Oracle OCI Networking: VCN, Load Balancer & Egress Costs Explained 2026

VCN, Subnets & Core Networking: What OCI Charges and What It Doesn't

Oracle's Virtual Cloud Network (VCN) is the fundamental networking construct in OCI — the equivalent of an AWS VPC or Azure Virtual Network. The core VCN infrastructure — the VCN itself, subnets, route tables, security lists, and network security groups — is provided at no additional charge. Oracle does not charge per-VCN or per-subnet, unlike some networking configurations on other clouds where subnet counts create cost accumulation.

Traffic within the same VCN — between compute instances, database servers, and load balancers within the same availability domain or fault domain — is also free. This is a genuine cost advantage for OCI deployments that keep workloads architecturally close: an Oracle Database server and its application tier in the same VCN incur no networking charges for the traffic between them, regardless of volume.

Cross-availability-domain traffic within the same OCI region is also provided at no charge. OCI's regional subnets span all availability domains in a region, meaning a database in one AD and an application server in another AD within the same region can communicate without data transfer charges. This simplifies high-availability architecture design and removes a cost consideration that complicates multi-AZ deployments on AWS.

What Oracle does charge for is data movement that crosses the regional boundary: inter-region data transfer, data egress to the internet, and FastConnect circuit usage. These are the networking cost components that must be modelled accurately to produce realistic OCI total cost projections. Many enterprises discover their Oracle cloud TCO models are materially understated because networking egress was excluded from the initial cost analysis.

OCI Load Balancer Pricing

OCI offers two load balancer types: the flexible Load Balancer (Layer 4/Layer 7) and the Network Load Balancer (Layer 4 only, ultra-low latency). Both are relevant to Oracle application deployments — Oracle Fusion Cloud and EBS environments typically use the flexible Load Balancer for HTTPS traffic distribution, while high-performance database connection routing may use the Network Load Balancer.

OCI Load Balancer pricing consists of two components: an hourly charge for the load balancer instance and a per-GB charge for data processed. The flexible Load Balancer starts at approximately $0.025/hour for the minimum bandwidth shape (10 Mbps), scaling to $0.168/hour for a 8 Gbps shape. Data processing is billed at approximately $0.008/GB for the first 10 TB/month, dropping to $0.005/GB for higher volumes.

For enterprise Oracle workloads, the flexible Load Balancer's bandwidth shape selection requires careful analysis. A shape that is too small creates throughput bottlenecks during peak load — Oracle ERP applications with significant report extraction workloads can easily saturate a 100 Mbps load balancer shape. A shape that is too large wastes hourly spend. Oracle's flexible bandwidth shapes allow resizing without downtime, but the billing switches to the new shape rate immediately and retroactively for that billing hour, creating a cost impact that teams sometimes miss during capacity events.

The Network Load Balancer is priced at a flat hourly rate ($0.008/hour) plus $0.006/GB processed, making it significantly cheaper than the flexible Load Balancer for high-volume, simple connection routing scenarios. For Oracle Database connection multiplexing — where an application tier distributes database connections across multiple RAC nodes — the Network Load Balancer provides a cost-efficient solution if the routing logic is simple. Oracle RAC licensing requirements are not affected by the load balancer type used for connection routing.

FastConnect: Dedicated Connectivity Pricing and Licensing Implications

Oracle FastConnect provides dedicated network connectivity between an enterprise's on-premise environment and OCI, bypassing the public internet. FastConnect is equivalent to AWS Direct Connect or Azure ExpressRoute and is essential for enterprises running latency-sensitive Oracle workloads that span on-premise and OCI — Oracle Data Guard replication, Oracle GoldenGate change data capture, or hybrid Oracle EBS deployments where some modules run on-premise while others run on OCI.

FastConnect pricing depends on the provider model. Oracle offers two connectivity options: colocation with Oracle's FastConnect locations (where the customer connects directly in a shared data center) and through third-party network providers who have established FastConnect partnerships. Provider-based FastConnect is typically priced by bandwidth commitment (1 Gbps, 10 Gbps) and billed either by Oracle or by the network provider depending on the commercial arrangement.

A 1 Gbps FastConnect circuit through an Oracle partner typically costs $750–$1,500/month depending on location and provider. A 10 Gbps circuit runs $3,000–$8,000/month. These costs are separate from OCI compute and storage charges and must be added to any OCI cost model for hybrid deployments. Enterprises that initially model OCI costs without FastConnect and then discover they require dedicated connectivity for Oracle Database replication face budget overruns that could have been anticipated with proper upfront scoping.

