A virtual network is still a network
A virtual network defines an address space. Subnets partition it; route tables select next hops. Keep cloud and on-premises prefixes from overlapping before connecting them.
- Separate address planning from firewall policy.
- Reserve space for growth and future site connections.
- A public route alone does not make a private workload reachable.
- Record which component supplies DNS, NAT and the default route.
Build public and private paths
Put public entry points in front of private application services. Load balancers distribute traffic; NAT can provide outbound IPv4 access without unsolicited inbound sessions.
- Use explicit ingress rules for each service.
- Private endpoints avoid exposing a service on a public address.
- An egress gateway does not replace application authentication.
- Design IPv6 ingress and egress policies separately from IPv4 NAT.
Connect the places you operate
A site-to-site VPN encrypts traffic over an existing network. Dedicated connectivity provides a private path, but does not automatically provide end-to-end encryption.
- Check routes in both directions, including return paths.
- Plan redundant tunnels and test failover.
- Inspect DNS resolution across private network boundaries.
- Document bandwidth and transfer assumptions before estimating costs.
Translate the vocabulary
Providers use different names for familiar building blocks. Check the provider’s documentation for exact policy and routing behaviour.
- AWS — VPC, subnets, route tables, security groups and network ACLs.
- Azure — Virtual Network, subnets, route tables and network security groups.
- Google Cloud — VPC networks, regional subnets, routes and firewall policies.