AWS Networking Fundamentals
Tags: aws, vpc, networking, cloud
Published: 2023-07-04 21:57:25

***_Introduction_***


Welcome to the world of AWS, In this article I will take you on a journey to explore the fundamentals of networking within  AWS. Whether you're preparing for the AWS Certified Solutions Architect exam or simply curious about how AWS manages networking,then this article will provide you with valuable insights.Throughout our journey we will touch upon essential topics such as Virtual Private Clouds (VPCs), subnets, security groups, internet gateways and so many more.

*Let's Get Started !*

---

**_Virtual Private Cloud (VPC)_**



![VPC Logo](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e617glcfnmg3yi6q5cuu.png)





Ever wondered how millions of cloud users worldwide can utilize the same hardware for their applications without encountering resource conflicts?

Well the answer is vpc , essentially it's a **private network** within the cloud that **isolate** your cloud resources from other aws customers.

It is a **regional** service (Tied to a single region)



![Vpc](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ro6dzznce78xsro1s9s2.png)

By default, each region gonna have a default vpc initially created by aws but we can create up to 4 additional vpcs per region which total to 5 



**_Subnets_**

Subnets as their name suggests are logical partitions within a vpc created at the availability zone level which means a subnet can only exist within a single AZ.

Can create up to 200 subnets per vpc.

There are two type of subnets : 
      
     - Public Subnet : resources that live here have access 
                       to the internet.

     - Private Subnet : resources that live here can't access 
                        the internet directly.



![Subnets](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z5w5h154bzjlprvynqj4.png)


**_IP Adressing_**

Each vpc require a range/pool of private ip addresses called a cidr block, an example would look like this **10.0.0.0/24**
 
The /24 part called suffix identifies the network part of the ip address, now without entering the details of how the ipv4 address scheme work the only thing we need to know is choosing the suffix depends on the size of infra we wanna build for example a /24 cidr block would provide us with 256 ip addresses, the first 5 addresses are reserved which leaves us with 251 ips or in other words can only have 251 running machines inside the vpc.

**If you want me to write an article explaining how ipv4 and CIDR blocks work tell me in the comments bellow**

In the meanwhile check this user guide provided by amazon on how to choose a cidr block for a vpc

[VPC CIDR blocks](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-cidr-blocks.html)


Each subnet in the vpc needs also a cidr block that is a subset of the vpc's cidr block.We can achieve this by taking the vpc cidr block and subnetting it even further using different techniques that are out of the scope for this article.


There are 3 types of ip addresses in aws
 
      - Public : Identifies resources on the internet 
                 Temporary (changes everytime we stop/start 
                            the instance).
       
      - Private : Identifies resources in the vpc and it's 
                  permanent unless the instance is terminated

      - Elastic : A static public ip address (permanente).
                  Created seperately and can be attached to 
                  an ec2 instance.
                  Aws only charge money when it's not in use.


**_Internet Gateway_**

It is a VPC component that allows communication between your VPC and the internet as simple as that.

**_Route Table_**

A table that contains the different routes in/out a subnet.


![route table](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t4o70407e384xwvzxant.png)

By default, aws creates a route table called main route table in every main vpc (default vpc /region) and associate it with all default subnets in the vpc (in every AZ aws creates a default subnet )


![diagram route table](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fm1vfsx73l38wql0wwke.png)


So to enable access to or from the internet for instances in a subnet in a VPC using an internet gateway, you must do the following : 

1. Create an internet gateway and attach it to your VPC.
2. Add a route to your subnet's route table that directs 
   internet-bound traffic to the internet gateway.
3. Ensure that your network access control lists and security 
   group rules allow the desired internet traffic (we will 
   get to this later in the article when discussing security 
   groups and Nacls )


Overall, we will have something like this at the end


![aws diagram](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8rc945ury7bmi4rejie0.png)


**_Nat Gateways_**

What if you want to make some updates to an ec2 instance that lives in a private subnet ? how can you access the internet to pull the updates ?

Well nat gateways is there for the rescue, it's a managed solution provided by aws that allows instances in a private subnet to connect to services outside your VPC such as the internet or other isolated vpcs.

There are two types : 

  - **Public** (default) : Instances in private subnets can 
    connect to the internet, but cannot receive connections 
    from it.
    Must be created in a public subnet 
    Must associate an **elastic IP** address with the NAT 
    gateway at creation.
    

  - **Private** : Instances in private subnets can connect to 
    other VPCs or your on-premises network through it.


In most cases we use public Nat gateways.

The only thing left to do is to update the route table associated with the private subnet to be able to direct internet-bound traffic to the Nat gateway.


