When you use Oracle Cloud Infrastructure (OCI), you're not just renting a server; you're creating your own private, isolated network. This is called a Virtual Cloud Network, or VCN. Think of it as your own virtual data center, a digital space that you control completely. It's the foundational block for all your cloud resources, like virtual machines and databases.

Before you can launch any resources, you first need to set up a VCN in a specific OCI region. This VCN comes with its own range of private IP addresses, which you define. This ensures that the resources within your VCN can communicate with each other securely, walled off from other users' networks in the cloud.

A large, open network isn't very practical. For organization and security, you need to divide your VCN into smaller segments. These segments are called subnets. Each subnet lives within a single availability domain (more on that later) and has its own contiguous range of IP addresses that is a part of the VCN's overall address range.

To define these address ranges, we use a notation called Classless Inter-Domain Routing, or CIDR. A CIDR block looks like an IP address followed by a slash and a number, like 10.0.0.0/16. This single line tells you two things: the starting IP address of the range and how many addresses are in it. The number after the slash (the prefix) indicates the size of the network. A smaller prefix, like /16, means a larger network with more IP addresses. A larger prefix, like /24, means a smaller network with fewer addresses.

Not all parts of your application should be exposed to the internet. You might have a web server that needs to be publicly accessible, but a database that should be kept private and secure. This is where the distinction between public and private subnets comes in.

A public subnet is one where resources, like a web server, can have public IP addresses and communicate directly with the internet via an Internet Gateway. This is your network's front door.

A private subnet is for resources that should not be directly reachable from the outside world, like your sensitive databases or application backends. They don't have public IP addresses. They can still access the internet for things like software updates through a special gateway (a NAT Gateway), but the internet cannot initiate connections into the private subnet.

Cloud infrastructure needs to be reliable. To achieve this, OCI builds its regions using a concept called Availability Domains (ADs). Think of an AD as a standalone data center, with its own independent power, cooling, and networking. They are physically separate from each other but are connected by a low-latency, high-bandwidth network.

Why does this matter? By distributing your resources, like virtual machine instances, across multiple ADs, you can protect your application from the failure of a single data center. If one AD experiences an issue, your resources in the other ADs will continue to run, ensuring your application remains available. This design is fundamental to building fault-tolerant systems in the cloud.

With these foundational pieces—VCNs, subnets, and availability domains—you have the essential building blocks to design a secure, scalable, and resilient network architecture in OCI.