OCI Network Subnets Should Be Private

Using Console

To make OCI network subnets private (per CIS-style “subnets should be private”) using the OCI Console, you need to:

Identify subnets that are effectively public
1. Sign in to the OCI Console.
2. In the left menu, go to Networking > Virtual Cloud Networks.
3. Select the Compartment you want.
4. Click your VCN.
5. Go to the Subnets tab.
6. For each subnet, note:
  - Route table (does it have a route to an Internet Gateway?)
  - Public IP assignment (auto-assign allowed?)
A subnet is effectively public if:
- Its route table has a route to an Internet Gateway (IGW), and/or
- It allows public IPs on resources and those resources have them.
Make the subnet stop assigning public IPs by default
For each public subnet you want to make private:
1. In the Subnets tab, click the subnet name.
2. Click Edit.
3. Under Subnet Access / IPv4 Public IP Address Assignment:
  - Set “Allow public IPs” to No (or uncheck “Assign a public IPv4 address” if present).
4. Click Save changes.
This prevents new VNICs in this subnet from getting public IPs.
Remove internet access from the subnet’s route table
1. From the subnet details page, note the Route Table name and click it, or
  go via VCN > Route Tables and open the relevant table.
2. Check for any route rule like:
  - Target Type: Internet Gateway
  - Destination: 0.0.0.0/0 or any public CIDR
3. For each such rule:
  - Click the Actions (⋯) menu > Delete.
  - Confirm deletion.
If workloads in that subnet still need outbound Internet, instead:
- Create / use a NAT Gateway, then
- Add a route with:
  - Target Type: NAT Gateway
  - Destination CIDR Block: 0.0.0.0/0
Remove existing public IPs from resources in that subnet
For each compute instance in that subnet:
1. Go to Compute > Instances.
2. Filter by Subnet or check the Primary VNIC details.
3. Click the instance, then in the Resources section click Attached VNICs.
4. Click the primary VNIC.
5. Under Public IP, if a public IP is assigned:
  - Click Edit, then Unassign or None (you may need to first create a reserved public IP if you must keep it and then move to a bastion later).
  - Save changes.
Do this for any load balancers, NLBs, or other services with public IPs in that subnet (change to private IP only or move to a different subnet).
(If needed) Move resources into a new dedicated private subnet
If you cannot change an existing subnet as desired (for example, it is heavily used for public-facing workloads), create a new private subnet and move internal workloads there:
1. In the VCN, go to Subnets > Create Subnet.
2. Choose:
  - Private subnet (no IGW route, no default public IPs).
  - Attach it to a route table with NAT Gateway only (if outbound Internet is needed) or no external route at all.
3. Create new instances or re-create services in this private subnet.
Verify the subnet is now private
For the subnet you remediated:
- Route Table: No routes to an Internet Gateway.
- Subnet settings: Public IP auto-assignment disabled.
- Resources: No public IPs on VNICs in that subnet.

Once these conditions are met, OCI networking monitoring / security tooling will evaluate that subnet as private.

Using CLI

In OCI, a “private” subnet is one where prohibitPublicIpOnVnic = true.
You can remediate this via OCI CLI by updating each public subnet so it no longer allows public IPs.Below are step‑by‑step CLI instructions.

0. Prerequisites

OCI CLI installed and configured (oci setup config)
Your user has permissions to manage subnets and route tables in the target compartment/VCN.

1. Identify public subnets

List subnets in a compartment and filter those that allow public IPs on VNICs:

COMPARTMENT_OCID="<your_compartment_ocid>"

oci network subnet list \
  --compartment-id "$COMPARTMENT_OCID" \
  --all \
  --output json \
| jq -r '.data[] | select(.["prohibit-public-ip-on-vnic"] == false) | "\(.id) \(.display-name)"'

Result: list of subnet OCIDs and names that are effectively “public”.

2. (Optional) Confirm subnet details

For a specific subnet:

SUBNET_OCID="<subnet_ocid>"

oci network subnet get --subnet-id "$SUBNET_OCID" --output json

Check:

"prohibit-public-ip-on-vnic": false → public
Associated route table may have default route (0.0.0.0/0) to an Internet Gateway.

3. Make the subnet private (disallow public IPs)

Update the subnet:

SUBNET_OCID="<subnet_ocid>"

oci network subnet update \
  --subnet-id "$SUBNET_OCID" \
  --prohibit-public-ip-on-vnic true \
  --force

This prevents new VNICs in the subnet from getting public IPs.
Existing VNICs with public IPs keep them; see next step.

