I’m relatively new to OCI and I need help configuring the routing for my network firewall.

I have a Hub-Spoke topology and I want all incoming traffic to go through the Network Firewall in the Hub and then to the spokes. This is easy to do if everything is in a single VCN as the docs explain it. But I don’t know how to do it for multiple VCNs since when I tried it, I couldn’t set the IP address of the NFW since it was in a different VCN. Also, I don’t know how OCI handles IP resoultion and to which Internet Gateway would my request go anyways.

There are some published architectures by Oracle that suggest putting the public subnet/resources in the hub, and have THEM communicate with the private resources in the spoke VCNs. But that is not the solution I’m looking for. I need to keep the public resources/subnets in the spoke VCNs.

In summary, my requirements are:

• All incoming traffic to public resources with public IP addresses (e.g., LBs, VMs, etc) should go through the NFW.
• Public resources shouldn’t be restricted to only the Hub VCN. I should be able to have public resources in a spoke VCN.

Any help or guidance would be appreciated. Below is a simplified architecture.

Don’t bother with the IP. It’s Twitter’s