DigitalOcean VPC & Networking Guide

DigitalOcean Networking and VPC

DigitalOcean provides a comprehensive networking stack that includes Virtual Private Clouds (VPCs), Cloud Firewalls, Load Balancers, Reserved IPs, DNS management, and VPC Peering. While simpler than the networking models of AWS, Azure, or GCP, DigitalOcean's networking is powerful enough for most production workloads and significantly easier to configure and manage. This guide covers the networking architecture, VPC design patterns, firewall strategies, load balancing, and DNS configuration for DigitalOcean deployments.

VPC Architecture

Default and Custom VPCs

Every DigitalOcean region has a default VPC that all resources are placed in unless you specify otherwise. Default VPCs use auto-assigned IP ranges and provide basic private networking between resources in the same region. For production deployments, you should create custom VPCs with specific IP ranges to enable better network segmentation and security.

# Create a production VPC
doctl vpcs create \
  --name "prod-vpc" \
  --region nyc3 \
  --ip-range "10.10.0.0/16" \
  --description "Production network"

# Create a staging VPC (separate IP range)
doctl vpcs create \
  --name "staging-vpc" \
  --region nyc3 \
  --ip-range "10.20.0.0/16" \
  --description "Staging network"

# List VPCs
doctl vpcs list

VPC Peering

VPC Peering connects two VPCs so resources in each can communicate using private IP addresses. This is useful for connecting production and shared-services VPCs, or for connecting VPCs across different environments while maintaining network isolation. Peered VPCs must have non-overlapping IP ranges and be in the same DigitalOcean region.

# Create a VPC peering connection
doctl vpcs peerings create \
  --name "prod-to-shared" \
  --vpc-ids <prod-vpc-id>,<shared-vpc-id>

# List peering connections
doctl vpcs peerings list <vpc-id>

Cloud Firewalls

Cloud Firewalls are stateful packet filters that control inbound and outbound traffic to your Droplets. They operate at the network edge, filtering traffic before it reaches your Droplet's network interface. This provides better security than host-based firewalls alone because malicious traffic is dropped before it reaches the OS. Cloud Firewalls are free and can be applied to Droplets by ID or tag.

Firewall Design Patterns

The most effective approach is to create role-based firewalls that are applied via tags. Create separate firewalls for web servers, application servers, database servers, and bastion hosts, then tag Droplets with the appropriate role.

# Web server firewall: HTTP/HTTPS from anywhere, SSH from VPC only
doctl compute firewall create \
  --name "fw-web" \
  --inbound-rules "protocol:tcp,ports:80,address:0.0.0.0/0,address:::/0 protocol:tcp,ports:443,address:0.0.0.0/0,address:::/0 protocol:tcp,ports:22,address:10.10.0.0/16" \
  --outbound-rules "protocol:tcp,ports:all,address:0.0.0.0/0,address:::/0 protocol:udp,ports:all,address:0.0.0.0/0,address:::/0 protocol:icmp,address:0.0.0.0/0,address:::/0" \
  --tag-names "web"

# App server firewall: app port from LB only, SSH from VPC
doctl compute firewall create \
  --name "fw-app" \
  --inbound-rules "protocol:tcp,ports:8080,tag:load-balancer protocol:tcp,ports:22,address:10.10.0.0/16" \
  --outbound-rules "protocol:tcp,ports:all,address:0.0.0.0/0,address:::/0 protocol:udp,ports:all,address:0.0.0.0/0,address:::/0 protocol:icmp,address:0.0.0.0/0,address:::/0" \
  --tag-names "app"

# Database firewall: DB port from app servers only
doctl compute firewall create \
  --name "fw-db" \
  --inbound-rules "protocol:tcp,ports:5432,tag:app protocol:tcp,ports:22,address:10.10.0.0/16" \
  --outbound-rules "protocol:tcp,ports:all,address:0.0.0.0/0,address:::/0 protocol:udp,ports:53,address:0.0.0.0/0,address:::/0" \
  --tag-names "database"

Load Balancers

DigitalOcean Load Balancers distribute incoming traffic across multiple Droplets or Kubernetes nodes. They support HTTP, HTTPS, HTTP/2, TCP, and UDP protocols, with SSL termination, sticky sessions, proxy protocol, and health checks. Load Balancers are regional and can be deployed in any DigitalOcean region.

