Build OCI networking from scratch — VCN, subnets, gateways, and security rules.
Use when creating a new VCN, debugging connectivity issues, or setting up security lists and NSGs.
Trigger with "oci networking", "vcn setup", "security list", "nsg rules", "oci subnet".
Build OCI networking from scratch — VCN, subnets, gateways, and security rules.
Use when creating a new VCN, debugging connectivity issues, or setting up security lists and NSGs.
Trigger with "oci networking", "vcn setup", "security list", "nsg rules", "oci subnet".
allowed-tools
Read, Write, Edit, Bash(pip:*), Grep
version
1.7.0
license
MIT
author
Jeremy Longshore <jeremy@intentsolutions.io>
tags
["saas","oraclecloud","oci"]
compatibility
Designed for Claude Code
OCI Networking — VCN, Subnets & Security Rules
Overview
Build a working OCI network from scratch using the Python SDK. OCI networking (VCN, subnets, security lists, NSGs, gateways) has more moving parts than AWS VPC. A misconfigured security list silently drops traffic with no error — just timeouts. This skill creates a complete network topology with public and private subnets, internet and NAT gateways, route tables, and Network Security Groups (NSGs).
Purpose: Build a production-ready VCN with proper routing and security rules that actually works on first deploy.
Prerequisites
OCI Python SDK — pip install oci
Config file at ~/.oci/config with fields: user, fingerprint, tenancy, region, key_file
IAM policy — Allow group Developers to manage virtual-network-family in compartment <name>
# Public route table — all traffic via internet gateway
public_rt = network.create_route_table(
oci.core.models.CreateRouteTableDetails(
compartment_id=config["tenancy"],
vcn_id=vcn.id,
display_name="public-rt",
route_rules=[
oci.core.models.RouteRule(
network_entity_id=igw.id,
destination="0.0.0.0/0",
destination_type="CIDR_BLOCK",
)
],
)
).data
# Private route table — all traffic via NAT gateway
private_rt = network.create_route_table(
oci.core.models.CreateRouteTableDetails(
compartment_id=config["tenancy"],
vcn_id=vcn.id,
display_name="private-rt",
route_rules=[
oci.core.models.RouteRule(
network_entity_id=nat.id,
destination="0.0.0.0/0",
destination_type="CIDR_BLOCK",
)
],
)
).data
Step 4: Create Network Security Group (NSG)
Use NSGs instead of security lists. NSGs attach to VNICs (per-instance) while security lists apply to entire subnets. NSGs are easier to manage and the OCI-recommended approach.
# List all subnets in the VCN to confirm setup
subnets = network.list_subnets(
compartment_id=config["tenancy"],
vcn_id=vcn.id
).data
for s in subnets:
print(f"{s.display_name} | {s.cidr_block} | Public IPs: {not s.prohibit_public_ip_on_vnic}")
Output
Successful completion produces:
A VCN with a /16 CIDR block and DNS resolution enabled
Internet gateway (public traffic) and NAT gateway (private outbound)
Separate route tables for public and private subnets
An NSG with SSH (22), HTTP (80), and HTTPS (443) ingress rules
Public and private subnets with correct routing
Error Handling
Error
Code
Cause
Solution
Not authorized
404 NotAuthorizedOrNotFound
Missing IAM policy for virtual-network-family
Add policy: Allow group X to manage virtual-network-family in compartment Y
CIDR overlap
400 InvalidParameter
Subnet CIDR conflicts with existing subnet
Use non-overlapping /24 blocks within the VCN /16 range
Limit exceeded
400 LimitExceeded
VCN or subnet limit reached
Check limits in Console > Governance > Limits; request increase
Silent traffic drop
N/A
Security list or NSG missing ingress rule
Check NSG rules — OCI drops unmatched traffic with no ICMP unreachable
Not authenticated
401 NotAuthenticated
Bad API key or config
Verify ~/.oci/config key_file and fingerprint
Rate limited
429 TooManyRequests
Too many API calls
Add backoff; OCI does not return Retry-After header
Debugging silent drops: If traffic times out, check in this order: (1) NSG ingress rules, (2) security list rules, (3) route table entries, (4) gateway exists and is enabled. OCI applies security lists AND NSGs — traffic must pass both.
rules = network.list_network_security_group_security_rules(
network_security_group_id=nsg.id
).data
for r in rules:
print(f"{r.direction} | {r.protocol} | {r.source or r.destination} | {r.description}")
Resources
VCN Overview — networking concepts and best practices
After networking is in place, launch instances with oraclecloud-core-workflow-a (use the subnet IDs from Step 5), or set up monitoring with oraclecloud-query-transform to watch network traffic metrics.
