You can connect to the Oracle Services Network using the service gateway for private subnets. The subnet is private and cannot be reached from the internet. Oracle recommends this option for a production system. The following image provides the architecture for private subnet with service gateway.

Figure 2-1 Architecture for Private Subnet with Service Gateway

Perform the following steps to setup private subnet with service gateway.

• Private subnet.

• Gateways for the VCN:

  • Dynamic Routing Gateway (DRG), with a FastConnect or Site-to-Site VPN to your on-premises network.
  • Service gateway to reach Oracle Services Network for database provisioning, backups and patching, and to reach Oracle YUM repos for OS updates.

• Route table: A custom route table for the subnet, with these rules:

  • A route for the on-premises network's CIDR, and target = DRG.
  • A rule for the CIDR label called All <region> Services in Oracle Services Network, and target = the service gateway.
• Security rules to enable the desired traffic to and from the DB system nodes.
  • The following rule enables the DB system to communicate with the Oracle services (for public subnet with internet gateway), or with the Oracle Services Network, which includes all the Oracle services (for private subnet with service gateway). It is redundant with the general egress rule for basic connectivity (and in the default security list). It is optional but recommended in case the general rule (or default security list) is inadvertently changed.
    • Stateless: No (all rules must be stateful)
    • Destination Type: Service
    • Destination Service:
      • When using public subnet (with internet gateway), use the CIDR 0.0.0.0/0
      • When using private subnet (with service gateway), use the CIDR label called All <region> Services in Oracle Services Network
    • IP Protocol: TCP
    • Source Port Range: All
    • Destination Port Range: 443 (HTTPS)
    • Description: An optional description of the rule.

You can connect to the Oracle Services Network using the internet gateway for public subnets. You can use this setup in production if you want to use an internet gateway with the VCN, or if you have services that run only on a public network and need access to the database. This option can be useful when doing a proof-of-concept or development work. The following image provides the architecture for public subnet with internet gateway.

Figure 2-2 Architecture for Public Subnet with Internet Gateway

Perform the following steps to setup public subnet with internet gateway.

• Public subnet.
• Internet gateway.

• Route table: A custom route table for the subnet, with a rule for CIDR 0.0.0.0/0, and target = internet gateway.

• Security rules to enable the desired traffic to and from the DB system nodes.

If you are setting up DB systems (and thus VCNs) in more than one region, make sure the IP address space of the VCNs does not overlap.

The subnet you create for a DB system cannot overlap with 192.168.16.16/28, which is used by the Oracle Clusterware private interconnect on the database instance.

The following table lists the minimum required subnet size.

The Networking section of the Console includes a wizard that creates a VCN along with related resources. It can be useful if you just want to try launching an instance. However, the wizard automatically creates a public subnet and an internet gateway. You may not want this for your production network, so Oracle recommends you create the VCN and other resources individually yourself instead of using the wizard.

For more information on the wizard, see Virtual Networking Quickstart.