[Yandex Cloud documentation](../../index.md) > [Yandex Virtual Private Cloud](../index.md) > [Concepts](index.md) > Cloud networks and subnets

# Cloud networks and subnets

## Cloud networks {#network}

A _cloud network_ is similar to a traditional LAN in a data center. Cloud networks are [created](../operations/network-create.md) in folders and used to transmit information between cloud resources and connect resources to the internet.

Internet access to and from Yandex Compute Cloud VMs and database hosts is provided through [public IP addresses](address.md#public-addresses).

You can manage cloud network and subnet traffic using [security groups](security-groups.md). They contain rules that define the protocols and IP addresses for receiving and sending traffic.

## Subnets {#subnet}

A _subnet_ is a range of IP addresses in a cloud network. Addresses from this range can be assigned to cloud resources, such as VMs and DB clusters. You can only [create subnets](../operations/subnet-create.md) in the folder the cloud network belongs to.

Subnet size is set using the [Classless Inter-Domain Routing](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) (CIDR) method. Subnets can only use private IPv4 addresses from the ranges defined by [RFC 1918](https://tools.ietf.org/html/rfc1918):
* `10.0.0.0/8`
* `172.16.0.0/12`
* `192.168.0.0/16`

The maximum CIDR size in these ranges is `/16`, the minimum is `/28`.

Subnet IP address ranges cannot overlap within the same cloud network. The first two addresses from any range are allocated to the gateway (x.x.x.gateway) and DNS server (x.x.x.dns).

Where:
* `gateway`: Subnet's first IP address, allocated to the gateway.
* `dns`: Subnet's second IP address, allocated to the DNS server.

> For example, a network named `network` having `192.168.1.0/24` as its address can consist of two equal subnets, e.g., `subnet-1` and `subnet-2`:
> * `subnet-1`: `192.168.1.0/25` subnet with the `255.255.255.128` mask and address range from `192.168.1.1` to `192.168.1.126`. Within this subnet, `192.168.1.1` will be used for the gateway, and `192.168.1.2`, for the DNS server.
> * `subnet-2`: `192.168.1.128/25` subnet with the `255.255.255.128` mask and address range from `192.168.1.129` to `192.168.1.254`. Within this subnet, `192.168.1.129` will be used for the gateway, and `192.168.1.130`, for the DNS server.

To get the list of the subnet's [internal IP addresses](address.md#internal-addresses), run the `yc vpc subnet list-used-addresses` CLI command.

Traffic can be transmitted between subnets of the same network, but not subnets of different networks. To transfer traffic between subnets of different networks, use public IP addresses.

To have a resource connected to a subnet, make sure it resides in the same availability zone as the subnet.

You can [move](../operations/network-move.md) a network and subnet between folders within a single [cloud](../../resource-manager/concepts/resources-hierarchy.md). You cannot move subnets between networks and availability zones.

#### Useful links {#see-also}

* [Software-accelerated network in Virtual Private Cloud](software-accelerated-network.md)
* [Infrastructure map](../../console/concepts/infrastructure-map.md)

## Use cases {#examples}

* [Architecture and protection of a basic web service](../tutorials/web-service.md)
* [Routing through a NAT instance](../tutorials/nat-instance/index.md)
* [DHCP settings for interfacing with a corporate DNS server](../tutorials/dhcp-options.md)