Welcome back to BackSpace Academy. In this lecture we're going to be building 2
on what we already know about VPC and we're going to go into a little bit more 3
of an advanced detail on this. This is quite important if you're going to be 4
going on and doing one of the associate level certifications. We're going to 5
start off by having a look at subnet addressing how do we address our VPCs 6
and our subnets and the IP addressing of those and the components that go inside 7
of those subnets. We'll talk about how we can connect to a VPC from an external 8
source. We'll talk about route tables that control the routing of traffic 9
within our VPC. We'll talk about public and private subnets, how do we create 10
those and the differences between those. We'll talk about network address 11
translation and how we can get requests for a public IP address and for them 12
over to our ec2 instances in a private IP address and, finally we'll look at the 13
core security functions of VPC. So here we have the AWS cloud. We have a region 14
of that AWS cloud and that region is divided up into availability zones. 15
We've created a VPC that's spanning those multiple availability zones and 16
inside of that VPC we've created two subnets. One subnet in each of those 17
availability zones. What we're going to talk about is how do we address 18
that VPC and the range of IP addresses that can live within that VPC and 19
also the same with the subnets. What is the IP range of those and how do we 20
define those? There are two different types of IP addresses 21
there are version 4 and version 6. A TCP IP version 4 address, it's a 32-bit 22
binary number. If you don't know what a binary number is then please go away and 23
learn a little bit about it because you certainly need to know that 24
to do anything in the IT industry. Now that is represented as four bytes, so 25
four eight bits, so 4 times 8 is 32 and you convert those over to a decimal 26
number. There we can see we might have something that says 27
192.173.255.000 and that would be an IP address a version 4 IP address. 28
There are private and public network addresses. A public address if it's 29
assigned to a server for example a web server, that allows that web server to be 30
found on the wider internet. A private network or a private IP on a private 31
network, that will not be accessible from outside of that network and so that IP 32
addressing in that range will only be for communication between that local 33
network. There are defined ranges or network ranges that are reserved 34
specifically for private addresses. We have Class A which is 10.0.0.0/8 35
and we're going to talk a bit more about that /8 and 36
what that means, but that represents the range of IP addresses in that block of 37
IP addresses. If an IP address begins with the number 10 it will be a class A 38
private address and you won't be able to use it on the wider Internet you can 39
only use that on your private local area network. 40
Class B addresses which 172.16.0.0/12, again we'll talk about 41
that /12 what that means. So if the IP address begins with 172 or 42
anywhere between 16 and 31 after that that will be a Class B private address. 43
Finally we have Class C there which is 192.168.0.0 /16 this time and so 44
that means that if an IP address starts with 192 .168 it has a or it is a 45
Class C private address. Those addresses will only be used on 46
your private network they're not used to broadcast for a public address point. 47
We'll talk more about what that means as far as /16 etc coming up 48
the network portion so that defines where your network actually starts. 49
The starting address of that block of network IP addresses and the zeros 50
represents the hosts. That's the IP range of hosts that can live within our 51
IP address or our IP address range. Amazon on the AWS cloud they will 52
reserve the first four IP addresses so you can't use those and the last IP 53
address of every subnet for their own IP networking purposes. So five of those IP 54
addresses you cannot use so although you might have for example 20 available in 55
reality you're only going to have 15 available because five of those will be 56
used by by AWS. So here's an example so what we've got here is 192 168 1 0 is 57
our network or our network IP address and we have to find there a subnet mask 58
of 255 255 255 0. So looking at that in binary we can see our subnet mask the 59
first 3 bytes of our subnet mask are ones and then the last byte are zeros. 60
That red line that I've drawn there is where the network portion ends and 61
the hosts or the range of hosts are defined after that. What we're going 62
to do is we're going to have a range of IP addresses which are going to go 63
from 192 168 1 all the way up to the last which will be 255 but again we 64
don't use 255 that will be used by AWS. Our first available host will be, it 65
won't be 0, it won't be 1, it won't be 2, and it won't be 3 because 66
those 4 IP addresses at 168 1 0 1 2 & 3 they're used by AWS. Our first 67
