PCA 3.x networking basics: create a VCN, subnets and security lists

Networking in the Private Cloud Appliance 3.x Compute Enclave follows the OCI model. A virtual cloud network (VCN) holds one or more subnets; route tables, DHCP options and security lists decide where traffic can go. Every VCN gets a default route table, a default security list and default DHCP options when it is created.

Two rules to know up front, both from the PCA User Guide: IPv6 is not currently supported, and DNS labels for a VCN or subnet must be set at creation time; they cannot be added later.

1. Create the VCN

In the Compute Web UI, open the navigation menu, choose Networking > Virtual Cloud Networks and click Create Virtual Cloud Network. Enter a name, compartment and CIDR block. If you want DNS host names, enable DNS and enter a label: it must start with a letter, contain only letters and numbers, and be at most 15 characters.

With the OCI CLI:

oci network vcn create \
  --compartment-id ocid1.compartment.unique_ID \
  --cidr-blocks '["10.0.0.0/16"]' \
  --dns-label vcn1 \
  --display-name VCN1

The output includes default-route-table-id and default-security-list-id. Note the VCN id for the next step.

2. Create a subnet

Open the VCN, select Subnets under Resources and click Create Subnet. The subnet CIDR must lie inside the VCN CIDR and must not overlap other subnets. Choose Private Subnet if instances there must never get a public IP. If you do not pick a route table, DHCP options or security list, the VCN defaults are used.

oci network subnet create \
  --compartment-id ocid1.compartment.unique_ID \
  --vcn-id ocid1.vcn.unique_ID \
  --cidr-block 10.0.1.0/24 \
  --dns-label subnet1 \
  --display-name app-subnet

A subnet DNS label is only possible if the VCN itself has one.

3. Create a security list

Security lists are sets of ingress and egress rules applied to every VNIC in the subnets that use them. By default the rules are stateful: allowing a request automatically allows its response. A rule marked stateless applies only in its own direction, so you must allow the return traffic yourself.

In the Web UI: open the VCN, select Security Lists, click Create Security List, give it a name and compartment, and add rules with +New Rule (CIDR, protocol, port ranges).

With the CLI you must pass both --ingress-security-rules and --egress-security-rules, even if one is an empty list. This example allows SSH from one admin network and all outbound traffic, using stateful rules:

oci network security-list create \
  --compartment-id ocid1.compartment.unique_ID \
  --vcn-id ocid1.vcn.unique_ID \
  --display-name app-ssh \
  --ingress-security-rules '[{"source": "10.0.0.0/24", "protocol": "6", "isStateless": false, "tcpOptions": {"destinationPortRange": {"min": 22, "max": 22}}}]' \
  --egress-security-rules '[{"destination": "0.0.0.0/0", "protocol": "all", "isStateless": false}]'

Protocol 6 is TCP. Then attach the list to a subnet, either when you create it (+Add Security List in the dialog) or by updating the subnet later.

4. Reaching networks outside the VCN

A subnet only reaches outside networks if its route table has a rule pointing to a gateway and its security lists allow the traffic. The PCA guide documents an internet gateway for access to your data center network; Oracle’s advice is to permit only the traffic types you actually need.

Cleaning up

Warning: deleting a subnet or VCN cannot be undone. Per the docs, a subnet can only be deleted when it is empty, and a VCN only when all its subnets, route tables, gateways and other resources are gone. List what is still inside first:

oci network subnet list --compartment-id ocid1.compartment.unique_ID --vcn-id ocid1.vcn.unique_ID --output table
oci compute instance list --compartment-id ocid1.compartment.unique_ID --output table

Official documentation

• Oracle PCA User Guide (3.0): Creating and Managing VCNs and Subnets
• Oracle PCA: Creating a Security List