From a licensing perspective, FastConnect does not create licensing obligations beyond what the workloads themselves require. However, FastConnect enables hybrid deployment architectures — where Oracle Database instances span on-premise and OCI — that create complex licensing questions. An Oracle RAC deployment where some nodes are on-premise and some are on OCI requires licenses for all nodes regardless of where they sit physically. Oracle's BYOL terms require that on-premise licenses transferred to OCI are not simultaneously used for the on-premise deployment from which they were moved — ensuring the same license cannot count for two locations simultaneously.

OCI Site-to-Site VPN: Cost and Limitations

OCI Site-to-Site VPN provides IPSec-encrypted connectivity between on-premise networks and OCI VCNs. Unlike FastConnect, VPN uses the public internet as the underlying transport, making it lower cost but subject to internet latency variability. Oracle charges approximately $0.05 per VPN connection-hour — roughly $36/month per VPN tunnel.

For Oracle Database replication workloads that require low, consistent latency — Data Guard redo log shipping, GoldenGate change capture — VPN is generally unsuitable due to internet latency variability. Redo log shipping delays translate directly to recovery point objective (RPO) degradation, and Oracle Data Guard's performance mode cannot guarantee the sub-second log gap that mission-critical Oracle Database deployments typically require over a VPN connection.

VPN is appropriate for administrative access to OCI environments, backup traffic where latency tolerance is high, and non-Oracle workloads where SLA requirements are moderate. For these use cases, the $36/month per tunnel is highly cost-effective compared to FastConnect's per-circuit costs. Many enterprises run FastConnect for production database replication alongside VPN tunnels for administrative and backup traffic — a layered approach that provides appropriate connectivity at each cost tier.

Data Egress Costs: Where Oracle Cloud Networking Gets Expensive

OCI data egress pricing is structured around three categories: egress to the internet, inter-region data transfer, and traffic to on-premise via FastConnect or VPN. Understanding each category is critical to building accurate OCI cost models for Oracle workloads.

Egress to the internet is free for the first 10 TB per month for customers on Universal Credits commitments. After the 10 TB free allowance, internet egress costs approximately $0.0085/GB — significantly lower than AWS's $0.09/GB or Azure's $0.087/GB for equivalent traffic. For Oracle applications that serve data to external internet consumers — public APIs, user-facing web applications, report distribution — OCI's lower egress rate is a genuine cost advantage that can reduce total internet egress costs by 80–90% compared to equivalent AWS deployments.

Inter-region data transfer — moving data between two OCI regions — costs approximately $0.02/GB. This charge applies to cross-region GoldenGate replication, active-active Data Guard configurations across OCI regions, and data transfer between regional tenancies. For Oracle databases with large log volumes (high-transaction-rate OLTP systems), inter-region replication can generate significant monthly transfer costs. A database generating 1 TB of daily redo log traffic in an active-active GoldenGate configuration across two OCI regions creates approximately $600/month in cross-region data transfer charges alone.

Data ingress into OCI from on-premise is provided at no charge, regardless of whether the connection uses the internet, VPN, or FastConnect. This asymmetric pricing — free inbound, charged outbound — reflects the industry standard and incentivises workload migration to OCI over time. Once data is in OCI, the cost of retrieving it (or moving it elsewhere) creates a switching cost that benefits Oracle commercially.

NAT Gateway & Internet Gateway: Outbound Internet Traffic

OCI's NAT Gateway enables instances in private subnets to initiate outbound internet connections without receiving inbound connections — essential for Oracle Database instances that need to reach Oracle support servers, update repositories, or external API endpoints without direct internet exposure. The NAT Gateway itself is free; charges apply only for the data processed through it at the standard egress rates described above.

The Internet Gateway provides both inbound and outbound internet connectivity for instances with public IP addresses. Like the NAT Gateway, the Internet Gateway infrastructure is provided at no charge; costs arise from outbound data transfers that exceed the free allowance. For Oracle application tiers that serve internet traffic — external Oracle EBS portals, Oracle APEX applications with external user access — the Internet Gateway is the appropriate routing path.

