​
Overview

A VPC is an isolated private network in one availability zone. Inside it you create networks — tiers with their own address range — and your machines attach to those.
Navigation: Networking → VPC. Titled Virtual Private Clouds, subtitled “Create and manage isolated virtual private clouds across regions and availability zones.”
Every zone your account uses gets its own VPC — they aren’t shared across zones. Three zones means three VPCs. See Regions and zones.

​
Columns

Filters: All VPCs, Enabled, Disabled, Inactive. Expanding a VPC lists its networks with Network Name, CIDR, Gateway, Netmask, Firewall Policy, State, Type, and Notes — the fastest way to see a VPC’s whole layout.
Under the VPC name you may see a Fabric status line — Connected · {n} direct, Connecting, {n} failed, or No direct connections. That’s Fabric reporting cross-zone links.

​
Creating a VPC

Create VPC — “Create an isolated network environment for your resources with full control over IP ranges, routing, and gateways.”

​
Choosing a CIDR

The prefix must be between /8 and /28. Anything outside that is rejected with Invalid CIDR format (e.g., 10.0.0.0/16).
A VPC’s CIDR cannot be changed after creation. Getting it wrong means rebuilding the VPC and everything in it.Two rules worth following:Use private ranges — 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. A public range will collide with the real internet.Don’t overlap with anything you might connect to. Overlapping ranges cannot be routed between, which breaks Fabric links and site-to-site VPN later. If your office is 192.168.1.0/24, don’t use it here. Plan the whole estate before creating the first VPC.
Give each zone’s VPC a distinct range — 10.0.0.0/16, 10.1.0.0/16, 10.2.0.0/16. Identical ranges in different zones can never be connected, and that constraint only becomes visible when you try.

​
Adding a network

Inside a VPC, a network is a tier — a web tier, an app tier, a database tier.

​
Let it derive the addresses

An Auto-generate button fills the IP configuration from the VPC’s range, picking a /24 that doesn’t collide with existing networks. For a VPC on 10.0.0.0/16 you’ll get: The next network gets 10.0.2.x, and so on. The button notes how many existing networks it avoided.
Use Auto-generate unless you have a specific addressing scheme. It picks a non-overlapping /24 and leaves the low addresses free — hand-entered ranges are where overlaps come from.
Addresses outside the VPC’s range produce a warning, not an error — “Gateway IP is outside VPC CIDR ()” — so the form will let you submit it. That’s deliberate flexibility, but an out-of-range tier generally won’t route. Treat the warning as an error unless you know exactly why you’re overriding it.
A Load balancing support switch and a Load balancer type selector appear only when load balancing is enabled for your deployment. It’s off in the current phase, so the network is created with a no-load-balancer offering. See Public IPs.

​
The detail page

Clicking a VPC opens it with a breadcrumb of Virtual Private Clouds / {name} and eleven sections in a left nav. Each has its own page here:
Opening an unfamiliar VPC, start with Network Designer. It gives you the shape of the thing in one screen, and missing pieces — a tier with no firewall policy, an address connected to nothing — are visually obvious in a way a list never is.
Earlier versions of this screen had routing and security tabs that were unfinished placeholders. The current section list above is what exists — the eleven sections are all real.

​
Deleting a VPC

A VPC can only be deleted once it’s empty. Failure adds: “Remove networks, VMs and other resources first.”
Delete in dependency order: machines, then public IP mappings, then networks, then the VPC. There’s no cascade, and the error won’t tell you which resource is blocking — you’ll have to check each section of the detail page.

​
Worked example: a two-tier application

Web tier reachable from the internet, database tier reachable only from the web tier.
1

Create the VPC with room to subdivide

Create VPC → name production-vpc, CIDR 10.0.0.0/16. A /16 leaves room for many tiers; a /24 would not.
2

Create a firewall policy per tier, before the networks

Two custom policies — web-tier-policy and db-tier-policy. The network creation form requires a policy, and you can’t tighten a default one. See Firewall Policies.
3

Create the web network

Name web-tier-network, policy web-tier-policy, Auto-generate the addresses → 10.0.1.0/24.
4

Create the database network

Name db-tier-network, policy db-tier-policy, Auto-generate again → 10.0.2.0/24.
5

Write the database policy against the web tier's range

On db-tier-policy: ingress TCP 5432 from 10.0.1.0/24 — the web tier’s range specifically, not 0.0.0.0/0. Plus an egress rule, since policies are stateless.This is where the isolation actually happens. Separate networks alone don’t restrict traffic.
6

Publish only the web tier

Acquire a public IP and Static NAT it to a web machine. The database tier gets no public address at all.
7

Verify the isolation

From a web machine, connect to the database. From outside, confirm the database port is unreachable. If it isn’t, the database policy is too broad.

​
Empty and error states

If a background refresh fails, the detail page keeps showing the last good data rather than blanking. A stale page is more useful than an empty one.

Firewall Policies

Required to create a network, and where isolation is enforced.

Public IPs

Publishing a machine inside a VPC.

Fabric

Connecting VPCs across zones.

Regions and zones

Why there’s one VPC per zone.