host address is going to be 4 so to be 192.168.1.4 is the first available 68
host address in that range of IP addresses and the last one will be 254 69
because 255 is is used by AWS for its own internal networking purposes. 70
That will define a range of IP addresses for our VPC and within that we 71
could define subnets of a smaller range inside that as well. Now a picture tells 72
a thousand words so here we can see we've got a network ID that we defined 73
in the last slide of 192 168 1 0. That had a subnet mask remember of 255 74
255 255 and 0 so what does it look like when we're launching servers or ec2 75
servers inside of that network what are the available ones? So the first one 76
there is going to be 192 168 1.4 is the first one that will be available for us 77
to use we can't use 0 we can't use 1 we can't use 2 and we can't use 3 so those 78
first 4 IP addresses will be used by AWS and then the last one that we can use 79
there will be 192 168 1 . 254 we can't use 255 because 80
that is being used by AWS, That is the maximum range of instances that we can 81
launch based on that subnet mask. Now if you remember at the start of the lecture 82
I did mention that we could define our IP address ranges using a notation of 83
/24 or /16 or whatever. The way that works is that 84
instead of using a subnet mask for example 255 255 255 0 0 0 which is quite 85
long, we could shorten that to simply /24 what that means is that 86
the 24 defines the number of network portion bits so a /24 will 87
have the first 24 bits allocated to defining the network address and then 88
the last 8 bits will be for defining the network IP address range. 89
A /24 is just a short way of writing that long 255 255 255 0 0 0 90
subnet mask. The next one down there we can see is a /16, The 91
first 16 bits are for defining the network portion and the last 16 are for 92
defining the IP address range of that network and so that would be in a subnet 93
mask 255 255 .0 0 0 .0 0 0 The final one there we've got is /20 94
As a subnet mask it will be 255 255 .240.000 because the first 95
20 bits so the first 2 bytes plus the next 4 bits so the first 20 bits 96
we'll be defining our network address and then the last 12 bits will be 97
defining our network IP address range. One thing to take consideration or take 98
note of is that the smaller the number for our shorthand the larger the IP 99
address range because there's more available for defining our IP address 100
range. There's more bits available and less bits that are used for 101
defining the actual network portion itself. So a /24 only has 8 102
bits available for defining an IP address range whereas a /16 has 16 bits 103
available for defining that IP range. Let's have a look at one a little bit 104
more difficult here. We've got an IP address range of 170 2.31.6.0/20 105
The first 20 bits are going to define our network 106
address and then the final 12 bits are going to be defining the range of 107
addresses that are available to us. We're going to start off with 108
172.31.16.0 in our address range but the first four addresses so that will be 0 1 2 and 109
3, they will be used by AWS. The very first address in that address range will 110
be 172.31.16.4. Now because we've defined where that red line is where 111
our /20 goes, our last host address it's going to be, it won't 112
be at the position 255 it's going to be at 172.31 and then it's going to be 113
31 again, so that third byte will be a 31 as you can see there on the last 114
there binary and the last host address will be 254 and won't be 255 because 115
that last address is used by AWS. That's a quite 116
tricky one there but you can see there that when you break it down using the 117
binary and you just draw it out in binary and then convert the individual 118
binary over to decimal, you can see there you'll get 172 31 16 4 all the way out 119
to 172 31 31 254. When we have our VPC it's going to have its 120
own defined range of IP addresses and then inside that our subnets are also 121
going to have a defined set of IP addresses. The range of IP addresses 122
within each subnet must of course be less than the range of the VPC 123
otherwise that subnet just physically won't fit within the range of the VPC. 124
Again when we have a larger number in our CIDR notation it's going to produce 125
a smaller range of IP addresses there so there we can see we've got our VPC 126
which is 172.31.0.0/16. It's quite a large range of IP addresses 127
and then we're going to have two subnets in there that are going to define a 128
smaller range of IP addresses which are /20 range. That's how 129
we do our IP addressing within a VPC. One good thing about the AWS 130
VPC service or the console, is that when you're creating a VPC and you're doing 131
it manually like this, if you make a mistake and the the range of IP addresses 132
is too big to to fit in that VPC then the VPC service will specifically tell 133
you, "hey that's too big make it smaller" and likewise if you make a VPC subnet 134