![Nat gateway](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4pg6jlm8mblltlll8x3k.png)
    

**_Security groups and Nacls_**

They are both firewalls

**Security groups** are **stateful** and controls inbound/outbound traffic at the **instance level**.

By default all outbound traffic is allowed and all inbound traffic is denied

Stateful means that if a connection to/from the instance is made in one direction (Passed the firewall rule) then the reply in the other direction is automatically allowed.
wich means requests have to pass the firewall rules only once.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/in2orqgt7f59xeln9k2b.png)

Example of an inbound rule 


![inbound](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0np6pysltsudp2cl9h3g.png)

Example of an outbound rule 


![outbound](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rsoe8qvzcv2b44enc3g8.png)


Some notes about security groups :

  - Specific to a region and a vpc.
  - Source and Destination can be a cidr or another security 
    group

**Nacls** are **stateless** and controls inbound/outbound traffic at the subnet level.

By default it allows all traffic from anywhere.

![nacl diagram](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aj9zo5jx2cjhqwvqx20a.png)

Example : Let's say we want to deny http traffic on port 80 


![nacl rules](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s10p1ihdgx8xfn7kj26d.png)

Rules are evaluated by number (lowest number evaluated first)

The default rule designated by (*) can't be deleted and it's always evaluated last and catches anything that didn't match prior rules.

An advantage of Nacls over security groups is that they give us the ability to define deny rules which allows us to block a specific ip addresses from reaching resources on a specific subnet.


**_Bastion Hosts_**

Now imagine that we want to ssh into an ec2 instance that lives in a private subnet to perform some configurations.

Answer : Bastion hosts also called jump hosts.

They are regular ec2 instances that live in a public subnet and we use them as a intermediary for ssh'ing into an instance within a private subnet.

**_Vpc Endpoints_**

In simple words they allow instances in a vpc to reach 'Paas' services like S3 and Dynamodb through aws's private network instead of going through the internet.
Can be used for additional layer of security.

There are two type of endpoints : 

  - Gateway : Allows connections to S3 and DynamoDB only.
  - Interface : Allow connections to all other aws services.


Services that are managed by aws like S3 , DynamoDB etc do not belong to a vpc.
The only way for resources within our vpc to reach these services is through the internet or through vpc endpoints.


![vpc endpoint diagram](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n9mh98498qh97g0y20kg.png)


**_Vpc Peering And Transit Gateways_**


So far we talked about how vpcs are isolated from each other which means there is no network reachability between them.

How can we make two or more vpcs communicate with each other through aws's private network.

We have two ways to do it :

- **Vpc peering** : We create a peering connection that allow two vpcs to behave as a single network under the condition that these two vpcs cannot have overlapping cidr ranges.

We can peer two vpcs within same account or accross multiple aws accounts

Not transitive.


![vpc peering](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kmnqmcs992k6fvennii2.png)


We also have to update the routing tables in each vpc to allow traffic back and forth.


![peering diagram](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xq7oji5uhmhat81mky4n.png)

- **Transit Gateway** : Allow us to connect two or more vpcs together and unlike vpc peering they are transitive.

They also can peer other transit gateways.


![transit gateway](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6w95jsp6nogig2a5ziok.png)

At the moment this is the only service that support multicast routing.

Multicast : means delivering single stream of data to multiple recieving instances simultaneously.


**_Site-to-Site Vpn_**

Suppose we want to connect a on-premise cloud to aws 

One option for doing this is through vpn 


![privatelink](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5g9jc25cvibw1wqnic70.png)

On the customer side you'll need a customer gateway managed on-premise and on the Aws side you'll need a virtual private gateway.

In the subnet route tables we need to enable route propagation and in the security groups of the ec2 instances we need to allow inbound icmp messages in order for this to work.

Even though the traffic is encrypted it's still going through the public internet.

So if we want maximum security then we can use direct connect.

**_Direct Connect_**

This offers a dedicated physical connection (using optic fibers) from on-premise to aws.

More expensive and takes longer to setup.


![direct connect diagram](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8jyieonzxw8p4xgq47aw.png)

---


**_Conclusion_**

In this article I tried to provide an overview of networking fundamentals in AWS. It is important to recognize that a comprehensive understanding of AWS networking requires a deeper exploration beyond the scope of a single article.
As with any technical subject, hands-on experience and continuous learning are crucial.


Alright that concludes our journey today thank you for your time
If you have any questions don't hesitate to ask in the comment section.

**Have a nice day !**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/97gj3q6mu0j7p766ac68.jpg)