Welcome back to Backspace Academy. In this hands-on session on VPC 2
networking I'm going to be keeping it pretty simple and high-level the reason 3
being this is a cloud practitioner part of the pathway so it's a foundation level 4
we don't need to get too involved in the nuts and bolts of VPC but I want 5
you to understand the basics around VPC subnetting, route tables 6
network access control lists, all this sort of stuff so that you understand the 7
basics around it and if you have problems you can 8
troubleshoot that yourself. So we get to here obviously by services and then VPC 9
and that will take us to the VPC dashboard which will list all of our VPC 10
components we can see here now we've already got a VPC and the reason we've 11
got a VPC is that AWS for all new accounts will create a default VPC in 12
every single region so we click here on see all regions we can see that we have a 13
default VPC already created for us in every region we can also see here that 14
we have subnets already created for us and there are six subnets the reason 15
there are six subnets is of is that there is a default subnet in our default 16
VPC for every single availability zone in that region and so the North Virginia 17
region has six availability zones so there will be six subnets so if we open 18
that up if I just do it in another screen we will see here that we've got 19
six subnets there and we can see the availability zones that they're in going 20
to 1a all the way through to 1f, so there's six availability zones there now 21
just one thing about availability zone so they've got an ID here so we've got 22
1a 1b 1c now that can change and what I mean by that is that AWS try and 23
balance the availability zone so they are trying to 24
make sure that they have the same amount of capacity or spare capacity in each 25
availability zone and so if everyone's selecting us east 1a then US East 1a 26
is going to get full very quickly and so your us East 1a will be different 27
to someone else's accounts us East 1a, they're not necessarily the same it 28
depends on which availability zone is being more overloaded than the other and 29
then they'll change that for the next account, okay so we just jump back into 30
the VPC management console again now we can also see that we've got 31
a route table already defined for us and we've got an Internet gateway which has 32
been attached to the default VPC now if you remember from the lecture we need to 33
have an Internet gateway attached to our VPC and we need to have our route from 34
our subnet through to that Internet gateway so let's have a look at that so 35
first of all have a look at the internet gateway ok so there we can see that 36
Internet gateway and it's attached to our default VPC so let's have a look at 37
the route 38
okay so there's our out table we just click on it to expand it okay what we've 39
got there is a route so we've got two entries here the first one is for local 40
traffic within our VPC so this CIDR block here and don't be too concerned if 41
you don't understand what a CIDR block is because that is associate level stuff 42
as a cloud practitioner you don't need to know that but that there will be the 43
same as our VPC so if we click on our VPC we will see that that 172 31 0 0 is 44
the same here so all traffic local traffic in our VPC is allowed now we 45
also have an Internet gateway there and we have traffic to the wider Internet is 46
allowed or is it routed through to that Internet gateway and so we look at that 47
and we can see that that will be the Internet gateway that is attached or 48
then it's attached to our VPC so we just open that up again and then we can 49
see so that Internet gateway we have a route for the wider Internet traffic to 50
the Internet gateway but we also need to have an association between this route 51
table and a subnet and that way we can have a route from our internet gateway 52
through to our subnet itself and so we look here on subject associations we can 53
see that we have six subnet associations and that is for the six subnets in each 54
availability zone so all traffic within any of those six subnets those default 55
substance subjects will be routed if they're for the wider Internet will be 56
routed to that Internet gateway there is a note here that is you do not have any 57
subnet associations so we haven't created our own specific subject 58
associations but AWS has created these ones for us and those have been implicitly 59
associated for us so just jumping back into the VPC 60
dashboard now we also have a network access control list here and so we can 61
click on that and have a look at that so again we'll click on it to have a look 62
at it so we have inbound and outbound rules and so that is allowing all 63
traffic okay so all traffic is allowed and then we've got a wild card here for 64
denied so anything that is not defined will be denied so that is a peculiarity 65
of network access control list so by default this will be here to deny 66
everything and so we have to specifically allow a rule to allow 67
traffic in so we have inbound and outbound rules the reason we have 68
inbound and outbound rules is because a network access control list is stateless 69
so just because a request comes in doesn't necessarily mean that the the 70
return is allowed back out again so we need to define both inbound and outbound 71
rules for that because it is state less okay so the best way to learn about this 72
is to launch a an instance and play around with it and see what happens so 73
if we click on launch ec2 instances here that will take us to the ec2 console and 74
it will automatically start the launch process for so just click on that and 75
then we're jumping into the ec2 console and we'll select an AMI so we'll select 76
a marketplace WordPress AMI, that will be fine and continue so I'm just 77
going to race through this quite quickly because we've already launched a 78
WordPress application in the past we know how to do this so I'm just going to 79
select the free tier eligible one now let's have a look at this so we didn't 80
go too much in to this when we launched a wordpress 81
application before but let's have a look at this so we've got our VPC and so 82
we've only got one of them so we're going to got one to select from and that 83
is our default VPC we can select a subnet to launch into so I'm going to 84
just select us to east at one a but it doesn't really matter and auto assign a 85
public IP now if you remember I'm going to do enable on here if you remember we 86
