# CloudHub VPCs, load balancers and static IPs

*MuleSoft Platform Integration Architect Study Guide · Designing for the runtime plane technology architecture · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-integration-architect/designing-for-the-runtime-plane-technology-architecture/cloudhub-vpcs-load-balancers-and-static-ips*

How to plan and connect a CloudHub 1.0 Anypoint VPC, resolve private domains, route traffic with the shared and dedicated load balancers, restrict access with firewall rules and allowlists, and give applications static IPs.

- Certification: Salesforce MuleSoft Platform Integration Architect
- Exam section: Designing for the runtime plane technology architecture
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-integration-architect

**Official exam objective:**

> Design integration solutions deployed to CloudHub to address specific requirements using CloudHub's network features.

## What the exam expects

- Size and place a CloudHub 1.0 Anypoint VPC so it can connect to private networks and grow.
- Predict whether an application runs inside a VPC, and connect the VPC through a VPN, transit gateway, peering or Direct Connect.
- Configure VPC Internal DNS for private domains and choose between load-balanced and direct worker endpoints.
- Design dedicated load balancer (DLB) mapping rules and predict the path an application receives.
- Combine VPC firewall rules, DLB allowlists and static IPs for inbound and outbound access requirements.

**Anypoint VPC:** a private, isolated network segment that hosts CloudHub workers. **Dedicated load balancer (DLB):** an optional load balancer inside a VPC that routes external HTTP and HTTPS traffic to applications. **Mapping rule:** a DLB rule that turns a request into a target application and path. **Static IP:** a fixed public address allocated to an application ([Virtual Private Cloud](https://docs.mulesoft.com/cloudhub/virtual-private-cloud), [Dedicated Load Balancers](https://docs.mulesoft.com/cloudhub/cloudhub-dedicated-load-balancer)).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| VPC CIDR | /24 smallest, /16 largest; must not overlap peered networks | [Provision a VPC](https://docs.mulesoft.com/cloudhub/vpc-provisioning-concept) |
| Addresses per worker | At least two, plus infrastructure reserves | [Provision a VPC](https://docs.mulesoft.com/cloudhub/vpc-provisioning-concept) |
| Late association | App enters the VPC after a restart | [Provision a VPC](https://docs.mulesoft.com/cloudhub/vpc-provisioning-concept) |
| Transit gateway | Same region as the Anypoint VPC | [Connectivity methods](https://docs.mulesoft.com/cloudhub/vpc-connectivity-methods-concept) |
| Route entries | 95 per VPC across all connections | [Connectivity methods](https://docs.mulesoft.com/cloudhub/vpc-connectivity-methods-concept) |
| Internal DNS | Up to 3 server IPs; domains within 229 characters; up to 60 minutes to propagate | [Private domains](https://docs.mulesoft.com/cloudhub/resolve-private-domains-vpc-task) |
| Internal worker record | VPC-only; bypasses load distribution | [Networking guide](https://docs.mulesoft.com/cloudhub/cloudhub-networking-guide) |
| Output path | Literal only; no patterns | [Mapping rules](https://docs.mulesoft.com/cloudhub/lb-mapping-rules) |
| Firewall scope | Inbound to workers only | [Firewall rules](https://docs.mulesoft.com/cloudhub/vpc-firewall-rules-concept) |
| Static IP quota | Twice the Production vCores by default | [Networking guide](https://docs.mulesoft.com/cloudhub/cloudhub-networking-guide) |
| DLB capacity | Each unit equals two workers; up to four units | [Dedicated Load Balancers](https://docs.mulesoft.com/cloudhub/cloudhub-dedicated-load-balancer) |

## Check yourself

- What are the smallest and largest CIDR blocks an Anypoint VPC can use?
- What rule of thumb does MuleSoft give for sizing an Anypoint VPC subnet?
- Why can a broad mapping rule placed above a more specific one capture the specific requests?
- When static IPs are enabled for applications, how many are available by default?

## Sources

- [Provision a VPC](https://docs.mulesoft.com/cloudhub/vpc-provisioning-concept)
- [CloudHub Networking Guide](https://docs.mulesoft.com/cloudhub/cloudhub-networking-guide)
- [Resolve Private Domains in Your Internal Network](https://docs.mulesoft.com/cloudhub/resolve-private-domains-vpc-task)
- [Dedicated Load Balancer Mapping Rules](https://docs.mulesoft.com/cloudhub/lb-mapping-rules)
- [VPC Firewall Rules](https://docs.mulesoft.com/cloudhub/vpc-firewall-rules-concept)
- [Anypoint VPC Connectivity Methods](https://docs.mulesoft.com/cloudhub/vpc-connectivity-methods-concept)
- [Dedicated Load Balancers](https://docs.mulesoft.com/cloudhub/cloudhub-dedicated-load-balancer)
- [Virtual Private Cloud](https://docs.mulesoft.com/cloudhub/virtual-private-cloud)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 11 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams