Networking for Cloud Computing – VPC & Subnets
A comprehensive presentation on Networking for Cloud Computing – VPC & Subnets
Introduction to Cloud Networking
Cloud networking provides the necessary connectivity for cloud computing services,
allowing resources like virtual machines, databases, and storage to communicate with
each other and the internet. In AWS, the foundational service for this is the Virtual
Private Cloud (VPC).
The Virtual Private Cloud (VPC)
A VPC is a virtual network dedicated to your AWS account. It is logically isolated from
other virtual networks in the AWS Cloud. It allows you to launch AWS resources into a
virtual network that you define.
Key Characteristics
● Isolation: Your VPC is completely separate from other AWS customers' VPCs.
● Controllability: You have complete control over your virtual networking
environment, including the selection of your own IP address range, the creation
of subnets, and the configuration of route tables and network gateways.
● Regional Scope: A VPC spans all the Availability Zones within the AWS region
it's created in.
IP Addressing in a VPC
When you create a VPC, you must specify an IPv4 Classless Inter-Domain Routing
(CIDR) block for it. This block is a private range of IP addresses (e.g., $[Link]/16$ or
$[Link]/16$).
● CIDR Notation: CIDR notation combines the network address with a suffix that
indicates the number of bits used for the network portion of the address (e.g.,
$/16$ means the first 16 bits define the network).
Subnets: Dividing the VPC
A subnet (short for subnetwork) is a range of IP addresses within your VPC. Subnets
are used to segment the VPC's network and are specific to a single Availability Zone
(AZ).
Types of Subnets
1. Public Subnet:
○ Resources in a public subnet can communicate directly with the internet.
○ This requires an Internet Gateway (IGW) to be attached to the VPC and a
route table entry pointing traffic to the IGW.
○ Instances must have a public IP address or an Elastic IP address to be
directly reachable from the internet.
2. Private Subnet:
○ Resources in a private subnet are isolated from the internet.
○ They are typically used for backend resources like database servers or
application servers that should not be directly exposed.
○ To allow instances in a private subnet to initiate outbound connections
(e.g., for software updates) while keeping them private, a NAT Gateway or
NAT Instance is used.
Subnet IP Addressing
● Subnets must have a CIDR block that is a subset of the VPC's CIDR block.
● For example, if the VPC CIDR is $[Link]/16$, you could create two subnets:
○ Subnet A: $[Link]/24$
○ Subnet B: $[Link]/24$
○ (A $/24$ block contains 256 addresses, of which 5 are reserved by AWS
in each subnet).
Routing and Connectivity
Route Tables
A route table contains a set of rules, called routes, that determine where network traffic
from your subnet is directed.
● Each subnet must be associated with a single route table (one-to-one or
many-to-one).
● Local Route: Every route table has a default local route for communication
within the VPC ($[Link]/16 \rightarrow \text{Local}$).
● Internet Route: For a public subnet, the route table includes a route sending all
external traffic ($[Link]/0$) to the Internet Gateway (IGW).
Internet Gateway (IGW)
The Internet Gateway is a horizontally scaled, redundant, and highly available VPC
component that allows communication between your VPC and the internet. It is the
bridge for internet traffic.
NAT Gateway (NAT)
The NAT (Network Address Translation) Gateway is deployed in a public subnet and
allows instances in a private subnet to connect to the internet (e.g., to download
updates) or other AWS services, but prevents the internet from initiating connections to
those instances.
ecurity in a VPC
Security within a VPC is managed at two levels:
1. Security Groups (SGs):
○ Act as a virtual firewall for an instance (EC2).
○ Stateful: If you allow inbound traffic, the outbound reply is automatically
allowed, and vice-versa.
○ Rules are defined for Allow only. Deny rules are not supported.
2. Network Access Control Lists (NACLs):
○ Act as a stateless firewall for a subnet.
○ Stateless: Requires explicit rules for both inbound and outbound traffic.
○ Supports both Allow and Deny rules.
Feature Security Group (SG) Network ACL (NACL)
Scope Instance (Virtual Subnet
Machine)
State Stateful Stateless
Rules Allow only Allow and Deny
Processing All rules evaluated Rules evaluated in order (lowest number
first)
Summary of VPC Components
Component Function Scope
VPC Logical isolation; defines IP space Region
Subnet Network segment; determines public/private Availability
status Zone
Internet Enables communication with the internet VPC
Gateway
NAT Gateway Enables private subnets to make outbound Availability
internet connections Zone
Route Table Defines traffic routing rules for subnets VPC
Security Group Instance-level stateful firewall Instance
NACL Subnet-level stateless firewall Subnet