Why it matters
Networking design determines security and cost. OCI's regional VCN scope makes multi-region designs slightly more complex than GCP's global VPC, but simpler than AWS's per-region VPCs.
The architecture
A VCN has a CIDR block (like 10.0.0.0/16) and subnets within it. Subnets can be regional (span all ADs) or AD-specific.
Route tables control traffic paths. Security lists (subnet-level firewall) and Network Security Groups (NSG, attached to VNICs) control access.
How it works end to end
Gateways: Internet Gateway (public bidirectional), NAT Gateway (private outbound), Service Gateway (to Oracle Services Network), Dynamic Routing Gateway (DRG) for on-prem via VPN/FastConnect.
Local Peering Gateway (LPG) connects VCNs in the same region. Remote Peering Connection (RPC) connects VCNs across regions.
Load Balancer service handles L4 and L7 with health checks and SSL termination.