VIRTUAL PRIVATE CLOUD (VPC) BASICS

VPC Sizing and Structure - PART1 (11:48)

Alt text VPC Considerations

Alt text Global Architecture

Alt text IP Ranges to Avoid

Alt text VPC - More Considerations

Alt text VPC Sizing

Alt text VPC Structure

VPC Sizing and Structure - PART2 (11:16)

Alt text VPC Design - End State

Custom VPCs - PART1 - THEORY (10:10)

Alt text VPC Design - Basic

Alt text Custom VPC: Overview

Alt text Custom VPC: IP address

Alt text Custom VPC: DNS in the VPC

[DEMO] Custom VPCs - PART2 - DEMO (5:40)

VPC Subnets (10:42)

Alt text VPC Subnets

how many subnets an az can have?

An AZ can have many subnets.

how many azs a subnet can have?

A subnet can only be in an AZ.

Alt text Subnet IP Addressing

Alt text VPC Subnets - Auto Assign IP & DHCP

[DEMO] Implement multi-tier VPC subnets (15:24)

No.Subnet NameSubnet AddressCIDRAZIPv6Host Address RangeBroadcast Address
1sb-reserved-A10.16.0.010.16.0.0/20AZ-A0010.16.0.1 - 10.16.15.25410.16.15.255
2sb-db-A10.16.16.010.16.16.0/20AZ-A0110.16.16.1 - 10.16.31.25410.16.31.255
3sb-app-A10.16.32.010.16.32.0/20AZ-A0210.16.32.1 - 10.16.47.25410.16.47.255
4sb-web-A10.16.48.010.16.48.0/20AZ-A0310.16.48.1 - 10.16.63.25410.16.63.255
5sb-reserved-B10.16.64.010.16.64.0/20AZ-B0410.16.64.1 - 10.16.79.25410.16.79.255
6sb-db-B10.16.80.010.16.80.0/20AZ-B0510.16.80.1 - 10.16.95.25410.16.95.255
7sb-app-B10.16.96.010.16.96.0/20AZ-B0610.16.96.1 - 10.16.111.25410.16.111.255
8sb-web-B10.16.112.010.16.112.0/20AZ-B0710.16.112.1 - 10.16.127.25410.16.127.255
9sb-reserved-C10.16.128.010.16.128.0/20AZ-C0810.16.128.1 - 10.16.143.25410.16.143.255
10sb-db-C10.16.144.010.16.144.0/20AZ-C0910.16.144.1 - 10.16.159.25410.16.159.255
11sb-app-C10.16.160.010.16.160.0/20AZ-C0A10.16.160.1 - 10.16.175.25410.16.175.255
12sb-web-C10.16.176.010.16.176.0/20AZ-C0B10.16.176.1 - 10.16.191.25410.16.191.255
1310.16.192.010.16.192.0/2010.16.192.1 - 10.16.207.25410.16.207.255
1410.16.208.010.16.208.0/2010.16.208.1 - 10.16.223.25410.16.223.255
1510.16.224.010.16.224.0/2010.16.224.1 - 10.16.239.25410.16.239.255
1610.16.240.010.16.240.0/2010.16.240.1 - 10.16.255.25410.16.255.255

VPC Routing, Internet Gateway & Bastion Hosts (17:35)

Alt text VPC Router

Alt text Route Tables

how many subnets a route table can be associated with?

A Route Table can be associated with many subnets.

how many route tables a subnet can be associated with?

A subnet can be attached with only ONE Route Table.

