AWS Basics · Module 04

Networking with Amazon VPC

Build your own network on AWS — split subnets, reach the Internet safely, block traffic in the right place and connect networks together.

Practice interactively →

What you will learn

• Calculate CIDR ranges and split a VPC into subnets
• Tell a public subnet from a private one by its route table
• Let private instances reach the Internet through a NAT Gateway and manage them via a bastion
• Choose a Security Group or a Network ACL for each allow/deny requirement
• Connect two VPCs with peering and reach S3 through a VPC Endpoint

Lessons

1. IP, Subnet Mask and CIDR

   Read /n notation, work out the network address, and know how many usable IPs an AWS subnet really has.

2. VPC, Subnet, Internet Gateway and Route Table

   Build a VPC with a public subnet from four building blocks — the VPC, a subnet, an Internet Gateway and a route table.

3. NAT Gateway, NAT Instance and Bastion Host

   Give private instances one-way Internet access with NAT, and SSH into them safely through a bastion host.

4. Security Group vs Network ACL

   The two firewall layers in a VPC — a Security Group guards each instance (stateful, Allow only), a NACL guards the whole subnet (stateless, supports Deny, evaluated by rule number).

5. VPC Peering, VPC Endpoints and troubleshooting

   Connect two VPCs with peering (non-transitive, needs routes on both sides), let private instances reach S3 through a gateway endpoint, and troubleshoot network issues in order.