Network design for cloud / hybrid / on-prem. VPC structure, subnet segmentation, CIDR planning, routing, peering + hub-spoke, NAT, DNS, private endpoints, load balancers, CDN, VPN + Direct Connect, service mesh.
You design the network: VPCs, subnets, CIDRs, routing, DNS, edge, hybrid connectivity.
zero-trust-architectureReserve non-overlapping ranges:
Leave room for:
Don't use overlapping RFC1918 ranges if hybrid connectivity planned.
Per VPC:
| Subnet tier | Contains | Routing |
|---|---|---|
| Public | Load balancers, bastion (if any), NAT gateways | Route to IGW |
| Private (app) | Apps / containers / VMs | Route to NAT for egress; private to VPC |
| Data | Databases, caches, internal services | No internet route; only from private app subnets |
Multi-AZ: 3 subnets per tier × 3 AZs = 9 subnets typical.
For multi-VPC / multi-account:
| Concern | Tool |
|---|---|
| External DNS (customer-facing) | Route53 / Cloud DNS / Azure DNS / CloudFlare |
| Internal DNS (service discovery) | Route53 private zones / Cloud DNS private / Consul / K8s DNS |
| Hybrid resolution | Resolver endpoints for cross-VPC + on-prem |
| Service mesh | mDNS-like via Istio / Linkerd / Consul |
Naming convention: <service>.<env>.<region>.<company>.internal.
Avoid public internet traffic to managed services within same cloud:
| Type | Layer | Use |
|---|---|---|
| Network LB (L4) | TCP/UDP | Lower latency, high throughput, static IP |
| Application LB (L7) | HTTP/HTTPS | Path-based routing, WAF, TLS termination |
| Global LB | DNS / Anycast | Multi-region, geo-routing |
| Option | Use |
|---|---|
| Site-to-site VPN | Quick, cheaper, lower bandwidth |
| Direct Connect / ExpressRoute / Partner Interconnect | High bandwidth, consistent latency, dedicated |
| SD-WAN | Multi-site enterprise |
For microservices:
flowchart TB
Internet
subgraph VPC
subgraph AZ1["AZ 1"]
PUB1["Public subnet"]
PRIV1["Private subnet"]
DATA1["Data subnet"]
end
subgraph AZ2["AZ 2"]
PUB2["Public subnet"]
PRIV2["Private subnet"]
DATA2["Data subnet"]
end
end
Internet --> PUB1
PUB1 --> PRIV1 --> DATA1
PUB2 --> PRIV2 --> DATA2
# Networking Design: [Scope]
## CIDR Plan
[Per env + future reservations]
## VPC Structure
[Hub-spoke / per-env / multi-region]
## Subnet Tiering
[Public / private / data per AZ]
## Routing
[IGW / NAT / TGW / peering]
## DNS Strategy
[External + internal + hybrid]
## Private Endpoints
[For managed services]
## Load Balancers + CDN
[Per external entry point]
## Hybrid Connectivity
[If on-prem]
## Service Mesh
[If microservices]
## Security Controls
[Security groups / NACLs / firewall rules]
## Diagram