Cloud networking

Why it matters

Every VM, database and container you create lands inside a virtual network. If you do not understand that network, you will either expose things that should be private or spend an afternoon wondering why your server cannot reach the internet. The Networking Fundamentals course taught IP addresses, subnets and routing; the cloud reuses all of it, with new names.

The core idea: a VPC

A VPCVirtual Private Cloud: your own private network inside a region with an address range in CIDR notation; Azure calls it a VNet. (Virtual Private Cloud; Azure calls it a VNet, Google Cloud also says VPC) is your own private network inside a region. You give it an address range in CIDR notation, such as 10.0.0.0/16 (65,536 addresses). Inside it you create subnets, each tied to one availability zone on AWS, such as 10.0.1.0/24 (256 addresses, of which AWS reserves 5).

What makes a subnet public or private is not a checkbox; it is the route tableA list of routes for a subnet; a route to an internet gateway is what makes a subnet public.:

• A public subnet has a route 0.0.0.0/0 -> internet gateway. Resources in it with a public IP can be reached from, and reach, the internet.
• A private subnet has no route to the internet gatewayThe VPC component that connects public subnets to the internet.. Its resources can only talk inside the VPC, unless you add a NAT gatewayA component that lets resources in private subnets make outbound connections while staying unreachable from outside., which lets them make outbound connections (for updates) while staying unreachable from outside.

Worked example: a two-tier VPC

A web app with a database, resilient across two zones:

VPC 10.0.0.0/16 (region eu-west-1)

  Zone a                              Zone b
  +--------------------------+       +--------------------------+
  | Public  10.0.1.0/24      |       | Public  10.0.2.0/24      |
  |   load balancer node     |       |   load balancer node     |
  |   NAT gateway            |       |                          |
  +--------------------------+       +--------------------------+
  | Private 10.0.11.0/24     |       | Private 10.0.12.0/24     |
  |   app server             |       |   app server             |
  |   database primary       |       |   database standby       |
  +--------------------------+       +--------------------------+

Public route table:  10.0.0.0/16 -> local ; 0.0.0.0/0 -> internet gateway
Private route table: 10.0.0.0/16 -> local ; 0.0.0.0/0 -> NAT gateway

Only the load balancer is internet-facing. App servers and the database have private addresses only. Leaving gaps in the numbering (.1, .2 for public, .11, .12 for private) makes the plan easy to read and to extend.

Firewalls: security groups and network ACLs

• A security groupA stateful firewall attached to a resource that lists allowed inbound traffic; replies are allowed automatically. is a stateful firewall attached to a resource. You list allowed inbound traffic; replies are allowed automatically. Security groups can reference each other, which is the cleanest way to build tiers:

sg-lb   inbound: 443 from 0.0.0.0/0
sg-app  inbound: 8080 from sg-lb
sg-db   inbound: 5432 from sg-app

The database accepts connections only from app servers, wherever their IPs happen to be.

• A network ACL is a stateless filter on a whole subnet, with numbered allow and deny rules for both directions. Most teams leave ACLs at the default and do the real work in security groups.

Reaching private servers

Do not give private servers public IPs just to log in. Options, from simplest to most traditional: a provider session tool such as AWS Systems Manager Session Manager (no open SSH port at all), a VPN into the VPC, or a small hardened bastion hostA small, hardened server in a public subnet used as a controlled SSH entry point to private servers. in a public subnet that allows SSH only from your IP.

Cost notes

VPCs, subnets, route tables and security groups are free. NAT gateways, load balancers and public IPv4 addresses are billed per hour whether or not traffic flows, and NAT gateways also charge per GB processed. For learning, sketch them rather than create them, and delete any you do create on the same day.

Common mistakes

• Overlapping CIDR ranges between VPCs (or with the office network) that later need to be connected.
• Putting databases in public subnets.
• Security groups with 0.0.0.0/0 on database or SSH ports.
• Subnets in only one zone, which undoes all your availability planning.
• Leaving a NAT gateway running after a tutorial.

Quick recap

• A VPC is a private network in a region; subnets live in one zone each.
• Public vs private is decided by the route table: internet gateway route or not.
• Security groups (stateful, per resource) do most filtering; reference groups to build tiers.

Try it

In the Do tab you design and draw a VPC for a real app, on paper or in a free diagramming tool, without creating any billable resources.