Overview

People using cloud infrastructure have a variety of needs and preferences when it comes to the networking services provided by the cloud.A virtual network is a logical construct that enables multi-tenancy on a single physical network. In Zergaw CloudStack a virtual network is isolated.

When you define a new virtual network, all your settings for that network are stored in Zergaw CloudStack. The actual network resources are activated only when the first resource starts in the network. When all Instances have left the virtual network, the network resources are garbage collected so they can be allocated again. This helps to conserve network resources.

Zergaw CloudStack provides a powerful, flexible, and software-defined virtual networking system that allows tenants to deploy secure, isolated, and scalable networks within their cloud environments. The platform abstracts complex networking operations and enables self-service creation of networks, IP management, firewalls, and routing functions all through the Zergaw CloudStack UI or API.

Key Concepts of Virtual Networking in Zergaw CloudStack

Zergaw CloudStack networking is built around several core concepts that define how traffic flows within and outside virtual machines.

1. Network Offerings

A network offering defines the capabilities and services available to a network, such as:

• DHCP
• DNS
• Source NAT
• Static NAT
• Load Balancing
• Port Forwarding
• User-defined firewall rules
• VPN services

Zergaw CloudStack administrators create network offerings; end-users select from these when creating networks.

2. Network Isolation

Zergaw CloudStack supports fully isolated virtual networks for each tenant using:

• VLAN-based isolation
• VXLAN overlay networks
• Security groups (in certain zones)

Each account’s network is completely isolated from others, ensuring privacy and tenant-level security.

Types of Virtual Networks

1. Isolated Networks

• The most common network type for tenants.
• Provides complete layer-3 isolation.
• Supports services such as NAT, firewall, DHCP, and VPN.
• Each network receives its own virtual router.

Ideal for:

• Web servers
• Application stacks
• Multi-tier environments

2. L2 Networks

L2 networks provide network isolation without any other services. This means that there will be no virtual router. It is assumed that the end user will have their own IPAM in place, or that they will statically assign IP addresses.

• L2 networks can be created by the end users
• Zergaw CloudStack does not assign IP addresses to instances.
• User Data and metadata can be passed to the instance using a config drive

3. Shared Networks/Direct Public Network

• Layer-2 shared networks where multiple accounts can connect to the same broadcast domain.
• Often used for:
  • Direct Public IP delivery to Instances
  • For VNF Appliances
  • Shared Networks accross domains and accounts

Shared networks are configured by Zergaw CloudStack administrators, not end-users.

4. VPC (Virtual Private Cloud)

A Virtual Private Cloud allows building multi-tier network topologies within a single tenant. Features include:

• Multiple isolated tiers (subnets)
• A single VPC virtual router per VPC
• Private gateways (linking on-prem networks)
• Site-to-Site VPN

Best for:

• Large deployments
• Multi-tier application stacks
• Production environments

Virtual Routers

Each isolated network or VPC contains a system-managed Virtual Router (VR) that provides essential services:

• DHCP & DNS
• Source NAT
• Static NAT
• Port forwarding
• Firewall rules
• VPN services
• Load balancing (depending on offering)

The VR abstracts network complexity and provides per-network security boundaries.

Public IP Address Management

Tenants can acquire public IP addresses for:

• Exposing applications to the internet
• Assigning static NAT (one VM per IP)
• Configuring port forwarding (many VMs behind a single IP)
• Load balancing services

Each public IP can be independently configured with:

• Firewall rules
• NAT rules
• LB rules

Inbound & Outbound Traffic Controls

• Firewall Rules: Define which inbound connections are allowed to reach the network.
• Egress Rules: Control outbound traffic from VMs to the internet.
• Port Forwarding: Maps a public IP and port to a private VM port.
• Static NAT: Links one public IP to one VM permanently.

Network Topology at a Glance

A typical tenant network includes:

.            Internet
                |
           [Public IP ]
                |
      +-----------------------+
      | Virtual Router (VR)   |
      | - DHCP/DNS            |
      | - NAT                 |
      | - Firewall            |
      | - VPN                 |
      +-----------------------+
                |
    +-----------+---------------+
    | VM Network 192.168.1.0/24 |
    +---------------------------+

VM Networking

Each VM receives:

• A private IP from the virtual router via DHCP
• A virtual NIC (vNIC) connected to the user network
• Optionally, one or more secondary network interfaces
• Access to services like DNS and DHCP automatically

Traffic between VMs in the same network remains internal and never traverses the internet.

Summary

Zergaw CloudStack’s virtual networking model provides a secure, flexible, and feature-rich system for tenants to build isolated cloud environments. Through isolated networks, VPCs, shared networks, and comprehensive firewall/NAT features, users can deploy applications ranging from simple web workloads to complex multi-tier architectures.

Zergaw CloudStack abstracts all networking complexities while giving tenants full control over how their virtual networks operate.

@startuml
title Zergaw CloudStack – Virtual Networking Overview

package "Network Offerings" {
  [Isolated Network] as iso
  [VPC] as vpc
  [Shared Network] as shared
}

package "Network Virtual Appliances" {
  [Virtual Router (VR)] as vr
  [VPC Virtual Router] as vpcvr
  [DHCP / DNS] as dhcp
  [User Data Service] as userdata
}

package "Security & Services" {
  [Firewall Rules] as fw
  [NAT (SNAT/DNAT)] as nat
  [Port Forwarding] as pf
  [Load Balancing] as lb
}

package "IP Management" {
  [Public IP Pool] as pip
  [Private IP Ranges] as priv
  [Source NAT] as snat
  [Static NAT] as ssnat
}

iso --> vr : Uses VR for\nRouting & Services
vpc --> vpcvr : Multi-tier Routing\n+ Distributed Services

vr --> nat : Provides
vr --> fw : Enforces
vr --> dhcp : Provides DHCP/DNS
vr --> userdata : Cloud-init / metadata

vpcvr --> lb
vpcvr --> pf

pip --> vr
pip --> vpcvr
pip --> shared
priv --> iso
priv --> vpc

snat --> iso
snat --> vpc

ssnat --> iso
ssnat --> vpc

@enduml