, and workload security.

Infrastructure as code improves repeatability and reviewability. Network policies should be version-controlled, peer-reviewed, tested, and deployed through controlled pipelines. Policy-as-code can detect public storage, unrestricted firewall rules, overlapping address ranges, or missing encryption. Automation must be paired with change controls because an incorrect network change can affect many services simultaneously.

Contemporary architectures increasingly use zero-trust principles. Trust is not granted merely because a request originates inside a private network. Access is evaluated using identity, device posture, service identity, context, and least privilege. Service meshes may provide encrypted service-to-service communication and policy enforcement, although they add operational complexity.

Best Practices

1. Plan non-overlapping address ranges before deployment.
2. Separate public, application, management, and data tiers.
3. Use private addressing wherever public exposure is unnecessary.
4. Apply least-privilege firewall rules and review them regularly.
5. Design routes in both directions and verify return paths.
6. Deploy critical components across independent availability zones.
7. Use DNS names and service discovery rather than hard-coded addresses.
8. Place load balancers in front of scalable application tiers.
9. Protect origins even when a CDN is used.
10. Encrypt hybrid connections and provide tested redundancy.
11. Centralize logs and monitor latency, errors, routes, and security events.
12. Test failover, disaster recovery, and rule changes before emergencies occur.
13. Use infrastructure as code with peer review and automated validation.
14. Document ownership, data flows, dependencies, and exception expiry dates.

Challenges and Limitations

Cloud networking abstracts physical infrastructure but does not remove complexity. Provider-specific terminology and limits can make designs difficult to transfer between platforms. Network charges may depend on data transfer direction, region, or service path and can be significant at scale. Abstraction may also obscure physical paths and make troubleshooting harder.

Other limitations include DNS caching delays, VPN throughput constraints, non-transitive peering, IPv4 exhaustion, misconfigured security rules, unexpected asymmetric routes, and dependence on provider control planes. Highly distributed architectures can improve resilience while increasing operational and diagnostic complexity. Good design therefore requires simplicity where possible, explicit documentation, and continuous testing.

Chapter Summary

Cloud networking provides the connectivity foundation for cloud applications. Virtual networks create logical isolation; subnets organize resources and failure domains; CIDR addressing supports structured allocation; and routing determines packet paths. DNS supplies stable names and can support health-based or geographic traffic steering. Load balancers distribute traffic and improve availability, while firewalls and gateways control exposure and access.

CDNs bring content closer to users and reduce origin load. VPNs provide encrypted connectivity across the internet, while dedicated private links offer more predictable enterprise connectivity. Hybrid networking requires coordinated routing, DNS, security, identity, monitoring, and operational procedures. Reliable cloud networks use redundancy, least privilege, observability, automation, and tested recovery plans.

Key Terms

Virtual network: A logically isolated customer network implemented on cloud infrastructure.

Subnet: A smaller IP network carved from a larger network range.

CIDR: A notation that represents an IP network using an address and prefix length.

Route table: A collection of destination and next-hop rules used to forward packets.

Internet gateway: A cloud component that connects a virtual network to internet routing.

NAT gateway: A service that translates private IPv4 addresses for controlled outbound access.

DNS: The distributed naming system that maps domain names to network records.

TTL: The period for which a DNS response may be cached.

Load balancer: A service that distributes traffic across backend resources.

Health check: A test used to determine whether a service can receive traffic.

Firewall: A control that permits or denies traffic according to defined rules.

Security group: A commonly stateful, interface-level cloud firewall policy.

WAF: A web application firewall that filters and protects HTTP traffic.

CDN: A distributed network that caches and delivers content near users.

VPN: An encrypted logical network connection over an untrusted network.

Peering: A private connection between two virtual networks.

Transit gateway: A hub that connects multiple networks and connectivity attachments.

Hybrid connectivity: Integration between cloud infrastructure and on-premises networks.

Zero trust: A security approach that continuously verifies access rather than trusting network location.

Review Questions

Short Answer Questions

1. What is a virtual network, and why is it useful in cloud computing?
2. Explain the difference between a public subnet and a private subnet.
3. What purpose does DNS serve in a cloud architecture?
4. How does a load balancer improve application availability?
5. What is the function of a NAT gateway?

Long Answer Questions

1. Explain how CIDR addressing and subnet planning support scalable cloud-network design.
2. Compare stateful security groups, network access control lists, and web application firewalls.
3. Describe the roles of internet gateways, transit gateways, VPN gateways, and private endpoints.
4. Explain how CDNs, DNS, and load balancers can work together to deliver a global web application.
5. Discuss the design, security, and operational requirements of a hybrid cloud network.

Analytical / Application Questions

1. An organization has web, application, and database tiers. Propose a subnet, routing, and firewall design that minimizes public exposure while allowing required traffic.
2. A company connects its office to the cloud through a VPN, but requests reach cloud servers and responses fail to return. Analyze the likely routing causes and propose a troubleshooting sequence.
3. Design a resilient architecture for an online retailer experiencing regional traffic spikes. Explain how you would use DNS, a CDN, load balancing, private subnets, security controls, monitoring, and failover.

Multiple Choice Questions with Answers

Question 1

Which component primarily determines the next hop for a packet in a cloud virtual network?

A. Route table

B. DNS zone

C. Content delivery network

D. Certificate authority

Correct Answer: A. Route table

Question 2

How many IPv4 addresses are contained in a conventional /24 CIDR block?

A. 24

B. 128

C. 256

D. 512

Correct Answer: C. 256

Question 3

What is the usual purpose of a NAT gateway?

A. To provide unsolicited inbound access to private servers

B. To permit controlled outbound IPv4 access from private resources

C. To replace all firewall rules

D. To resolve domain names

Correct Answer: B. To permit controlled outbound IPv4 access from private resources

Question 4

Which DNS record maps a name directly to an IPv4 address?

A. AAAA

B. MX

C. CNAME

D. A

Correct Answer: D. A

Question 5

Which load balancer is most suitable for routing HTTP requests by URL path?

A. Layer 7 load balancer

B. Layer 2 bridge

C. NAT gateway

D. IPsec tunnel

Correct Answer: A. Layer 7 load balancer

Question 6

What is a principal benefit of a content delivery network?

A. It eliminates the need for origin security

B. It caches and delivers content near users

C. It assigns private IP addresses to databases

D. It replaces application authentication

Correct Answer: B. It caches and delivers content near users

Question 7

Which approach best follows least privilege for a database tier?

A. Allow all internet addresses on the database port

B. Allow only the application tier on the required database port

C. Give every subnet unrestricted access

D. Disable all logging

Correct Answer: B. Allow only the application tier on the required database port

Question 8

A site-to-site VPN primarily provides which capability?

A. Encrypted connectivity between networks over an untrusted path

B. Automatic database replication without configuration

C. Public DNS registration only

D. Replacement of all cloud subnets

Correct Answer: A. Encrypted connectivity between networks over an untrusted path

Question 9

What is the ideal transfer time for 800 megabits over a 200 megabits-per-second link, ignoring overhead and congestion?

A. 0.25 seconds

B. 2 seconds

C. 4 seconds

D. 160 seconds

Correct Answer: C. 4 seconds

Question 10

Why should cloud address ranges generally be non-overlapping with connected corporate networks?

A. Overlapping ranges can complicate routing and private connectivity

B. Non-overlapping ranges increase DNS TTL

C. Overlapping ranges prevent all encryption

D. Non-overlapping ranges eliminate the need for firewalls

Correct Answer: A. Overlapping ranges can complicate routing and private connectivity