Mirco Cloud Primer
Photo by Brett Sayles on Pexels
Cloud networking terms tend to arrive all at once, and beginners often meet subnet, gateway, and VPN within the first few minutes of setting up a project. Each term describes a genuinely simple idea once it's separated from the jargon. This guide walks through all three using one consistent, everyday comparison: a neighborhood and its mail system.
Why cloud networking terminology trips beginners up
Most of these terms were originally written for network engineers, so they describe technical mechanics rather than everyday purposes. But every cloud network, no matter how large, is really just solving the same few problems: how to divide space into manageable sections, how to control what can enter or leave those sections, and how to connect separate private spaces securely. Keeping that in mind makes each individual term much less intimidating.
Subnets: dividing the neighborhood into blocks
A virtual private cloud is like an entire neighborhood you've been given to design. A subnet is one block within that neighborhood, a smaller section with its own defined boundary. Dividing a large network into subnets lets you group similar resources together and apply different rules to each group. One block, for instance, might be designed to be reachable from the public street, while another block stays tucked away, accessible only from within the neighborhood itself.
Gateways: the mail routing point in and out
A gateway is the point where mail enters or leaves the neighborhood altogether, like the post office that routes everything to and from the wider postal system. In cloud networking, a gateway is the designated point through which traffic passes between a subnet and something outside it, whether that's the public internet or another private network. Without a properly configured gateway, resources inside a subnet may be completely unable to reach anything beyond their own block, even if every other setting looks correct.
VPNs: a private, locked tunnel between two places
Now imagine running a private, locked underground tunnel directly between your neighborhood and another trusted location across town, so that mail and visitors can travel between the two without ever using the open public streets. That's the essence of a Virtual Private Network, or VPN. It creates an encrypted, private connection between two networks, such as a company's own office network and its resources inside the cloud, so that traffic between them stays shielded from the open internet it technically travels across.
How these pieces work together
| Concept | Everyday role | What it controls |
|---|---|---|
| Subnet | A block within the neighborhood | Groups resources and applies shared rules |
| Gateway | The post office routing point | Connects a subnet to the internet or another network |
| VPN | A private, locked tunnel | Secures traffic between two separate networks |
A simple walkthrough: setting up a small project's network
Imagine a small business setting up its first real project in the cloud: a website with a database behind it. The first step is creating a private network space, the VPC, which acts as the neighborhood. Inside it, the team creates two subnets: one public subnet for anything that genuinely needs to be reached by visitors, and one private subnet for anything that should stay hidden from the open internet. The website's server goes into the public subnet, since visitors need to reach it directly. The database goes into the private subnet, because there is no good reason for the database to ever be directly reachable from outside the project at all. Next, the team configures a gateway for the public subnet, so that visitors from the internet can actually reach the website sitting inside it, the same way a post office needs to exist before mail can flow in and out of a neighborhood at all. The private subnet, by contrast, gets no direct gateway to the public internet; instead, the website server is allowed to reach the database internally, within the same VPC, without that connection ever needing to touch the open internet. Finally, if an employee needs to connect securely from the office to manage the database directly, rather than through the website, the team sets up a VPN, creating that private, locked tunnel between the office network and the cloud's private subnet. None of these pieces is particularly complicated in isolation; the challenge for most beginners is simply remembering how they fit together, and this walkthrough is meant to make that fit a little more concrete before trying it on an actual project of your own.
Common mistakes beginners make
- Placing a sensitive resource, like a database, in a subnet that is reachable directly from the public internet.
- Forgetting to configure a gateway at all, then being confused about why nothing in a subnet can connect outward.
- Assuming a VPN alone makes a system secure, when access controls still need to be configured correctly on both ends.
- Treating every networking setting as permanent, rather than revisiting the configuration as a project's needs change.
Frequently asked questions
Do I need to understand all of this to use basic cloud services?
Many beginner-friendly services set up sensible networking defaults automatically. Understanding the basics helps most once you start customizing access or connecting multiple services.
Is a VPN only useful for personal privacy browsing?
No. In cloud computing, VPNs are commonly used to connect private company networks to cloud resources securely, which is a different use case from consumer privacy VPN apps.
Can a subnet exist without a gateway?
A subnet can exist in isolation, but without a gateway configured appropriately, nothing inside it can reach resources outside that subnet.
Are these concepts specific to one cloud provider?
No. Subnets, gateways, and VPNs are general networking concepts used across virtually all cloud providers, even though specific setup steps vary.
Related reading
Sources
- RFC 1918 — Address Allocation for Private Internets
- Documentation published by major public cloud providers (consulted October 2026)