--- title: About Networks canonical: https://openvpn.net/cloud-docs/owner/networks/networks---networks/about-networks/ product: CloudConnexa Docs description: A CloudConnexa Network is a representation of your actual physical private network. It represents the Routes to your physical network and the reachable Applications and IP Services. keywords: CloudConnexa Network --- # About Networks Users can connect to the private overlay network created by CloudConnexa and get protection from cyber threats if [Cyber Shield Domain Filtering Basic Protection](https://openvpn.net/cloud-docs/owner/shield/shield---policies/shield---policies---domain-filtering/domain-filtering-protection-levels-and-content-categories.md) has been set. However, you need to connect a network to allow users to access the private applications on it or to use it as a means to access the Internet. A CloudConnexa Network is a representation of your actual physical private network. It represents the reachable general internet, private and public Applications, and IP Services. Connectors connecting your physical private network to your WPC are also associated with the CloudConnexa Network. Connectors that connect your private network to your WPC make an outbound, unattended, always-on tunnel to a [CloudConnexa Region](https://openvpn.net/cloud-docs/owner/get-started/about-cloudconnexa/locations-of-cloudconnexa-regions.md) of your choosing. A Connector installed on a computer or virtual machine acts as a software router. OpenVPN-compatible and IPsec routers can act as Connectors. For more information on Connectors, refer to [About Connectors](https://openvpn.net/cloud-docs/owner/get-started/about-cloudconnexa/cloudconnexa-connectors.md) and [About Network Connectors](https://openvpn.net/cloud-docs/owner/networks/networks---connectors/about-network-connectors.md). Once a Connector is online, any private or public application or service reachable by that network is accessible. It is recommended to configure reachable services as an [Application](https://openvpn.net/cloud-docs/owner/networks/networks---applications/about-network-applications.md). A [DNS record](https://openvpn.net/cloud-docs/owner/settings/settings---dns/set-dns-records.md) must be added, or a private DNS server must be used to resolve domain names to IP addresses for configured [Applications](https://openvpn.net/cloud-docs/owner/networks/networks---applications/about-network-applications.md) representing private applications. If IP routing is desired, [IP Services](https://openvpn.net/cloud-docs/owner/networks/networks---ip-services/about-network-routes-and-ip-services.md) need to be configured. The IP subnets associated with the IP Services create implicit routes for the network. Explicit routes can also be configured when route configuration is enabled. See [Routes Configuration](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/enable-configuring-routes-for-networks.md). > **Note** > > Configure a Host to access all applications and services hosted on an application server rather than connecting the entire private network to CloudConnexa. Refer to [About Hosts](https://openvpn.net/cloud-docs/owner/hosts/hosts---hosts/about-hosts.md). A network can be connected to CloudConnexa using multiple Connectors that can setup tunnels to different CloudConnexa Regions for geographic redundancy or the same Region for increased throughput and fault tolerance. For example, connect your corporate network using two Connectors to the Chicago Region, and remote access traffic from your employees will be equally distributed among them. If one of the Connectors goes down, all remote access traffic will use the Connector that is up and connected. CloudConnexa uses smart routing if multiple Connectors are used. CloudConnexa will optimize the route to your network based on the Region the remote user uses. For example, one of your Network’s Connectors uses the San Jose Region while the other uses Chicago. Traffic from a remote worker connected to Los Angeles will be routed via San Jose, and traffic from a remote worker connected to Ashburn, VA, will be routed via Chicago. The routing logic is based on geographic proximity and also considers network characteristics. ## Common scenarios explained with examples You have an AWS VPC with a subnet of 10.0.0.0/24. A web application named 'webapp' is running on IP address 10.0.0.14, and an FTP server named 'ftpapp' is running on 10.0.0.15. ### **To provide remote access to this VPC:** You log in to the CloudConnexa Administration Portal and add a Network. Let us name it 'AWS\_VPC\_London'. Add a Connector to 'AWS\_VPC\_London,' which will be used to connect it to the closest CloudConnexa Region using IPsec or deploy an OpenVPN Connector on it. With connectivity done, let us discuss routing options: - **\[Recommended\] Application Domain-based