that's too small a range that can fit any instances in, then it'll tell you 135
that as well. So it does provide you a little bit of assistance as well. 136
There's a few things to understand about the AWS VPC service, in particular with 137
ipv4 addressing. By default when you create an AWS account a default VPC 138
will be created for you and it will have the private side a range of 172.31.0.0/16 139
So you're free to use other private address ranges if you like 140
for example if you want to use a 10.0.0.0/16 range you could do that as 141
well, but by default, out of the box, there is a default VPC there already created 142
for you ready to go in that IP address range. Amazon VPC it will support 143
between /28 and /16 address ranges in size. 144
If it's larger than that, if it's larger than a /6 or or less than a 145
/28 then you'll receive an error saying change the size of that 146
VPC. so the minimum size of a subnet is a /28. Now a /28 will 147
have 16 IP addresses in that range, of which, because five of those will be used 148
by AWS, 11 are available. If you do a /28 you can only put 11 149
resources within that VPC or you can only address 11 resources within that 150
VPC. Obviously the subnets can't be larger than the VPC that's surrounding 151
it. You need to make sure that your subnets are smaller than that VPC or the 152
IP address range is smaller than that of the VPC. Now there is also IPv6 addressing 153
available with Amazon VPC but it has more restrictions around it. Although it 154
allows you to provide very large size of VPCs there are restrictions around how 155
you can size those. It does support ipv6 addressing and that format is not a 156
32-bit it's now a 128 bit, so it's eight groups of four hexadecimal digits is how 157
you define an ipv6 address. The CIDR block is fixed at 56 so if you want 158
anything other than slash 56 you can't use it, and the subnet CIDR block that 159
is fixed at /64, so you need a different CIDR 160
block range you can't use that. So they're the restrictions around it. 161
Also AWS chooses the CIDR block for your VPC, you cannot choose that yourself. 162
AWS will choose it from those that are available. All ipv6 addresses 163
are public, there are no private address ranges available on ipv6 for you to use 164
with AWS. Now elastic IP addresses, so having an IP address available that you 165
can use with different ec2 instances and disconnect them and 166
reconnect them to others. Elastic IP addresses are not supported with version 6 167
only with ipv4 addresses. So there are some restrictions around how you use 168
VPC addressing with AWS. So to change the IP range of an existing 169
VPC or an existing subnet. For example if you wanted to change it from a 24 and 170
then make it a /20 you just can't do that, you just kind of go into 171
the console and and type that in and change it, you must terminate that VPC 172
and create a new one but, there are ways around this. You can expand an 173
existing VPC by adding up to four secondary ipv4 address ranges to that VPC 174
Although you can't get an existing subnet and just create that or change 175
that IP address range from a 24 to a 20 for example but you can add a whole new 176
set of CIDR blocks here as well and, of course you can shrink it by deleting 177
those secondary CIDR blocks at any time if you want to as well. A big 178
restriction, you cannot change the size of an ipv6 address 179
range on your VPC. 180
Now in our past lessons we've launched EC2 instances and we've launched them 181
with a Wordpress AMI and created a web server with a public IP address and 182
we've been able to access that web server over the Internet through a 183
browser. Now to achieve that we needed to have an Internet gateway and so in our 184
default VPC there is one of those already created and so that will allow 185
us to receive traffic from the wider Internet. That is a scalable 186
redundant and highly available VPC component, so although it appears to be a 187
single point of failure in reality it is actually a highly available and fault 188
tolerant VPC component that won't go down on you. It provides a target in your 189
VPC and you define that in your route tables for internet routable traffic. 190
If you want traffic to go out to the wider internet you need to put in an 191
entry in your route table, and we'll talk about that soon, to get to that internet 192
gateway. It also performs network address translation or NAT so if your instance 193
has a public IP address and, if it's a web server it will no doubt have a 194
public IP address, so when the internet gateway receives traffic for that public 195
IP address it will do network address translation. It will forward that on to 196
the private IP address of that EC2 instance in your VPC. If you don't want 197
public access to your your private network what you can do is that you can, 198
instead of using an Internet gateway, you can use a virtual private network or 199
