Virtual private cloud network
for isolated VM connectivity

Each VM on the network gets a private address, and the VMs communicate with one another over those addresses without touching the public internet. You can reference them by private IP, or run your own internal DNS so services find each other by name as you add and replace machines.

They solve different aspects of the problem. A private network determines which systems can reach one another and whether a VM is exposed to the public internet. Firewall rules control what’s allowed on the connections that do exist, by port and source. Used together you get defence in depth, with isolation first, then filtering 
on top.

You decide per network. A fully isolated network has no internet route, so for those VMs you either give the network outbound access when you need it or route through a VM that does have access. Inbound from the public internet stays closed either way.

No. It runs on the same backbone as the rest of your infrastructure, so private traffic is as quick as any internal link. Isolation is a routing and policy boundary rather than a detour, so there’s no performance penalty for keeping VMs on their own network.

Yes. Attach a VM to a network or detach it at any time, and the network exists independently of the VMs on it. That makes it straightforward to grow a tier, replace a machine or move a VM between networks as your architecture changes.