Oracle VCN, subnets and network security groups on STACKIT

A security list and a public subnet, assessed

A small network written for this page and assessed by StackToIT on 4 November 2026. Left: the input, lines 48 to 75 of main.tf. Right: the result for the same two resources, an excerpt of assessment.json with the values as the run wrote them. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "oci_core_security_list" "public" {
  compartment_id = var.compartment_id
  vcn_id         = oci_core_vcn.main.id
  display_name   = "public-web"

  ingress_security_rules {
    protocol = "6"
    source   = "0.0.0.0/0"

    tcp_options {
      min = 443
      max = 443
    }
  }

  egress_security_rules {
    protocol    = "all"
    destination = "0.0.0.0/0"
  }
}

resource "oci_core_subnet" "public" {
  compartment_id    = var.compartment_id
  vcn_id            = oci_core_vcn.main.id
  cidr_block        = "10.40.0.0/24"
  display_name      = "public"
  security_list_ids = [oci_core_security_list.public.id]
}

[
  {
    "id": "oci_core_security_list.public",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT security groups"
      },
      "reason": "A security list applies to a whole subnet, while a STACKIT security group attaches to a server. Its rules are rewritten and attached to the workloads of that subnet."
    }
  },
  {
    "id": "oci_core_subnet.public",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT network"
      },
      "reason": "A subnet becomes a STACKIT network with its own address range. Review the public or private role of the subnet and the workloads on it."
    }
  }
]

• The firewall moves to the workloads

  The security list protects a whole subnet in Oracle Cloud. A STACKIT security group attaches to network interfaces, so the rewritten rules are attached to the workloads that used to sit in that subnet.

• Medium confidence, with a reason

  Both units are MEDIUM. The subnet is the first thing to review: the run asks for its public or private role and the workloads on it to be checked, because STACKIT decides reachability differently.

• Nothing is drafted for them

  On this build the run writes no STACKIT resource block for an Oracle estate. The assessment, the architect report and the work packages are the deliverable; the Terraform is written by your team.

How the VCN estate maps

The estate has nine resources and eight units: the security rule is read together with its group. Five units are RECONFIGURE and three are MANUAL_REVIEW. Six of the eight carry LOW confidence, the VCN and the private subnet among them, because both are linked to the route table the run does not know.

Private subnet and NSG, with what is left open

The private subnet points to a route table, and the group has one rule that opens port 8080 from the public subnet. Both resources are mapped, and the run states what it did not read. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "oci_core_subnet" "private" {
  compartment_id             = var.compartment_id
  vcn_id                     = oci_core_vcn.main.id
  cidr_block                 = "10.40.10.0/24"
  display_name               = "private-app"
  prohibit_public_ip_on_vnic = true
  route_table_id             = oci_core_route_table.private.id
}

resource "oci_core_network_security_group" "app" {
  compartment_id = var.compartment_id
  vcn_id         = oci_core_vcn.main.id
  display_name   = "app"
}

[
  {
    "id": "oci_core_subnet.private",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "LOW",
      "target": {
        "service": "STACKIT network"
      },
      "reason": "A subnet becomes a STACKIT network with its own address range. Review the public or private role of the subnet and the workloads on it."
    }
  },
  {
    "id": "oci_core_network_security_group.app",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "LOW",
      "target": {
        "service": "STACKIT security groups"
      },
      "reason": "A network security group becomes a STACKIT security group. Its rules are rewritten, and STACKIT rules only allow traffic."
    }
  }
]

• The rule is yours to rewrite

  The group becomes a STACKIT security group and its rules are rewritten. The single ingress rule on 8080 is where you start; the run records it as a linked, unmapped item rather than inventing a translation.

• LOW is information

  The private subnet is LOW because it names a route table that the run cannot assess. Closing that question, not the subnet itself, raises the confidence.