create a virtual private network. To do that that will consist of a virtual 200
private gateway and a customer gateway and a VPN connection between those two. 201
The virtual private gateway that is the VPN 202
concentrator that's on the Amazon side of that VPN connection, and the customer 203
gateway that is at your remote premises. If it's a data center for example you 204
would have a customer gateway which could be a software application or it 205
could be a physical hardware device that connects to that VPN. Now looking at that 206
diagram there we can see that we've got our Virtual Private Gateway, we've got 207
our customer gateway and, we've got our VPN connection between the two. You 208
may ask "Isn't that a single point of failure?" 209
What happens if our virtual private gateway goes down or any one of those 210
components goes down? You may think that we've got no redundancy there but 211
in reality the VPN connection is a dual tunnel connection and the Virtual 212
Private Gateway will connect to both of those tunnels on that VPN 213
connection, and it will also address two public IP addresses. So if you wanted to 214
take advantage of that dual tunnel connection and that dual tunnel traffic 215
all you need to do is to attach another customer gateway so you've got two 216
customer gateways then you will have both of those tunnels in that VPN 217
connection used and you will have redundancy there, you will 218
not have a single point of failure. Other options that are available, if 219
you're looking for a very high-speed connection to the AWS network, that is 220
going to be private, then by all means consider AWS Direct Connect. That is 221
what you would consider if you had a large enterprise that wanted a 222
high-speed private connection to AWS. We already know by now that we can use 223
an Internet gateway for public access to the wider Internet. We also know from our 224
our experience from launching EC2 instances with WordPress that we need to 225
have a public IP address so that web server can be found on the wider 226
Internet but, we also need to define a route from our VPC 227
subnet through to our internet gateway. Without that our traffic 228
won't get routed through our VPC. The way that we do that is that we use a 229
route table and we create a custom route table entry that will point to that 230
internet gateway and it will be explicitly associated to the subnets 231
that are containing those instances that need public access. So we're launching 232
EC2 instances into a subnet we need to make sure that there is a route table 233
associated to that subnet that has an entry that points to the Internet 234
gateway for traffic that is destined for the wider Internet. 235
If you don't specifically or explicitly define a route table with a subnet by 236
default when you create a VPC a route table called the main route table will 237
be automatically created and, if you don't associate or explicitly associate 238
a route table to a subnet then by default the main route table will be 239
associated to it. So by default that will allow all 240
local traffic within the VPC but it will not allow any traffic to the wider 241
internet. That is how you create a private subnet is that you use a main 242
route table and so that will be implicitly associated to all subnets 243
only unless you explicitly associate a different route table to that subnet. 244
A custom route table it is also automatically created when you create a 245
VPC with the VPC wizard so it will automatically create an Internet gateway 246
it will automatically create a custom route table and it will also create a 247
route entry within that route table that will point from your public subnet 248
through to that internet gateway. That will allow local traffic within the 249
VPC. It will create a route to the public 250
Internet gateway and it will be explicitly associated to the public 251
subnet that is if you use a VPC wizard and you ask it to create a public subnet. 252
If we have a look at the table below we've got 2 253
sample route entries in a route table. The first one there is the main route 254
table and that is automatically created for you when you create a VPC and if you 255
don't associate a route table to a subnet then that will be automatically 256
associated for you. That will have destination of 10.0.0.0/16. That is if 257
your VPC is within that range if it's 172 dot whatever then it will say that 258
there but all the traffic that is destined within that VPC will be 259
allowed, any traffic that is outside of that VPC will not be allowed as opposed 260
to the next route table entry there which is for a custom route table. So 261
that again allows traffic within the VPC, between subnets within that local 262
VPC that's fine, but it also allows traffic to the wider internet. We can 263
see there 0 0 0 0 /0. It also allows that to go through the internet gateway 264
and so we've defined a route for all of that public or that wider Internet 265