4. Remove existing public IPs from VNICs (if required)

List VNICs in the subnet:

VCN_OCID="<vcn_ocid>"

oci network vnic list \
  --compartment-id "$COMPARTMENT_OCID" \
  --vcn-id "$VCN_OCID" \
  --all \
  --output json \
| jq -r '.data[] | select(.subnet-id == "'$SUBNET_OCID'") | "\(.id) \(.public-ip)"'

For each VNIC that still has a public IP, find and delete the public IP resource (reserved or ephemeral):

List public IPs:

oci network public-ip list \
  --compartment-id "$COMPARTMENT_OCID" \
  --scope REGION \
  --all \
  --output json

Once you identify the public IP OCID:

PUBLIC_IP_OCID="<public_ip_ocid>"

oci network public-ip delete \
  --public-ip-id "$PUBLIC_IP_OCID" \
  --force

5. (Recommended) Remove Internet access from route table

A subnet is only fully private if it also does not route to an Internet Gateway.

Get the subnet’s route table:

SUBNET_JSON=$(oci network subnet get --subnet-id "$SUBNET_OCID" --output json)
ROUTE_TABLE_OCID=$(echo "$SUBNET_JSON" | jq -r '.data["route-table-id"]')

Inspect the route rules:

oci network route-table get \
  --rt-id "$ROUTE_TABLE_OCID" \
  --output json \
| jq '.data."route-rules"'

Remove any rule with destination 0.0.0.0/0 that points to an Internet Gateway:

Build a new route-rules JSON without those entries, e.g.:

oci network route-table get \
  --rt-id "$ROUTE_TABLE_OCID" \
  --output json \
| jq '.data."route-rules" 
      | map(select(.destination != "0.0.0.0/0"))' \
> new-route-rules.json

Update the route table:

oci network route-table update \
  --rt-id "$ROUTE_TABLE_OCID" \
  --route-rules file://new-route-rules.json \
  --force

6. Apply to all public subnets (script example)

COMPARTMENT_OCID="<your_compartment_ocid>"

oci network subnet list \
  --compartment-id "$COMPARTMENT_OCID" \
  --all \
  --output json \
| jq -r '.data[] | select(.["prohibit-public-ip-on-vnic"] == false) | .id' \
| while read SUBNET_OCID; do
  echo "Making subnet private: $SUBNET_OCID"
  oci network subnet update \
    --subnet-id "$SUBNET_OCID" \
    --prohibit-public-ip-on-vnic true \
    --force
done

If you share your compartment/VCN IDs, I can tailor the exact CLI commands for your environment.

Using Python

To make OCI subnets private using Python, you need to:

Ensure VNICs in the subnet cannot get public IPs
Ensure the subnet’s route table does not route to an Internet Gateway

Below is a minimal step‑by‑step remediation approach using the OCI Python SDK.

1. Prerequisites

Install and configure the OCI Python SDK:

pip install oci
oci setup config

This creates ~/.oci/config with a profile (e.g., DEFAULT).

2. Logic to Make a Subnet “Private”

A subnet is “private” if:

prohibit_public_ip_on_vnic = True
Its route table has no route rules where:
- network_entity_id is an Internet Gateway OCID

We’ll:

List target subnets (by compartment or VCN).
For each subnet:
- Enable prohibit_public_ip_on_vnic.
- Clean its route table of Internet Gateway routes.

3. Python Script Example

import oci

# -----------------------
# CONFIG
# -----------------------
PROFILE = "DEFAULT"
COMPARTMENT_ID = "<your_compartment_ocid>"  # e.g., ocid1.compartment.oc1..xxxx
# Optionally filter by VCN:
VCN_ID_FILTER = None  # or "ocid1.vcn.oc1..xxxx"

# -----------------------
# CLIENTS
# -----------------------
config = oci.config.from_file("~/.oci/config", PROFILE)
network_client = oci.core.VirtualNetworkClient(config)

# -----------------------
# HELPERS
# -----------------------
def is_internet_gateway(network_entity_id: str) -> bool:
    """Heuristic: IG OCIDs contain ':internetgateway:'."""
    return network_entity_id and ":internetgateway:" in network_entity_id

def make_subnet_private(subnet, network_client):
    updated = False

    # 1) Ensure subnet prohibits public IPs
    if not subnet.prohibit_public_ip_on_vnic:
        update_details = oci.core.models.UpdateSubnetDetails(
            prohibit_public_ip_on_vnic=True
        )
        network_client.update_subnet(subnet.id, update_details)
        print(f"Set prohibit_public_ip_on_vnic=True on subnet {subnet.display_name} ({subnet.id})")
        updated = True

