---
schema_version: "1"
id: 639ce0d1fe4763434505333277463a6b670e6a537fcc944a5d1d0256c4da33d2
title: VPC Network Architecture
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub/vpc-architecture-concept.md
canonical_url: https://docs.mulesoft.com/cloudhub/vpc-architecture-concept
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 5e998f0f7c17ca6d70c30bc10188ce6ae3d88472f3440d8f2ce4c53ab940fd65
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub
---

# VPC Network Architecture

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

An Anypoint VPC is a logically private and isolated network hosted inside CloudHub. You can connect
your private intranet to your Anypoint VPC as if they were all part of a single, private network.

The Anypoint VPC configuration exposes the DNS record `mule-worker-internal-<app-name>.cloudhub.io`.
This is a DNS A record, which includes the IP addresses of all your workers. This DNS record cannot
be accessed from outside your Anypoint VPC.

Each Anypoint VPC allows you to configure firewall rules to check inbound connections directly to
your workers.

Four firewall rules are created by default—​two rules that allow your private address space to
connect through ports 8091 and 8092, and two rules that allow external requests proxied by
CloudHub’s shared load balancer through ports 8081 and 8082.

All traffic that is not allowed in a firewall rule is blocked by default.

![Default Anypoint VPC architecture](/mulesoft/current/en-us/cloudhub/_images/vpc-default-arch.png)

Figure 1. The graphic shows the default Anypoint VPC architecture.

You can configure a dedicated load balancer inside your VPC, which allows you to provide custom
certificates and optionally enforce two-way SSL client authentication. If you configure proxy rules
that map your applications to custom domains, you can, for example, host everything under a single
vanity domain.

![Anypoint VPC architecture with a dedicated load balancer](/mulesoft/current/en-us/cloudhub/_images/vpc-dlb-arch.png)

Figure 2. The graphic shows the Anypoint VPC architecture with a dedicated load balancer.

A CloudHub dedicated load balancer is assigned to a particular Anypoint VPC. The dedicated load
balancer then routes traffic to that particular Anypoint VPC within the particular service region of
the VPC.

Each dedicated load balancer has a DNS A record `_lb-name_.lb.anypointdns.net` or
`_lb-name_.lb-prod-eu-rt.anypointdns.net` (for EU control plane) that resolves to two public IP
addresses of its two instances.  
Through your DNS provider, you can add a `CNAME` record pointing to the dedicated `A` record and use
your own domain names to access it. This DNS A record can also be reached from outside the VPC.  
Additionally, a CloudHub dedicated load balancer has an internal domain name to be used by
applications and clients within the Anypoint VPC. The structure is
`internal-_lb-name_.lb.anypointdns.net`.

## See Also

- [Resolve Private Domains in Your Internal Network](https://docs.mulesoft.com/cloudhub/resolve-private-domains-vpc-task)