traffic to go through the internet gateway within our VPC. We have two 266
different types of subnets that are available to us. We have public subnets 267
that can retrieve traffic from the wider internet from outside of our VPC and we 268
have private subnets that can only allow traffic within that VPC. So there we 269
can see we've got our VPC which is 10.0.0.0/16 and within there we've 270
got a route table explicitly associated to our public subnet and that is 271
allowing local traffic within the 272
VPC but it's also allowing traffic through to the wider Internet through to 273
our Internet gateway. On the right there we've got a private subnet so that does 274
not have a route to an Internet gateway and so that cannot have or the instances 275
inside of that cannot have access through to the wider Internet and vice 276
versa and, they cannot receive traffic from the wider Internet and so that is 277
if we just create a subnet that is what our some that will look like it will be 278
by default a private subnet until we explicitly associate a route table that 279
makes it a public subnet, and by being a public subnet it will have a route from 280
that subnet through to the Internet gateway. Now if you create a private 281
subnet and for example you launch a database application on ec2 for example 282
it could be MongoDB. That application that's running on the EC2 in that 283
private subnet will need to download its updates from the wider Internet but if 284
that EC2 instance is located in a private subnet that can't occur because 285
we're not going to have a route to the Internet and it's going to be a private 286
something that's not going to allow that to happen. 287
Also there are a number of AWS services that may require access to the wider Internet 288
A good example of that is elastic beanstalk. So you might want to 289
launch this MongoDB application on Elastic Beanstalk and it won't work 290
because Elastic Beanstalk needs to have access to the Internet gateway. 291
So when you create a private subnet it is always a very good idea to also launch 292
either a NAT server or a NAT gateway. What that does with, for example a NAT 293
server, you can launch an EC2 instance that will have a NAT server AMI that 294
will be running on it and that will have a route in a public subnet to the 295
Internet gateway. So that NAT instance will have access to the wider 296
Internet and your Elastic Beanstalk or your EC2 environment or whatever it is, 297
that needs to download updates from the wider Internet, can connect privately to 298
that NAT instance and can download those updates. That way you 299
get all the benefits of having a private subnet but your resources inside of 300
there can contact the wider Internet to receive any data or any application 301
uploads or updates that it needs. So you have two options here. You have an 302
option to launch an EC2 instance in a public subnet or you can launch a NAT 303
Gateway and so that is a highly available service it's a serverless service. 304
It's a lot more expensive than running just a simple micro EC2 instance, so you 305
need to take into consideration how much traffic and how much bandwidth you're 306
going to need because all it's basically doing is providing a proxy from your 307
private subnet through to the wider Internet. Okay so looking at the NAT 308
Gateway side of things there, we've got a VPC main route table now that will be 309
implicitly associated to the private subnet and our elastic beanstalk 310
environment is inside of that private subnet. The Elastic Beanstalk service 311
needs access to the wider internet no matter what it's doing it will need 312
access and so if you don't have either a NAT server or a NAT 313
Gateway it won't work. So that main route table will of course have its local 314
traffic allowed but it will also allow outgoing traffic to the wider Internet 315
but it will need to go through to the NAT gateway that will be located inside 316
of that public subnet. On the right there we've got a net instance. 317
We could launch a very small NAT instance a micro instance or something 318
like that to keep the cost down. If we didn't need a highly available solution 319
like a NAT gateway and again so that wider all that traffic that needs to 320
come in from the wider internet will have a target route table 321
entry they're pointing to the elastic network interface a network interface 322
card of that NAT instance and so all traffic will go through to that NAT 323
instance it will act as a proxy through to the wider Internet. 324
So the Golden Rule, if you're creating a private subnet it is always a good 325
practice to either create a NAT instance in the public subnet or a NAT gateway as 326
well because if you don't and you run into problems they can be very difficult 327
to troubleshoot. AWS has a very broad range of security offerings that are 328
available that you can use within a V PC but the three core services that you 329
need to really understand and that is, first of all, security groups that you 330