Gateways and the route table

The internet gateway, the NAT gateway and the route table that sends private traffic to it. The run does not map them one to one and says so. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "oci_core_internet_gateway" "edge" {
  compartment_id = var.compartment_id
  vcn_id         = oci_core_vcn.main.id
  display_name   = "edge"
  enabled        = true
}

resource "oci_core_nat_gateway" "egress" {
  compartment_id = var.compartment_id
  vcn_id         = oci_core_vcn.main.id
  display_name   = "egress"
}

resource "oci_core_route_table" "private" {
  compartment_id = var.compartment_id
  vcn_id         = oci_core_vcn.main.id
  display_name   = "private"

  route_rules {
    destination       = "0.0.0.0/0"
    destination_type  = "CIDR_BLOCK"
    network_entity_id = oci_core_nat_gateway.egress.id
  }
}

[
  {
    "id": "oci_core_internet_gateway.edge",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "Gateways do not carry over one to one. Whether the egress needs a STACKIT network with a public address or a NAT design is a decision for the network owner."
    }
  },
  {
    "id": "oci_core_nat_gateway.egress",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "Gateways do not carry over one to one. Whether the egress needs a STACKIT network with a public address or a NAT design is a decision for the network owner."
    }
  },
  {
    "id": "oci_core_route_table.private",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "oci_core_route_table is not in the knowledge base catalogue; an architect has to decide the target. Nothing of this resource is assessed or drafted (unknown source type)."
    }
  }
]

• Gateways are a design question

  Whether egress needs a STACKIT network with a public address or a NAT design is a decision for the network owner. The class MANUAL_REVIEW says exactly that.

• The route table is unknown to the run

  The route table type is not in the catalogue, so nothing of it is assessed or drafted. Treat its rules as a checklist item: every destination and next hop has to be reproduced by a design.

Configuration differences that bite

Facts below come from the Oracle and STACKIT documentation pages listed at the end. They are the places where a literal copy of the rules changes behaviour.

• Scope of the firewall

  Oracle security lists are configured at the subnet level, so all VNICs of a subnet share them. A network security group applies only to the VNICs placed in it, and a VNIC can be in up to five groups. A STACKIT security group attaches to network interfaces, and one interface can carry several groups.

• Deny is the default, on both

  A new Oracle network security group is empty and has no default rules. On STACKIT all incoming traffic is blocked by default except traffic from members of the same group, and outgoing traffic is allowed by default. An explicit allow-all egress rule in a security list therefore matches the STACKIT default.

• Stateless rules need a second look

  Both sides only allow traffic, and neither evaluates rules in a fixed order. The difference is state: Oracle lets you mark single rules as stateless, while STACKIT security groups can be stateful, so the reply to an allowed connection is admitted automatically. A pair of stateless Oracle rules for request and reply is re-read as one intent, not copied rule by rule.

• Groups as sources

  An Oracle NSG rule can name another NSG as its source or destination. The STACKIT concepts page describes rules by IP or CIDR, so check for each such rule whether an address-based equivalent is acceptable.

• Public means different things

  Oracle needs a public subnet, an enabled internet gateway, a route rule, a public IP and open rules together. On STACKIT a network reaches the internet outbound through source NAT, and inbound reachability needs a separate public IP address attached to a network interface or a load balancer.

• Address ranges

  An Oracle VCN allows /16 down to /30. A STACKIT network ranges from /29 to /8. In a Network Area the range of a new network is cut from the area ranges, so plan the address space once for all projects.

The order the run proposes

Waves follow the dependencies in the input. Units in a wave can move in parallel; a unit waits for everything it depends on.

1. 01

   Wave 1

   The VCN: its address plan is the frame from which the STACKIT networks are cut.

2. 02

   Wave 2

   The internet gateway, the NAT gateway, the network security group and the security list.

3. 03

   Wave 3

   The route table and the public subnet.

4. 04

   Wave 4

   The private subnet, last because it depends on the route table and with it on the NAT gateway.

Questions network teams ask

Sources

• Oracle Cloud Infrastructure: Networking overview
• Oracle Cloud Infrastructure: Network security groups
• Oracle Cloud Infrastructure: Security lists
• STACKIT: Security groups, concepts
• STACKIT: Network Area, concepts
• STACKIT: Virtual Network, concepts