Load Balancer Sizes

Load Balancer Sizes:
  lb-small   - 10,000 simultaneous connections   - $12/mo
  lb-medium  - 25,000 simultaneous connections   - $24/mo
  lb-large   - 100,000 simultaneous connections  - $48/mo

Creating a Load Balancer

# Create a Load Balancer with HTTPS and health checks
doctl compute load-balancer create \
  --name "prod-web-lb" \
  --region nyc3 \
  --size lb-small \
  --vpc-uuid <vpc-uuid> \
  --forwarding-rules "entry_protocol:https,entry_port:443,target_protocol:http,target_port:8080,certificate_id:<cert-id> entry_protocol:http,entry_port:80,target_protocol:http,target_port:8080" \
  --health-check "protocol:http,port:8080,path:/health,check_interval_seconds:10,response_timeout_seconds:5,healthy_threshold:3,unhealthy_threshold:5" \
  --redirect-http-to-https \
  --enable-backend-keepalive \
  --tag-name "web"

# The load balancer automatically includes all Droplets tagged "web"

SSL Certificates

DigitalOcean provides free managed SSL certificates via Let's Encrypt. You can also upload custom certificates. Managed certificates auto-renew before expiration, eliminating the need for manual certificate management.

# Create a managed (Let's Encrypt) certificate
doctl compute certificate create \
  --name "example-cert" \
  --type lets_encrypt \
  --dns-names "example.com,www.example.com"

# List certificates
doctl compute certificate list

DNS Management

DigitalOcean provides free DNS hosting with the ability to manage A, AAAA, CNAME, MX, TXT, NS, SRV, and CAA records. DNS is managed per domain and supports automatic record creation for Droplets, Load Balancers, and Spaces.

# Add a domain
doctl compute domain create example.com

# Create DNS records
doctl compute domain records create example.com \
  --record-type A --record-name @ --record-data <lb-ip> --record-ttl 3600

doctl compute domain records create example.com \
  --record-type CNAME --record-name www --record-data @ --record-ttl 3600

doctl compute domain records create example.com \
  --record-type MX --record-name @ --record-data mail.example.com. \
  --record-priority 10 --record-ttl 14400

doctl compute domain records create example.com \
  --record-type TXT --record-name @ \
  --record-data "v=spf1 include:_spf.google.com ~all" --record-ttl 3600

# List records
doctl compute domain records list example.com

Reserved IPs

Reserved IPs (formerly Floating IPs) are static public IPv4 addresses that can be instantly reassigned between Droplets in the same datacenter region. They are essential for high-availability configurations where you need a stable IP address that can move between servers during failover. Reserved IPs are free when assigned to a Droplet and $5/month when unassigned.

# Create and assign a reserved IP
doctl compute reserved-ip create --region nyc3
doctl compute reserved-ip-action assign <ip> <droplet-id>

# Reassign during failover
doctl compute reserved-ip-action assign <ip> <standby-droplet-id>

Network Architecture Patterns

Simple Web Application

For a simple web application, use a Load Balancer in front of multiple web server Droplets, all in the same VPC. Web servers connect to a managed database via private networking. Cloud Firewalls restrict access: web servers accept HTTP/HTTPS from anywhere, the database accepts connections only from web server Droplets.

Multi-Tier Application

For a multi-tier application, use separate VPCs for each tier (web, app, data) with VPC Peering for controlled communication between tiers. The web tier is the only tier with public internet access. App servers receive traffic only from the web tier Load Balancer. Database servers accept connections only from app servers. This provides defense-in-depth network isolation.

Multi-Region Deployment

For multi-region deployments, deploy identical stacks in multiple DigitalOcean regions and use an external DNS provider (Cloudflare, Route 53) with geographic or latency-based routing to direct users to the closest region. DigitalOcean does not support cross-region VPC Peering, so inter-region communication must traverse the public internet (use TLS encryption).