apply or you associate to an instance. You can associate the same security 331
group to multiple instances but they're associated at the instance level and 332
they act as a firewall for that instance. You can also have network access control 333
lists or NACLs. Now they will operate as a firewall, again similar to security 334
groups, but they operate at the subnet. So you define them at a subnet and any 335
instance that is located within that subnet will have the protection from 336
that network access control list. Finally we've got flow logs. They can 337
capture information as cloudwatch logs. If you have some unusual activity you 338
can go and have a look at those flow logs and see what's going on. You 339
might be getting hit with a DDoS attack or something. That will be picked up 340
on those flow logs. One thing that a lot of students seem to get a 341
little bit confused around is what is the difference between a secure 342
group and a network access control list? First off as we stated before a 343
security group it operates at the instance level. You associate a 344
security group to a particular instance or multiple instances. A network ACL 345
that operates at the sub net level. If you define a subnet with a network 346
access control list any instance that is inside of that subnet will receive the 347
security of that network access control list. A security group it 348
supports allow rules only. You don't have deny, you only have allow. 349
If you don't have any allow rules then no traffic will be allowed. You need 350
to allow traffic in using those security groups with a network access control 351
list. It has both allow and deny rules and we'll talk a bit about how they work 352
when they're conflicting. A security group 353
it's stateful. What that means is that return traffic is automatically allowed. 354
If an ec2 instance receives traffic that is allowed then the return traffic 355
that it sends back to that request will also be allowed, its stateful. That's 356
what we mean by stateful. Network access control list its state less. 357
Although you may receive traffic, the traffic going the other way to the same 358
location that you received it from may not necessarily be allowed. 359
Return traffic as well as incoming traffic must be explicitly allowed by those network 360
access control list rules. We evaluate the rules differently depending on 361
whether it's a security group or a network access control there. With a 362
security group we will evaluate all of the rules before deciding whether 363
to allow that traffic. If there is more than one 364
rule for a specific port, because we apply these rules based on a port, it will 365
apply the most permissive rule. What that means is if you have a rule that allows 366
everything in and you have another rule that only allows a little bit in 367
everything will come in. The most permissive, or the least 368
restrictive, the most permissive will will allow everything in. So that's 369
something that you need to be very important with security groups. 370
As opposed to the network access control list that will process the rules in 371
number order and once it's gone through all of those rules it will make a 372
decision on whether to allow that traffic in and as opposed to a security 373
group the most restrictive denied applies. If you have and allow that 374
allows everything and then you have a deny that restricts everything 375
nothing will be allowed to come through. That is a very big difference, 376
the network access control list, the most restrictive deny applies there. 377
A security group, it applies to an instance only if someone specifies that security 378
group when you launch that instance or if you associate that 379
security group with that instance at a later stage. A network ACL is 380
applied to all instances in that subnet. If you launch an instance inside of a 381
private subject that has a network access control list, it will receive the 382
protection of that network access control list. All instances inside of 383
that subnet will. It acts as a backup layer of defense so you don't have to 384
rely upon on someone specifying the security group and making a mistake on 385
that. You can set up a network access control list that can really provide 386
overall across all of those instances in that subnet a basic level of security. 387
That brings us to the end of a very long very complicated lecture. I 388
hope you got a lot out of it and if you're becoming a Cloud practitioner 389
you just really need to know this high-level stuff. If you're going on to 390
become an associate level certified with AWS then you're going to need to know 391
this very well and you also need to know how to apply that as well and if you're 392
going on to further courses with Backspace' Academy then you will 393
certainly get a lot more hands-on on how to actually use this stuff as well. So I 394
look forward to seeing you in the next lecture.