Routing** It allows you to easily route traffic to applications distributed among your various connected private networks, using the application’s domain name as a route to the network where that application resides. In addition, the defined applications can be used in configuring access control. You add two [Applications](https://openvpn.net/cloud-docs/owner/networks/networks---applications/about-network-applications.md) to the 'AWS\_VPC\_London' Network and give them domain names: webapp.aws.local and ftpapp.aws.local. Add [DNS record](https://openvpn.net/cloud-docs/owner/settings/settings---dns/set-dns-records.md) for each Application mapping webapp.aws.local to 10.0.0.14 and ftpapp.aws.local to 10.0.0.15. - **IP routing** Identifies which traffic needs to be routed to the connected network based on the subnet IP addresses configured for that network as IP Services. If you need to use IP routing for 'AWS\_VPC\_London', you would configure two IP Services: webapp with subnet 10.0.0.14/32 and ftpapp with 10.0.0.15/32. > **Note** > > You cannot add another Network with IP Services that conflict with 10.0.0.14/32 and 10.0.0.15/32 because they act as implicit routes for the 'AWS\_VPC\_London' Network. Therefore, we recommend using Application Domain-based Routing whenever possible. > **Note** > > A Network can be configured with both Applications and IP Services (i.e., both kinds of routing can be used in conjunction). > **Note** > > The IP subnets associated with the IP Services create implicit routes for the network. Explicit routes can also be configured when route configuration is enabled. See [Routes Configuration](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/enable-configuring-routes-for-networks.md). ### **To use the AWS VPC to reach specific SaaS apps or other internet destinations:** You want to add another layer of security to SaaS to protect against compromised credentials, man-in-the-middle attacks, and other cyber threats. You decide that all access to SaaS must be via CloudConnexa because you want to use all its security features. To selectively steer traffic to specific domain names via CloudConnexa while all other internet traffic uses the local internet, you need only add the domain names to a connected network with internet access. For example, just add salesforce.com as an [Application](https://openvpn.net/cloud-docs/owner/networks/networks---applications/about-network-applications.md) to the 'AWS\_VPC\_London' Network. No DNS record is needed as it is a public domain name. Traffic to salesforce.com will now exit the WPC to the Internet from the 'AWS\_VPC\_London' Network. You can set the login policy on your SaaS app to only allow logins from the public IP address of the AWS network, thus enforcing that all access is via CloudConnexa. ### **To use the AWS VPC as the default route to the internet** You have deployed various cybersecurity and data protection solutions on your AWS VPC and want all internet traffic from your workforce to be routed through the AWS VPC for analysis and protection. To achieve this, you need to do two things: 1. Set the Internet Access for User Groups to' Split Tunnel OFF' to bring all the traffic from user devices to CloudConnexa. 2. Turn ON the Internet Gateway setting for 'AWS\_VPC\_London' Network. Refer to [Make a Network act as an Internet Gateway](https://openvpn.net/cloud-docs/owner/networks/networks---networks/make-a-network-act-as-an-internet-gateway.md) ### **To provide remote access to an Azure VNet with an IP address range that overlaps the AWS VPC:** You now need to provide remote access to Azure VNet due to an acquisition made by your company. It so happens that the Vnet uses the same subnet 10.0.0.0/24 as the already connected 'AWS\_VPC\_London' Network. Connecting the VNet to CloudConnexa would not have been possible using IP routing. But, if you had used Application Domain-based Routing with 'AWS\_VPC\_London' Network, you can add a new Network and just use a different domain to identify and route to applications on the VNet. For example, while webapp.**aws.local** is routed to 10.0.0.14 on the AWS VPC, timecard.**vnet.local** can be routed to the 10.0.0.14 on the VNet by adding a Network to represent the VNet, configuring an [Application](https://openvpn.net/cloud-docs/owner/networks/networks---applications/about-network-applications.md) with the domain name of timecard.**vnet.local**, and adding a corresponding DNS record. ### **To add site-to-site connectivity between the AWS VPC and Azure VNet:** Assuming both the AWS VPS and Azure VNet use OpenVPN Connectors, and application domain-based routing, for site-to-site routing to work properly, you need to: 1. Add a route to the VPC and VNet route tables to set the private IP address of the Connector as the next hop (target) for destination IP addresses in the range used for domain routing (default range of 100.80.0.0/12) and your WPC (default range of 100.96.0.0/11). Refer to, [Domain Routing Subnet](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-the-ip-subnet-range-from-which-to-assign-domain-routing-ip-addresses.md) and [WPC Subnet](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-the-ip-subnet-range-from-which-to-assign-tunnel-ip-addresses.md). 