The image shows an On-Premises or Third Party Cloud, Internet, and an OCI Region.

On-Premises or Third Party Cloud contains:

Management Agent connected to a Management Gateway via https and Application Servers.
Management Agent connected to a Management Gateway via https and Database Servers.
Management Gateway connected to Customer Premises Equipment.

Internet contains Site-to-Site VPN with IP Sec Tunnel 1 and IP Sec Tunnel 2 connecting OCI Region with On-Premises on Third-Party Cloud.

OCI Region contains:

Customer VCN with Route Table, DRG Attachment, and Service Gateway.
Oracle Services Network: Database Management, Operations Insights, SPLAT/Load Balancer, Logging Analytics, Application Performance Monitoring.

You can set up your on-premises network with private access to Oracle services through the VCN's service gateway . A service gateway allows hosts in your on-premises network to use and communicate with any of the supported Oracle services from your private IP addresses. Security lists are set on the on-premises edge nodes to allow traffic only for the OCI service IP range.