Scenario A: Public Subnet

1. While still viewing the VCN, click Create Subnet.

2. Enter the following:

   • Name: A friendly name for the subnet (for example, Regional Public Subnet). It doesn't have to be unique, and it cannot be changed later in the Console (but you can change it with the API). Avoid entering confidential information.
   • Regional or Availability Domain-Specific: Select Regional (recommended), which means the subnet spans all availability domains in the region. Later when you launch an instance, you can create it in any availability domain in the region. For more information, see Overview of VCNs and Subnets.
   • CIDR Block: A single, contiguous CIDR block within the VCN's CIDR block. For example: 172.16.0.0/24. You cannot change this value later. For reference, here's a CIDR calculator.
   • Enable IPv6 Address Assignment: This option is available only if the VCN is enabled for IPv6. IPv6 addressing is supported for all commercial and government regions. For more information, see IPv6 Addresses.
   • Route Table: Select the default route table.
   • Private or public subnet: Select Public Subnet, which means instances in the subnet can optionally have public IP addresses. For more information, see Access to the Internet.
   • Use DNS Hostnames in this Subnet: This option is available only if a DNS label was provided for the VCN when it was created. The option is required for assignment of DNS hostnames to hosts in the subnet, and also when you plan to use the VCN's default DNS feature (called the Internet and VCN Resolver). If you select the checkbox, you can specify a DNS label for the subnet, or let the Console generate one for you. The dialog box automatically displays the corresponding DNS domain name for the subnet as an FQDN. For more information, see DNS in Your Virtual Cloud Network.
   • DHCP Options: Select the default set of DHCP options.
   • Security Lists: Ensure that the default security list is selected.
   • Tags: Leave as is. You can add tags later. For more information, see Resource Tags.

3. Click Create Subnet.

   The subnet is then created and displayed on the Subnets page.

1. Under Resources, click Internet Gateways.
2. Click Create Internet Gateway.

3. Enter the following:

   • Name: A friendly name for the internet gateway. It doesn't have to be unique, and it cannot be changed later in the Console (but you can change it with the API). Avoid entering confidential information.
   • Create in Compartment: Leave as is.
   • Tags: Leave as is. You can add tags later. For more information, see Resource Tags.

4. Click Create Internet Gateway.

   Your internet gateway is created and displayed on the Internet Gateways page. The gateway is already enabled, but you must add a route rule that allows traffic to flow to the gateway.

The default route table starts out with no rules. Here you add a rule that routes all traffic destined for addresses outside the VCN to the internet gateway. The existence of this rule also enables inbound connections to come from the internet to the subnet, through the internet gateway. You use security list rules to control the types of traffic that are allowed in and out of the instances in the subnet (see the next task).

No route rule is required to route traffic within the VCN itself.

1. Under Resources, click Route Tables.
2. Click the default route table to view its details.
3. Click Add Route Rule.

4. Enter the following:

   • Target Type: Internet Gateway
   • Destination CIDR block: 0.0.0.0/0 (which means that all non-intra-VCN traffic that is not already covered by other rules in the route table goes to the target specified in this rule)
   • Compartment: The compartment where the internet gateway is located.
   • Target: The internet gateway you created.
   • Description: An optional description of the rule.
5. Click Add Route Rule.

The default route table now has a rule for the internet gateway. Because the subnet was set up to use the default route table, the resources in the subnet can now use the internet gateway. The next step is to specify the types of traffic you want to allow in and out of the instances you later create in the subnet.

Earlier you set up the subnet to use the VCN's default security list. Now you add security list rules that allow the types of connections that the instances in the VCN need.

For example: For a public subnet with an internet gateway, the (web server) instances you launch might need to receive inbound HTTPS connections from the internet . Here's how to add another rule to the default security list to enable that traffic:

1. Under Resources, click Security Lists.
2. Click the default security list to view its details. By default, you land on the Ingress Rules page.
3. Click Add Ingress Rule.

4. To enable inbound connections for HTTPS (TCP port 443), enter the following:

   • Stateless: Unselected (this is a stateful rule)
   • Source Type: CIDR
   • Source CIDR: 0.0.0.0/0
   • IP Protocol: TCP
   • Source Port Range: All
   • Destination Port Range: 443
   • Description: An optional description of the rule.
5. Click Add Ingress Rule.

For a production VCN, you typically set up one or more custom security lists for each subnet. If you like, you can edit the subnet to use different security lists. If you choose not to use the default security list, do so only after carefully assessing which of its default rules you want to duplicate in your custom security list. For example: the default ICMP rules in the default security list are important for receiving connectivity messages.