Alt text Internat Gateway (IGW)

Alt text Using an IGW

Alt text IPv4 Addresses with an IGW - Outbound Traffic

Alt text IPv4 Addresses with an IGW - Inbound Traffic

Alt text Bastion Host / Jumpbox

[DEMO] Configuring A4l public subnets and Jumpbox - PART1 (13:45)

[DEMO] Configuring A4l public subnets and Jumpbox - PART2 (11:45)

Stateful vs Stateless Firewalls (14:04)

Alt text TCP

Alt text Every “Connection” has 2 parts: REQUEST & RESPONSE

Alt text Directionality (Inbound or Outbound) depends on perspective (Client/Server)

Alt text With Stateless Firewall, a connection needs 2 rules (1 IN, 1 OUT) to go through

with stateless firewall, ephemeral port is not the well known port (e.g. 443, 80)

Alt text Stateful firewall is intelligent enough to identify the REQUEST and RESPONSE components of a connection as being related

Alt text

Network Access Control Lists (NACLs) (12:38)

Alt text NACLs filter traffic across the subnet’s boundary

what is nacl?

A set of rules grouped into:

  • INBOUND rules 👉 match traffic ENTERING the subnet
  • OUTBOUND rules 👉 match traffic LEAVING the subnet

what does nacl do?

NACLs filter traffic across the subnet’s boundary.

how are nacl's rules processed?

NACL’s rules are process in order:

  • Lowest rule number first. 🤏1️⃣
  • Once a match occurs, processing STOPS. 🛑
  • If nothing else matched, * is process 👈 implicit DENY ❌

Alt text NACLs are stateless firewall

Alt text Rule-pairs (app port & ephemeral port) are needed on each NACL for each communication type which occurs:

  • 🔄️ within a VPC
  • ➡️ to a VPC
  • ⬅️ from a VPC

Alt text Default NACL - The NACL created with a VPC

what does default nacl do?

Default NACL does NOTHING. It has an ALLOW ALL rule.

Alt text Custom NACL DENIED ALL traffic after created

Alt text NACL - Summary

which aws resources can be use with nacls?

NACLS can only be used with subnets.

how many subnets a nacl can be associated with?

A NACL can be associated with MANY subnets.

how many nacls a subnet can have?

A subnet can only have ONE (1) NACL.

Security Groups (SG) (11:48)

Alt text Security Group (SG) is STATEFUL firewall

which type of rules a sg can have?

SG can only have ALLOW rule.

👉 SG can’t block specific bad actors 😈

can sg deny a traffic?

No. SG can’t deny traffic. It can’t block bad actors.

Because SG only support ALLOW rules.

which kind of sources does sg rules support?

SG rules supports:

  • CIDR blocks
  • Many AWS logical resources:
    • Other SGs
    • Itself 🤯
    • Prefix Lists 📃

to which, the sgs are attached to?

SGs are attached to ENI, not the instances.

Alt text SG is applied to all traffic entering or leaving the ENI

Alt text An SG reference applies to anything which has the SG attached

Alt text With SG reference, any new instances uses a SG has that SG reference ALLOW rule

Alt text With SG Self reference, the instances can scale easily

Network Address Translation (NAT) & NAT Gateway - PART1 (13:43)

Alt text

aws internet gateway (aws igw) is a nat (static nat)

what can nat can be used for?

  • IP masquerading 👺: hiding CIDR blocks behind one IP.
  • Gives Private CIDR block outgoing internet access.

Alt text NAT Architecture - Example

Alt text Routing a package from an instance in a private subnet …

Alt text … through the NAT Gateway (in a public subnet) …

Alt text … through the Internet Gateway, then to the Public Internet.

Alt text NAT Gateways run from a public subnet, uses Elastic IPs

what level of resilient nat gateway is?

NAT Gateway is an AZ resilient service.

how to have the region resilience for nat gateways?

NATGW in each AZ, and Route Tables in each AZ targets that NATGW.

Network Address Translation (NAT) & NAT Gateway - PART2 (11:08)

Alt text VPC Design - NATGW Full Resilience

Alt text NAT Instance vs NAT Gateway

what is nat instance?

Alt text NAT Gateway and IPv6

which kind of ip version can nat gateway work with?

NAT Gateway only works with IPv4, it doesn’t work with IPv6.

All IPv6 addresses in AWS are publicly routable. The IGW works with IPv6 directly without the NAT Gateway.

[DEMO] Implementing private internet access using NAT Gateways (19:25)

VPC Basics Section Quiz