TH3. Basic concept(TCP vs UDP), trust & untrust network, firewall, route,gateway, protocols - DevWithNehaCloud/Oracle-Cloud-Infrastructure-wiki GitHub Wiki
OCI Basic Networking Concepts
1. TCP vs UDP
TCP (Transmission Control Protocol)
TCP is a connection-oriented protocol that ensures reliable communication between devices.
Features of TCP
- Reliable communication
- Error checking available
- Data packets arrive in correct order
- Slower but secure
Common TCP Protocols
- HTTP
- HTTPS
- SSH
- FTP
- SMTP
Example
When connecting to a Linux server using SSH or opening a website, TCP is used.
UDP (User Datagram Protocol)
UDP is a connectionless protocol that sends data without verifying delivery.
Features of UDP
- Faster communication
- No delivery guarantee
- No packet ordering
- Low latency
Common UDP Usage
- Video streaming
- Online gaming
- Voice calls (VoIP)
- DNS queries
Example
Live streaming applications commonly use UDP for faster transmission.
Difference Between TCP and UDP
| Feature | TCP | UDP |
|---|---|---|
| Connection Type | Connection-oriented | Connectionless |
| Reliability | High | Low |
| Speed | Slower | Faster |
| Error Checking | Yes | Minimal |
| Packet Order | Maintained | Not maintained |
| Usage | SSH, Web Browsing | Streaming, Gaming |
2. Trust and Untrust Network
Trust Network
A trusted network is considered secure and internal.
Examples
- Private subnet
- Internal company network
- Backend application servers
Characteristics
- Limited external access
- More secure
- Used for internal communication
Untrust Network
An untrusted network refers to external or public networks.
Examples
- Internet
- Public subnet
- External users
Characteristics
- Open access
- Higher security risks
- Requires firewall protection
OCI Example
| Network Type | OCI Example |
|---|---|
| Trust Network | Private Subnet |
| Untrust Network | Public Subnet with Internet Access |
3. Firewall
A firewall is a security system that controls incoming and outgoing traffic based on rules.
It helps protect servers and applications from unauthorized access.
Purpose of Firewall
- Protect servers from attacks
- Allow only required ports
- Block unwanted traffic
- Improve overall security
Common Allowed Ports
| Port | Protocol | Purpose |
|---|---|---|
| 22 | SSH | Remote server access |
| 80 | HTTP | Website traffic |
| 443 | HTTPS | Secure website traffic |
Firewall in OCI
OCI provides firewall functionality using:
- Security Lists
- Network Security Groups (NSG)
These control traffic for OCI resources.
4. Route
A route defines where network traffic should go.
Routes are managed using a Route Table.
Route Table Components
| Component | Description |
|---|---|
| Destination CIDR | Target network range |
| Target | Gateway used for traffic |
Example Route Rule
| Destination CIDR | Target |
|---|---|
| 0.0.0.0/0 | Internet Gateway |
Meaning
All internet traffic is sent through the Internet Gateway.
5. Gateway
A gateway connects one network to another network.
OCI provides multiple types of gateways.
Types of Gateways in OCI
1. Internet Gateway (IGW)
Allows communication between OCI VCN and the Internet.
Used For
- Public subnets
- Public websites
- Internet access
2. NAT Gateway
Allows private instances to access the Internet without exposing them publicly.
Used For
- OS updates
- Package installation
- Secure outbound internet access
3. Service Gateway
Provides private access to OCI services without using the Internet.
Used For
- Accessing Object Storage privately
4. Dynamic Routing Gateway (DRG)
Connects OCI VCN with:
- On-premises network
- Other cloud networks
6. Protocols
A protocol is a set of communication rules used between devices.
