Your own private network.
Inside Pakistan's cloud.
QCloud Virtual Private Cloud (VPC) gives you a logically isolated section of the cloud with full control over IP ranges, subnets, route tables, gateways, and security policies — hosted entirely inside KHI-1 and ISB-1, billed in PKR, and ready in under 5 minutes.
Trusted across Pakistan's enterprise networks
Three patterns we see in every Pakistani VPC.
Compliance-grade isolation. Cross-region replication. Zero offshore exposure.
Core banking in an air-gapped subnet
Payment processing, KYC, and core ledger workloads sit behind private subnets with explicit-allow NACLs. State Bank residency rules met by design.
BSS islands with peering across KHI ↔ ISB
Billing, OSS, and IVR workloads in dedicated VPCs, peered across regions over QCloud's private fabric — no public internet hop.
PECA-aligned sovereign network islands
Federal and provincial workloads inside fully air-gapped VPCs with zero internet gateway, accessed only via Direct Connect from government data centers.
One service. Every layer of your network — yours to design.
QCloud VPC is a logically isolated, software-defined network you control end-to-end. Bring your own IP ranges, carve subnets, attach gateways, apply firewalls, and connect to your on-prem data center over secure tunnels — all from a single console, all inside Pakistan.
Four promises behind every QCloud VPC.
What you get by default — no checkbox, no extra cost, no asterisk.
Granular Isolation
Every VPC is a software-defined slice of the cloud — invisible to other tenants, defended by VLAN, VXLAN, and access controls applied at every hop.
Hybrid by Default
Extend your on-prem data center into QCloud with IPsec VPN or Direct Connect. Bring your routes, your DNS, your security policies — they all carry over.
Defense in Depth
Stateless NACLs at the subnet level, stateful Security Groups at the instance level, optional WAF at the edge — three independent layers, all auditable.
Sovereign Networking
Every packet, every route, every replication hop stays inside PTCL's Tier-3 / Rated-3 data centers in Pakistan. PECA-aligned. SBP-aligned. No offshore exposure.
Eleven primitives. Compose any network topology.
Every VPC is built from the same well-understood building blocks. Click any one to see what it does.
Connect your VPC to anything. Securely.
Four connectivity patterns, one console. Pick the one that fits your topology — switch later if your topology changes.
From CIDR to running workloads — in six clicks.
Watch a VPC come together. Each step takes seconds.
Six topology patterns we deploy every month.
Each one tuned for a specific industry, regulator, and SLA target.
Three rings of defense. All on by default.
Your VPC is hardened from the perimeter to the instance. Every ring is independently configurable, independently auditable.
Network ACL
Stateless firewall at the subnet boundary. Explicit allow/deny on inbound + outbound, evaluated by rule priority. Default-deny on custom NACLs.
Security Group
Stateful firewall at the instance level. Connection tracking, automatic return-traffic allowance, source group references, instance-specific rules.
WAF + DDoS
Optional managed Web Application Firewall and DDoS mitigation in front of public-facing workloads. OWASP Top 10 + bot management + geo-blocking.
The old way needed a network engineer.
QCloud VPC needs a console tab.
- ✕Procure firewall hardware · 4–6 weeks
- ✕Cable, rack, and label every switch port
- ✕Maintain network engineer payroll: $$$
- ✕Manual VLAN tagging across 12 switches
- ✕Audit logs scattered across 4 vendors
- ✕Add a subnet? Submit a change ticket. Wait.
- ✓Provision a full VPC in < 5 minutes
- ✓Software-defined: change topology with one click
- ✓Pay only for gateways and IPs, not boxes
- ✓Centralized audit logs · immutable · 7-year retention
- ✓Terraform / API / Console — pick your tool
- ✓Add a subnet? CIDR field. Done.
Most teams retire their on-prem network gear within 6 months.
Pay for what you use. In rupees. No surprises.
VPC itself is free. You only pay for the gateways and IPs you actually provision. Egress inside QCloud is free.
VPC is the network. Everything else plugs in.
Once your VPC is provisioned, every QCloud service launches inside it — by default, with zero extra config.
Every QCloud service launches inside your VPC by default. No bolt-ons. No bridges. No proxies.
Everything you wanted to know before you carve your first subnet.
Design Pakistan's most secure network — on the house.
$100 in QCloud credit · 1-month free trial of VPC, ECS, and EVS · a real network architect on the call from day one · migration support from on-prem or hyperscalers — all included.
No credit card required · Production workloads welcome · PKR billing
Name: vpc-prod-01 Region: KHI-1 ▾ CIDR: 10.0.0.0/16 Subnets: 3 (auto) Gateways: IGW + 1 NAT Estimated: PKR ~32 / hr