AWS Networking Basics For Programmers | Hands On

Summary

Travis Media host Travis explains foundational AWS networking concepts through a hands-on build. The example network contains a VPC, a public subnet, a private subnet, EC2 instances, route tables, an internet gateway, and a NAT gateway.

The central lesson is that naming a subnet “public” or “private” does not determine its access. Connectivity depends on routing, gateways, IP configuration, and firewall rules.

Main Concepts

• VPC (Virtual Private Cloud): An isolated network boundary for AWS resources.
• CIDR ranges: Define the IP address space for a VPC or subnet. The example uses 10.0.0.0/16 for the VPC, with 10.0.0.0/24 and 10.0.1.0/24 for its subnets.
  • The host’s mnemonic is that /24 fixes the first three octets and /16 fixes the first two. More generally, CIDR prefixes specify a number of fixed bits, so this octet-based shortcut applies most directly to prefixes in multiples of eight.
  • AWS reserves five IP addresses in each subnet, so the number of usable addresses is lower than the total in the CIDR range.
• Subnets: Smaller IP ranges within a VPC where resources are placed. A VPC alone is not enough to launch an EC2 instance; the instance must be placed in a subnet.
• Availability Zones: Deploying subnets across multiple Availability Zones can improve availability if one zone has an outage. The demonstration uses one public and one private subnet to keep the setup simple.
• Route tables: Control where subnet traffic goes. The VPC’s main route table initially has a local route for traffic within the VPC. Custom route tables can be associated with specific subnets and given different routes.
• Internet gateway (IGW): Connects a VPC to the internet. Attaching an IGW is not sufficient by itself: a subnet needs a route to it, and an instance generally needs a public IP to be reachable from the internet.
• NAT gateway: Lets instances in a private subnet initiate connections to outside services, such as downloading updates, without allowing outside systems to initiate connections directly to those instances.
• Security groups and network ACLs (NACLs):
  • A security group is a stateful virtual firewall associated with an instance. Return traffic for an allowed connection is automatically permitted.
  • A NACL is a stateless virtual firewall associated with a subnet. Inbound and outbound traffic rules must be configured separately.
  • NACLs are often left at their default settings, but can be used for subnet-level controls such as blocking an IP address.

Hands-on Workflow

1. Create a VPC

   • In the AWS VPC console, create a VPC manually rather than using the automated “VPC and more” option.
   • Assign it the CIDR range 10.0.0.0/16.

2. Create public and private subnets

   • Create both subnets inside the new VPC.
   • Use 10.0.0.0/24 for the public subnet and 10.0.1.0/24 for the private subnet.
   • Choose an Availability Zone for each. For a more resilient design, the host notes that deployments commonly use multiple subnets across different zones.

3. Launch an EC2 instance in the public subnet

   • Select the new VPC and public subnet, enable public IP assignment, and create a security group with an inbound SSH rule.
   • The initial connection attempt fails because the VPC has no internet path yet.

4. Connect the VPC to the internet

   • Create an internet gateway and attach it to the VPC.
   • Create separate public and private route tables, then associate each with its corresponding subnet.
   • Add a 0.0.0.0/0 route from the public route table to the internet gateway.
   • With the route, public IP, and security group rule in place, the public EC2 instance can be reached and can access the internet.

5. Launch an EC2 instance in the private subnet

   • Place a second instance in the private subnet and do not assign it a public IP.
   • The host demonstrates reaching it by first connecting to the public instance and then SSHing from there into the private instance. This provides a way to administer it without exposing it directly to the public internet.

6. Give the private instance outbound internet access

   • The private instance initially cannot download package updates.
   • Create a public NAT gateway in the public subnet and allocate an Elastic IP to it.
   • Add a 0.0.0.0/0 route from the private route table to the NAT gateway.
   • The private instance can then initiate outbound connections while remaining inaccessible through a direct inbound internet connection.

7. Understand the two firewall layers

   • Use NACLs for subnet-level, stateless traffic rules.
   • Use security groups for instance-level, stateful traffic rules.
   • The demonstration opens SSH to anywhere for convenience; in real deployments, access should generally be restricted to trusted sources.

Speakers and Sources

• Travis, host of Travis Media — the only speaker.
• AWS Management Console — used for the hands-on configuration.
• IP subnet calculator — referenced to illustrate CIDR address ranges.