Oracle Cloud Infrastructure (OCI) Network Firewall Routing Design for Secure Egress Inspection

In Oracle Cloud Infrastructure, deploying a Network Firewall is easy. Designing the routing correctly is where most production issues occur.

A common mistake is allowing private workloads to bypass inspection due to incorrect route-table design or asymmetric routing.

This guide demonstrates a simple production-style egress inspection architecture using:

• OCI Network Firewall
• Internet Gateway (IGW)
• private subnet workloads
• route-table steering
• stateful outbound inspection

The goal is to securely control outbound internet access from private Oracle Linux workloads.

Executive Summary

This design routes all outbound traffic from a private subnet through OCI Network Firewall before reaching the internet.

Allowed:

• HTTP (TCP/80)
• HTTPS (TCP/443)

Denied:

• all other outbound traffic

Key concept:

0.0.0.0/0 → Firewall Private IP

The firewall becomes the mandatory egress inspection point.

Architecture Overview

High-Level Topology

High-Level Topology

OCI Logical Design

OCI Logical Design

Key Design Principle

The private workload subnet does not send traffic directly to the Internet Gateway.

Instead:

0.0.0.0/0 → OCI Network Firewall Private IP

This makes the firewall the mandatory inspection point.

Traffic Flow Analysis

Outbound Packet Flow

Step-by-Step Flow

· Oracle Linux VM initiates HTTPS traffic.

· Subnet route table forwards traffic to firewall private IP.

· OCI Network Firewall performs:

• session creation,
• policy inspection,
• state tracking.

· Firewall forwards approved traffic toward IGW.

· Internet response returns through IGW.

· Return traffic reaches firewall session table.

· Firewall validates session state.

· Firewall forwards traffic back to VM.

Packet Flow Diagram

Packet Flow Diagram

The return path must traverse the same firewall. Otherwise, asymmetric routing breaks stateful sessions.

Configuration Steps

1. Create VCN and Subnets

| Component          | CIDR         |
| ------------------ | ------------ |
| VCN                | 10.10.0.0/16 |
| Private App Subnet | 10.10.1.0/24 |
| Firewall Subnet    | 10.10.2.0/24 |

2. Deploy OCI Network Firewall

Deploy the firewall in a dedicated subnet.

Example:

• Firewall Private IP: 10.10.2.10

3. Configure Route Tables

Private Subnet Route Table

| Destination | Target     |
| ----------- | ---------- |
| 0.0.0.0/0   | 10.10.2.10 |

Why? All outbound traffic is forced through the firewall.

Firewall Subnet Route Table

| Destination | Target           |
| ----------- | ---------------- |
| 0.0.0.0/0   | Internet Gateway |

Firewall Policy Example

| Rule        | Service | Action |
| ----------- | ------- | ------ |
| Allow HTTPS | TCP/443 | Allow  |
| Allow HTTP  | TCP/80  | Allow  |
| Deny All    | Any     | Deny   |

Asymmetric Routing Example

Incorrect Design

Incorrect Design

This breaks firewall state tracking.

Correct Design

Correct Design

NSG Example

Workload NSG

Allow outbound:

• TCP/80
• TCP/443

Logging & Monitoring

Enable:

• OCI Network Firewall Logs
• VCN Flow Logs
• OCI Logging

Monitor:

• denied sessions
• unusual outbound traffic
• policy violations

Verification

Test outbound access:

curl https://ifconfig.me

Test HTTPS:

curl -I https://oracle.com

Test blocked traffic:

telnet google.com 25

Expected:

• blocked by firewall policy

Troubleshooting

No Internet Access

Check:

• route tables
• firewall policy
• NSGs
• firewall subnet routing

Intermittent Connectivity

Most common cause:

• asymmetric routing

Symptoms:

• TCP timeout
• SSL handshake failure
• unstable sessions

Best Practices

• Use dedicated firewall subnets
• Keep workloads private
• Apply least-privilege outbound rules
• Monitor denied traffic
• Avoid asymmetric routing

Assumptions

This article assumes:

• single VCN deployment
• IPv4 environment
• outbound inspection only
• Oracle Linux workload

References

• OCI Network Firewall Documentation
• OCI Route Tables Documentation
• OCI Internet Gateway Documentation
• OCI NSG Documentation
• OCI Logging Documentation

OCI Network Firewall routing is fundamentally a traffic-engineering problem. Once the route path is designed correctly, inspection becomes predictable, secure, and operationally stable.