    # 2) Clean route table from Internet Gateway routes
    if subnet.route_table_id:
        rt = network_client.get_route_table(subnet.route_table_id).data
        new_route_rules = [
            r for r in rt.route_rules
            if not is_internet_gateway(r.network_entity_id)
        ]

        if len(new_route_rules) != len(rt.route_rules):
            update_rt_details = oci.core.models.UpdateRouteTableDetails(
                route_rules=new_route_rules
            )
            network_client.update_route_table(rt.id, update_rt_details)
            print(f"Removed Internet Gateway routes from route table {rt.display_name} ({rt.id}) "
                  f"for subnet {subnet.display_name} ({subnet.id})")
            updated = True

    if not updated:
        print(f"Subnet {subnet.display_name} ({subnet.id}) is already private.")

# -----------------------
# MAIN
# -----------------------
def main():
    # List subnets in compartment (optionally filtered by VCN)
    list_kwargs = {}
    if VCN_ID_FILTER:
        list_kwargs["vcn_id"] = VCN_ID_FILTER

    subnets = oci.pagination.list_call_get_all_results(
        network_client.list_subnets,
        compartment_id=COMPARTMENT_ID,
        **list_kwargs
    ).data

    for subnet in subnets:
        print(f"Evaluating subnet {subnet.display_name} ({subnet.id})")
        make_subnet_private(subnet, network_client)

if __name__ == "__main__":
    main()

4. How to Use This for “Networking Monitoring”

Run this script on a schedule (e.g., via cron, OCI Functions, or OCI DevOps) as a remediation job.
Optionally modify it to:
- Only log non‑compliant subnets instead of updating them.
- Push findings to your monitoring/alerting system (e.g., emit metrics, write to Object Storage, send to OCI Logging or an external SIEM).

If you tell me how you currently trigger monitoring (OCI Events, Functions, external CI/CD, etc.), I can adjust this into a fully automated remediation workflow.

Using Terraform

resource "oci_core_subnet" "PRIVATE_SUBNET" {
  # Replace with your compartment, VCN, and CIDR details
  compartment_id  = var.COMPARTMENT_OCID        # e.g., "ocid1.compartment.oc1..xxxx"
  vcn_id          = oci_core_vcn.MY_VCN.id
  cidr_block      = "10.0.1.0/24"
  display_name    = "private-subnet"
  dns_label       = "privsubnet"

  # This setting makes the subnet private by preventing public IP assignment
  prohibit_public_ip_on_vnic = true

  # Optional: other typical subnet settings
  route_table_id      = oci_core_route_table.MY_RT.id
  security_list_ids   = [oci_core_security_list.MY_SL.id]
  dhcp_options_id     = oci_core_dhcp_options.MY_DHCP.id
}

This change does not force replacement of an existing subnet; OCI allows updating prohibit_public_ip_on_vnic in place.After updating, terraform plan should show an in-place ~ update in-place on the oci_core_subnet resource with prohibit_public_ip_on_vnic changing from false (or null) to true.

OCI Misconfigurations

OCI Network Subnets Should Be Private

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

0. Prerequisites

1. Identify public subnets

2. (Optional) Confirm subnet details

3. Make the subnet private (disallow public IPs)

4. Remove existing public IPs from VNICs (if required)

5. (Recommended) Remove Internet access from route table

6. Apply to all public subnets (script example)

1. Prerequisites

2. Logic to Make a Subnet “Private”

3. Python Script Example

4. How to Use This for “Networking Monitoring”

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​0. Prerequisites

​1. Identify public subnets

​2. (Optional) Confirm subnet details

​3. Make the subnet private (disallow public IPs)

​4. Remove existing public IPs from VNICs (if required)

​5. (Recommended) Remove Internet access from route table

​6. Apply to all public subnets (script example)

​1. Prerequisites

​2. Logic to Make a Subnet “Private”

​3. Python Script Example

​4. How to Use This for “Networking Monitoring”

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

0. Prerequisites

1. Identify public subnets

2. (Optional) Confirm subnet details

3. Make the subnet private (disallow public IPs)

4. Remove existing public IPs from VNICs (if required)

5. (Recommended) Remove Internet access from route table

6. Apply to all public subnets (script example)

1. Prerequisites

2. Logic to Make a Subnet “Private”

3. Python Script Example

4. How to Use This for “Networking Monitoring”