Public IP addresses are free in OCI when assigned to running instances but incur a charge of approximately $0.0036/hour when reserved but unattached to running instances. This is a minor cost for most deployments but becomes relevant for large-scale environments that maintain IP address reservations for disaster recovery or maintenance purposes.

Service Gateway: Zero-Cost Traffic to Oracle Cloud Services

The OCI Service Gateway provides private connectivity from a VCN to Oracle Cloud services — primarily OCI Object Storage, Oracle Container Registry, and Oracle Cloud Agent — without routing traffic over the public internet or incurring internet gateway charges. For Oracle Database deployments that use OCI Object Storage for RMAN backups, the Service Gateway ensures backup traffic does not consume the free internet egress allowance and is not exposed to internet routing.

Service Gateway traffic carries no additional charges beyond the object storage operations themselves. This is meaningful for large Oracle Database environments with frequent backup operations: a 20 TB Oracle Database with daily full backups and hourly incremental backups moving through a Service Gateway incurs zero networking charges, while the same traffic over a NAT Gateway or Internet Gateway would consume the monthly free egress allowance and potentially generate egress overage charges.

Configure Service Gateways for all Oracle Database deployments using OCI Object Storage. This is a zero-cost networking optimization that eliminates unnecessary egress charges and keeps backup traffic on Oracle's internal network fabric — improving both cost and security posture simultaneously.

OCI Network Firewall: Premium Security at a Cost

OCI Network Firewall provides next-generation firewall capabilities — deep packet inspection, intrusion detection and prevention, URL filtering, and application visibility — as a managed OCI service. For enterprises with regulatory requirements that mandate next-generation firewall controls for Oracle Database traffic (particularly healthcare, financial services, and government deployments), OCI Network Firewall provides a native alternative to deploying third-party firewall appliances on OCI compute instances.

OCI Network Firewall is priced at $3.75/hour per firewall instance, plus $0.001/GB of traffic processed. A continuously running Network Firewall costs approximately $2,700/month before traffic charges. For Oracle Database environments with strict PCI DSS, HIPAA, or FedRAMP compliance requirements, this cost is often justified. For general Oracle workloads without specific regulatory mandates, OCI Security Lists and Network Security Groups provide adequate L3/L4 filtering at no additional cost, and the $2,700/month Network Firewall premium is difficult to justify.

The compliance advisory note here: enterprises deploying Oracle databases subject to regulatory frameworks often find that their compliance teams require next-generation firewall controls without fully understanding the cost implications. Review your actual compliance requirements carefully before provisioning OCI Network Firewall — many frameworks that reference "firewall controls" can be satisfied with OCI's native security group capabilities without requiring next-generation features.

OCI Networking Cost Optimization Strategies

Networking costs in OCI are often overlooked in initial deployments and corrected reactively after the first billing cycle. These strategies address the most common networking cost issues we encounter in our Oracle Cloud Advisory engagements.

• Use Service Gateways for all OCI Object Storage traffic. This is the simplest zero-cost networking optimization available and eliminates the risk of Object Storage backup traffic consuming the free egress allowance.
• Model FastConnect vs VPN for each connectivity use case. Not all connectivity needs dedicated circuits. Administrative access, non-production environment connectivity, and low-volume backup traffic are valid VPN use cases at $36/month, not FastConnect at $750–$1,500/month.
• Monitor inter-region data transfer volumes. Cross-region Oracle GoldenGate replication and active-active Data Guard generate inter-region transfer charges that accumulate quickly. Set budget alerts and review replication compression settings to reduce transfer volumes.
• Right-size load balancer shapes. Review utilization metrics on flexible Load Balancers and resize to the minimum shape that handles peak load with appropriate headroom. Oversized shapes waste hourly spend on unused bandwidth capacity.
• Consolidate VPN tunnels. Multiple VPN tunnels to the same on-premise location can often be consolidated, reducing the per-tunnel hourly charge without compromising redundancy through BGP multi-path configuration.
• Use private DNS resolution for service-to-service communication. Avoid routing inter-service API traffic through NAT gateways or load balancers when direct private IP communication within the VCN is possible. Every unnecessary hop adds both latency and potential cost.
• Include networking in Universal Credits commitment modelling. Networking charges count against your Universal Credits balance and receive the same discount as compute and storage. Model networking consumption as part of your commitment sizing to avoid either under-committing (paying PAYG for networking overage) or over-committing (paying for unused credits).