A VPC is a private network in the cloud. A VPN is a secure tunnel over the public internet. The two are different and the team often needs both. The VPC is the network; the VPN is the secure connection to the network.
Table of contents
- What a VPC is
- What a VPN is
- The two compared
- When to use a VPC
- When to use a VPN
- When to use both
- FAQ
What a VPC is
A VPC (Virtual Private Cloud) is a private network in the cloud. The VPC is logically isolated from other networks in the cloud; the team has full control over the IP address range, the subnets, the route tables, the security groups, and the network ACLs.
The VPC is the network. The team’s resources (EC2 instances, RDS databases, Lambda functions) run inside the VPC. The VPC connects to the internet through an internet gateway, to other VPCs through VPC peering, and to the on-premises network through a VPN or a Direct Connect.
What a VPN is
A VPN (Virtual Private Network) is a secure tunnel over the public internet. The VPN encrypts the traffic between two endpoints, so the traffic cannot be intercepted by a third party.
The two common types of VPN:
- Site-to-site VPN. The VPN is between the on-premises network and the cloud VPC. The traffic between the two networks is encrypted.
- Client VPN. The VPN is between an individual client and the cloud VPC. The traffic from the client to the VPC is encrypted.
The two compared
The two compared:
- VPC: the network in the cloud. Logically isolated. The team has full control over the configuration.
- VPN: the secure tunnel over the public internet. The traffic is encrypted. The team has control over the endpoints and the routing.
When to use a VPC
The team that should use a VPC:
- The team that is running any workload in the cloud. The VPC is the default for most cloud deployments.
- The team that needs to isolate the workload from other workloads in the cloud.
- The team that needs to control the network configuration (the IP range, the subnets, the security groups).
When to use a VPN
The team that should use a VPN:
- The team that needs to connect the on-premises network to the cloud VPC.
- The team that needs to allow individual clients to access the cloud VPC.
- The team that needs to encrypt the traffic between the on-premises network and the cloud VPC.
When to use both
The team that should use both:
- The team that is running a hybrid cloud setup (on-premises + cloud). The VPC is the cloud network; the VPN is the secure connection between the on-premises network and the VPC.
- The team that needs to allow individual clients to access the cloud VPC. The VPC is the cloud network; the VPN is the secure connection for the clients.
- The team that has a compliance requirement that the traffic to the cloud VPC must be encrypted. The VPC is the cloud network; the VPN is the encryption layer.
FAQ
What is a VPC?
A Virtual Private Cloud. A private network in the cloud, logically isolated from other networks. The team has full control over the IP range, the subnets, the route tables, the security groups, and the network ACLs.
What is a VPN?
A Virtual Private Network. A secure tunnel over the public internet. The traffic is encrypted between the two endpoints.
What is the difference between a VPC and a VPN?
A VPC is the network. A VPN is the secure connection to the network.
Do I need a VPC?
If you are running any workload in the cloud, yes. The VPC is the default for most cloud deployments.
Do I need a VPN?
If you need to connect the on-premises network to the cloud VPC, or if you need to allow individual clients to access the cloud VPC, yes.
Can I use a VPC without a VPN?
Yes. The VPC can connect to the internet through an internet gateway, to other VPCs through VPC peering, and to the on-premises network through a VPN or a Direct Connect.
Can I use a VPN without a VPC?
Yes, but it is unusual. The VPN is typically used to connect to a VPC.
If you are sizing a network tier for a new project, the RunxBuild hosting calculator is the place to model the line items. The VPC, the VPN, the subnets, the bandwidth - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual network performance in one place.