2. All the instances on the cloud network should use the Connector as the DNS Server. The IP address of the DNS server is one before the tunnel IP address of the Connector. For example, if the tunnel IP address of the Connector is 100.96.1.18, then the DNS server IP address is 100.96.1.17. Once the above setup is done, if a VM in AWS wants to communicate with timecard.vnet.local on Azure, a DNS request is made to CloudConnexa because of step 2. The DNS response is of an intermediary IP address in the 100.80.0.0/12 range which results in the traffic going to CloudConnexa via the Connector because of step 1. CloudConnexa then routes it to 10.0.0.14 on the VNet. > **Note** > > Site-to-site routing using Application Domain-based Routing, as shown in the above example, **may not** work with IPsec Connectors used to connect to IaaS providers but **may** work with connections to on-prem routers. If the Networks for the site-to-site networking have IP Services configured, then instead of relying on CloudConnexa DNS and the domain routing IP address range, the static routes can use the IP address subnet ranges of the actual networks. For example, if the AWS VPC uses a subnet range of 192.168.0.0/24 and the Azure VNet has a subnet range of 10.0.0.0/24, then the VNet routing table would need two entries with the Connector as the next hop: 192.168.0.0/24 (AWS VPC subnet) and 100.96.0.0/11 (WPC subnet). Similarly, the routing table of the AWS VPC would need two entries with the Connector as the next hop: 10.10.0.0/24 (Azure VNet subnet) and 100.96.0.0/11 (WPC subnet). ## Related Documents - [Use the Network Wizard](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-remote-access-using-the-network-wizard.md) - [Add a Network for secure internet access](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-secure-internet-access.md) - [Add a Network for secure internet access to select internet destinations](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-secure-internet-access-to-select-internet-destinations.md) - [Add a Network for site-to-site connectivity](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity.md) - [About Application Domain-Based Routing](https://openvpn.net/cloud-docs/owner/networks/networks---applications/about-application-domain-based-routing.md) - [Change the internet access for a Network](https://openvpn.net/cloud-docs/owner/networks/networks---networks/change-the-internet-access-for-a-network.md) - [Manage Networks](https://openvpn.net/cloud-docs/owner/networks/networks---networks/list-filter-and-search-for-networks.md) - [Make a Network act as an Internet Gateway](https://openvpn.net/cloud-docs/owner/networks/networks---networks/make-a-network-act-as-an-internet-gateway.md) - [View, make changes, and delete a Network](https://openvpn.net/cloud-docs/owner/networks/networks---networks/view-make-changes-and-delete-a-network.md) ## Related Tutorials - Secure Internet Access - [Tutorial: Secure All Internet Traffic by Configuring a Private Network as an Internet Gateway](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--secure-all-internet-traffic-by-configuring-a-private-network-as-an-internet-gateway.md) - [Tutorial: Block All Internet Traffic Except To Trusted Internet Destinations](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--block-all-internet-traffic-except-to-trusted-internet-destinations.md) - [Tutorial: Steer Traffic To Specific Internet Destinations Through CloudConnexa](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--steer-traffic-to-specific-internet-destinations-through-cloudconnexa.md) - [Tutorial: Use CloudConnexa for Secure Internet Access](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--use-cloudconnexa-for-secure-internet-access.md) - [Tutorial: Use Multiple Geographically Distributed Internet Gateways to Improve Internet Performance](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--use-multiple-geographically-distributed-internet-gateways-to-improve-internet-performance.md) - Remote Access - [Tutorial: Use CloudConnexa for Remote Access](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/remote-access---ztna/tutorial--use-cloudconnexa-for-remote-access.md) - [Tutorial: Use CloudConnexa for Secure Access to Your AWS VPC](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/remote-access---ztna/tutorial--use-cloudconnexa-for-secure-access-to-your-aws-vpc.md) - [Tutorial: Use CloudConnexa for Zero Trust Network Access (ZTNA)](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/remote-access---ztna/tutorial--use-cloudconnexa-for-zero-trust-network-access--ztna.md) - [Tutorial: Use CloudConnexa for Remote Access to Applications on Networks Having Overlapping IP Address Subnets](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/remote-access---ztna/tutorial--use-cloudconnexa-for-remote-access-to-applications-on-networks-having-overlapping-ip-address-subnets.md) - [Tutorial: Deploy Multiple Connectors To Increase the Performance and Availability of Remote Access](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/remote-access---ztna/tutorial--deploy-multiple-connectors-to-increase-the-performance-and-availability-of-remote-access.md) - Site-to-Site - [Tutorial: Use CloudConnexa for Private Connectivity Between Multiple Sites (Site-to-Site Networking)](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/site-to-site-networking/tutorial--use-cloudconnexa-for-private-connectivity-between-multiple-sites--site-to-site-networking.md) - SaaS Protection - [Tutorial: Restrict Login Access to SaaS With Whitelisting and Without Backhauling All Internet Traffic](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/saas-security/tutorial--restrict-login-access-to-saas-with-whitelisting-and-without-backhauling-all-internet-traffic.md) - [Tutorial: Use CloudConnexa to Secure All Internet Traffic and Restrict Login Access to SaaS](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/saas-security/tutorial--use-cloudconnexa-to-secure-all-internet-traffic-and-restrict-login-access-to-saas.md) ## Related Videos - Secure Internet Access - [Video: Use CloudConnexa To Secure Traffic to the Internet](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-to-secure-traffic-to-the-internet.md) - [Video: Use CloudConnexa for Zero Trust Network Access to a Public SaaS Application](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-for-zero-trust-network-access-to-a-public-saas-application.md) - Remote Access - [Video: Use CloudConnexa to Access Your AWS VPC](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-to-access-your-aws-vpc.md) - [Video: Use CloudConnexa for Zero Trust Network Access to Private Applications on Your AWS VPC](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-for-zero-trust-network-access-to-private-applications-on-your-aws-vpc.md) - [Video: Use CloudConnexa for access to your GCP VPC](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-for-access-to-your-gcp-vpc.md) - [Video: Use CloudConnexa for access to your Azure VNet](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-for-access-to-your-azure-vnet.md) - [Video: Use CloudConnexa to Remotely Access Your Home Network](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-to-remotely-access-your-home-network.md) - [Video: Use CloudConnexa to Connect to Your Remote Desktop Server](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-to-connect-to-your-remote-desktop-server.md) - [Video: Use CloudConnexa for Zero Trust Network Access to a Public SaaS Application](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-for-zero-trust-network-access-to-a-public-saas-application.md) - [Video: Application Domain-Based Routing Cloaks IP Addresses](https://openvpn.net/cloud-docs/videos/features/video--application-domain-based-routing-cloaks-ip-addresses.md) - [Video: No Incoming Connections To Your Network Prevents Denial of Service Attacks](https://openvpn.net/cloud-docs/videos/features/video--no-incoming-connections-to-your-network-prevents-denial-of-service-attacks.md) - [Video: Application Domain-Based Routing Segments Your Network](https://openvpn.net/cloud-docs/videos/features/video--application-domain-based-routing-segments-your-network.md) - [Video: Application Domain-based Routing Allows IP Addresses to Overlap](https://openvpn.net/cloud-docs/videos/features/video--application-domain-based-routing-allows-ip-addresses-to-overlap.md) - [Video: Automatic Network Segmentation Limits Lateral Movement](https://openvpn.net/cloud-docs/videos/features/video--automatic-network-segmentation-limits-lateral-movement.md) - Site-to-Site - [Video: Use CloudConnexa To Create a Site-to-Site Network With Application Domain-Based Routing](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-to-create-a-site-to-site-network-with-application-domain-based-routing.md) - SaaS Protection - [Video: Use CloudConnexa for Zero Trust Network Access to a Public SaaS Application](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-for-zero-trust-network-access-to-a-public-saas-application.md) --- Prev: [Networks - Networks](https://openvpn.net/cloud-docs/owner/networks/networks---networks.md) Next: [Use the Network Wizard](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-remote-access-using-the-network-wizard.md) Index: https://openvpn.net/cloud-docs/llms.txt