Common Networking Protocols
| Protocol | Port | Purpose |
|---|---|---|
| HTTP | 80 | Web traffic |
| HTTPS | 443 | Secure web traffic |
| SSH | 22 | Remote login |
| FTP | 21 | File transfer |
| DNS | 53 | Domain name resolution |
| SMTP | 25 | Sending emails |
| RDP | 3389 | Remote desktop connection |
OCI Networking Flow Example
User → Internet → Internet Gateway → Route Table → Security List/NSG → OCI Instance
Flow Explanation
- User accesses application from Internet
- Traffic enters through Internet Gateway
- Route Table directs traffic to correct subnet
- Security List/NSG checks firewall rules
- Instance receives traffic using TCP/HTTPS protocol
Summary
| Concept | Description |
|---|---|
| TCP | Reliable communication protocol |
| UDP | Fast communication protocol |
| Trust Network | Internal secure network |
| Untrust Network | External/public network |
| Firewall | Controls network traffic |
| Route | Defines traffic path |
| Gateway | Connects networks |
| Protocol | Communication rules |
Conclusion
These networking concepts are fundamental in OCI and cloud environments. Understanding TCP/UDP, firewalls, routes, gateways, and protocols helps in designing secure and efficient cloud infrastructure.
Advanced Simple OCI Networking Diagrams
1. Complete OCI Network Flow
User Request
│
▼
Internet
│
▼
Internet Gateway
│
▼
Route Table
│
▼
Security List / NSG
│
┌─────────────┴─────────────┐
│ │
▼ ▼
Public Subnet Private Subnet
│ │
▼ ▼
Web Server Database Server
2. Public vs Private Subnet
OCI VCN
┌──────────────────────────────────────────────┐
│ │
│ Public Subnet │
│ ┌──────────────────────┐ │
│ │ Web Server │ │
│ │ Public IP Available │ │
│ └──────────────────────┘ │
│ │ │
│ ▼ │
│ Internet Access │
│ │
│----------------------------------------------│
│ │
│ Private Subnet │
│ ┌──────────────────────┐ │
│ │ Database Server │ │
│ │ No Public IP │ │
│ └──────────────────────┘ │
│ │
└──────────────────────────────────────────────┘
3. Firewall Traffic Control
Incoming Traffic
│
▼
┌────────────┐
│ Firewall │
└─────┬──────┘
│
┌────────────┴────────────┐
│ │
▼ ▼
Allow Port 22 Block Unknown
SSH Traffic Traffic
│
▼
OCI Instance
4. Internet Gateway vs NAT Gateway
Internet
│
┌────────────────┴───────────────┐
│ │
▼ ▼
Internet Gateway NAT Gateway
│ │
▼ ▼
Public Subnet Private Subnet
│ │
▼ ▼
Public Server Private Server
(Accessible from Internet) (No Direct Access)
5. Service Gateway Architecture
Private Subnet
│
▼
Service Gateway
│
▼
OCI Object Storage
(Private Access Without Internet)
6. DRG (Dynamic Routing Gateway)
On-Premises Data Center
│
▼
DRG
│
▼
OCI VCN
│
┌───────────┴───────────┐
▼ ▼
Application Server Database Server
7. TCP Handshake Diagram
Client Server
│ │
│ -------- SYN Request -----------> │
│ │
│ <------ SYN-ACK Response -------- │
│ │
│ -------- ACK Response ----------> │
│ │
Connection Established Successfully
8. UDP Communication Diagram
Client Server
│ │
│ -------- Data Packet -----------> │
│ │
No Handshake
No Acknowledgement
Fast Communication
9. OCI Security Layer Flow
Internet
│
▼
Internet Gateway
│
▼
Route Table
│
▼
Security List / NSG
│
▼
OCI Instance
│
▼
Application
10. Simple OCI Architecture
Internet
│
▼
Load Balancer
│
┌───────────────┴───────────────┐
▼ ▼
Web Server 1 Web Server 2
│ │
└───────────────┬───────────────┘
▼
Database Server
(Private Subnet)
OCI Networking Flow Explanation
Step-by-Step Traffic Flow
-
User sends request from the Internet to access the application or server.
-
The request first reaches the Internet Gateway, which allows communication between the Internet and OCI VCN.
-
After entering the VCN, the traffic is checked by the Route Table to determine where the request should go.
-
The Route Table forwards the traffic to the correct subnet (Public or Private Subnet).
-
Before reaching the server, the traffic passes through Security Lists or NSG (Firewall Rules) for security checking.
-
If the required port and protocol are allowed, the traffic reaches the OCI Compute Instance or application server.
-
Finally, the application processes the request and sends the response back to the user through the same network path.