VPC: Your Private Network

Every server we've launched in this series has been inside a network you didn't build: the default VPC that AWS creates in each Region. It's fine for experiments, but a real application needs a design where the database stays hidden and each layer has its own place.

What is a VPC? #

A VPC (Virtual Private Cloud) is your private network within one Region. It spans all of that Region's Availability Zones, and nothing gets in or out unless you allow it. This is the common design:

Address ranges: how to read CIDR #

You write an address range in CIDR form, such as 10.0.0.0/16. The number after the slash says how many of the 32 bits are fixed, so the smaller the number, the bigger the range:

Use the private ranges: 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. The default VPC uses 172.31.0.0/16.

Subnets #

A subnet is a slice of the VPC's range, and here's what matters most:

• It lives in one Availability Zone. For high availability you need subnets in at least two zones.
• AWS reserves 5 addresses in each one: the first four and the last. So /24 gives you 251 addresses, not 256.
• "Public" and "private" aren't settings. A subnet becomes public when its route table has a route to an internet gateway.

Route tables and the internet gateway #

An internet gateway connects the VPC to the internet. A route table decides where each packet goes. A public subnet's table looks like this:

For anyone to reach the server from outside, it also needs a public address. Remember from part four that all public IPv4 addresses cost money.

NAT Gateway: out without in #

A server in a private subnet sometimes needs to go out, for example to download updates, but you don't want anyone coming in. That's the job of a NAT Gateway: it sits in the public subnet, sends the private servers' requests out under its own address, and accepts no connection started from outside.

The private subnet's table has 0.0.0.0/0 pointing to nat-... instead of the internet gateway. There are a few forms:

How do you reach a private server? #

It has no public address, so how do you get in?

Two firewalls: security groups and NACLs #

You know the security group, which surrounds the server. There's a second firewall called a NACL that surrounds the subnet:

Since a NACL doesn't remember connections, you must allow the server's replies through ephemeral ports (usually 1024-65535), and this causes a lot of mistakes.

The practical rule: leave the default NACL alone and work with security groups. Use a NACL when you want to block an address range quickly, since a security group can't deny.

Flow Logs #

When a request doesn't arrive and you don't know why, Flow Logs record the details of each connection at the VPC, subnet or interface level, and send them to CloudWatch Logs or S3. A line looks like this:

2 123456789012 eni-0abc 203.0.113.7 10.0.1.5 49152 22 6 5 300 1730000000 1730000060 REJECT OK

That means: from 203.0.113.7 to 10.0.1.5 on port 22, and it was rejected. How to diagnose:

• Inbound rejected: the problem is the security group or the NACL.
• Inbound accepted and outbound rejected: the problem is the NACL, because a security group allows the reply automatically.

Hands-on: build a VPC from scratch #

We'll build a network with public and private subnets, and see for ourselves that the whole difference is in the route table. All commands are from CloudShell. First, the network and subnets:

VPC=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=series-vpc}]' \
  --query Vpc.VpcId --output text)

AZ=$(aws ec2 describe-availability-zones \
  --query "AvailabilityZones[0].ZoneName" --output text)

PUBLIC=$(aws ec2 create-subnet --vpc-id $VPC --cidr-block 10.0.1.0/24 \
  --availability-zone $AZ --query Subnet.SubnetId --output text)

PRIVATE=$(aws ec2 create-subnet --vpc-id $VPC --cidr-block 10.0.11.0/24 \
  --availability-zone $AZ --query Subnet.SubnetId --output text)

Now the internet gateway, and a route table for the public subnet only:

IGW=$(aws ec2 create-internet-gateway \
  --query InternetGateway.InternetGatewayId --output text)
aws ec2 attach-internet-gateway --vpc-id $VPC --internet-gateway-id $IGW

RT_PUBLIC=$(aws ec2 create-route-table --vpc-id $VPC \
  --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id $RT_PUBLIC \
  --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW
aws ec2 associate-route-table --route-table-id $RT_PUBLIC --subnet-id $PUBLIC

A security group allowing traffic only from inside the network, and an entry point so we can reach the servers without opening a port to the world:

SG=$(aws ec2 create-security-group --group-name series-sg \
  --description "SSH and ping from inside the VPC" --vpc-id $VPC \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id $SG \
  --protocol tcp --port 22 --cidr 10.0.0.0/16
aws ec2 authorize-security-group-ingress --group-id $SG \
  --protocol icmp --port -1 --cidr 10.0.0.0/16

aws ec2 create-instance-connect-endpoint --subnet-id $PRIVATE \
  --security-group-ids $SG --no-preserve-client-ip

And a server in each subnet:

AMI=$(aws ssm get-parameter \
  --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \
  --query Parameter.Value --output text)

aws ec2 run-instances --image-id $AMI --instance-type t3.micro \
  --subnet-id $PUBLIC --security-group-ids $SG --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=public-server}]'

aws ec2 run-instances --image-id $AMI --instance-type t3.micro \
  --subnet-id $PRIVATE --security-group-ids $SG \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=private-server}]'

Wait a few minutes for the entry point to be ready. Then in EC2 select a server, choose Connect, and under EC2 Instance Connect pick the option that connects through the endpoint. On each server, try:

curl -m 5 https://checkip.amazonaws.com

• public-server: prints its public address.
• private-server: times out with no answer, because it has no route to the internet.

From the private server, try ping on the public server's private address, and it replies, because the local route connects them.

Add a NAT Gateway #

Now let the private server go out. This step is billed by the hour, so delete it after experimenting:

ALLOC=$(aws ec2 allocate-address --domain vpc \
  --query AllocationId --output text)

NAT=$(aws ec2 create-nat-gateway --subnet-id $PUBLIC --allocation-id $ALLOC \
  --query NatGateway.NatGatewayId --output text)
aws ec2 wait nat-gateway-available --nat-gateway-ids $NAT

RT_PRIVATE=$(aws ec2 create-route-table --vpc-id $VPC \
  --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id $RT_PRIVATE \
  --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT
aws ec2 associate-route-table --route-table-id $RT_PRIVATE --subnet-id $PRIVATE

Repeat the same curl command on private-server. This time it prints an address, which is the NAT Gateway's, not the server's. The server went out to the internet, and still nobody can start a connection to it.

Summary #

• A VPC is your private network in a Region, split into subnets across Availability Zones.
• A subnet is public if its table has a route to an internet gateway, otherwise it's private.
• A NAT Gateway lets private subnets go out with nobody coming in, but watch its cost.
• Security groups remember connections and only allow; NACLs don't remember and can deny.
• Flow Logs tell you where a connection was rejected.

Test yourself #

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Your network is now ready, but isolated. In part fourteen we connect it to other networks, to AWS services and to your office.