need to have a public IP address for our ec2 server so that it can be found on 87
the wider Internet if we don't have a public IP address it cannot be found on 88
the wider Internet, now a placement group that is just were we can launch 89
instances into a high speed group with high speed network between them we don't 90
need to worry about that, now IAM role if you remember in the 91
IAM lab we created a role for ec2 we could attach an IAM role here but we 92
won't worry about that now we don't need that and shutdown behaviour we just have 93
to stop we won't worry about terminating it actually we will terminate it 94
actually and protect against accidental determination we don't need to worry 95
about anything there so we'll leave everything as it is and we'll go to add 96
storage and we'll leave that as it is again we're going to add a tag and just 97
call it the name and we're going to call this one public or public IP so this 98
one's going to have a public IP address and we're going to launch one that 99
doesn't have a public IP address now we have a security group that has already 100
been created for us by this iami or it's already defined within this ami so what 101
we what we've got here is that is it as you remember a security group is 102
associated to an instance it operates at the instance level it's a firewall that 103
operates on that instance it's unlike a network access control list that 104
operates at the subnet level okay so the first entry there we've got is 105
SSH so if we want to connect into this ec2 instance into the Linux operating 106
system we can do that through SSH it's a little bit advanced right now but we can 107
do that if we if we would like to and that will be on port 22 so normally if 108
we're going to be connecting directly into this instance we would select the 109
source as being your IP so you select my IP and it would lock it to your IP 110
address we also need to allow traffic coming in from for HTTP because it is a 111
website so there we've got we're allowing traffic all traffic from the 112
wider Internet is going to be allowed and also we've got SSL traffic here for 113
port 443 and so that's what's going to be allowed in and allowed out and 114
nothing else will be allowed unless it's defined here in this security group so 115
let's review and launch and launch so I don't have a key pier so I'm going to 116
create a new key pin and I'll make sure that I download that key pin okay 117
okay I'm just going to launch that instance okay so that has finished 118
launching and I'll just click on few instances and I'm going to create 119
another instance but this one's not going to have a public IP address so 120
again we select the same one we select a word press ok or just very quickly go 121
through this select one that's on the free tier okay so I'm you're going to 122
leave everything as it was before I'll launch this one into maybe longitude to 123
one a as well now I'm going to disable assigning of a public IP address so this 124
won't have a public IP address but other than that it will be identical to the 125
other one so I'll leave that as it is and storage will be the same I'll add a 126
tag for this and we're going to call this one no IP believe the security 127
group exactly the same as the other one and then we'll launch this one as well 128
okay so that one's launched so we'll just give it a bit of time to wait for 129
all these status checks to be done and we just click on refresh to see whether 130
how they going okay so they're pretty well up and running now those two 131
instances so we've got here public IP nope no IP so if you remember we we 132
defined a tag for name with a capital n if you use lowercase n it wouldn't have 133
worked but a capital in there it will come up in this list here so we've got 134
here no IP and public IP so this one with a public IP that we defined will 135
have a public DNS so we just select that and have a look at it and there we go 136
we've got our WordPress site up and running just the same as as we had last 137
time that we did it and we've also got our public IP address here so select 138
that and go to it the same thing again but when we go to the one that doesn't 139
have a public IP address there's no public DNS and there's no public IP 140
address so there's no way of finding this on the wider Internet it's 141
impossible to find it so if we go to this private DNS and we try and navigate 142
to that it's just going to take us to a Google search it's it's just not going 143
to work and if we go to this private IP address here what's going to happen is 144
that your computer is going to try and find it on your private network and it's 145
not going to find it it's it's a private IP address so just the same as you have 146
computers connected to your private network 147
it'll be looking for this server that is connected to your private network and 148
it's actually not connected so it's just going to hang there forever and so that 149
you can see it doesn't work and so that's one why you need to have a public 150
IP address so before we get billed I'm just going to terminate that and 151
terminate okay so that's shutting down now so let's have a look at this now and 152
we'll have a bit of a play around with the VPC networking and see if we can get 153
this thing play up on us okay so back in the VPC 154
dashboard what I want to do now is show you a little bit about Route tables and 155
the importance of having a route or a route table associated to the subnet 156
that your ec2 instance is launched into and having an entry in that route table 157
that defines around between that subnet and an Internet gateway and without that 158
you're not going to be able to connect to the wider Internet so just go into 159
this route tables part here and click on that route table and there we can see is 160
our default route table which has got local traffic defined for our VPC but 161
it's also got traffic defined there for the wider internet going to our internet 162
gateway so what I'm going to do now is I'm going to delete that now a word of 163
warning this is a hands-on session where I'm playing around with a few things and 164
showing you how things work I don't expect you to do this yourself it's not 165
a hands-on lab the reason I haven't done this as a hands-on lab because or as a 166
lab rather than a hands-on session is because when you play around with your 167
default VPC you can break it and if you delete it 168
it's you'd have to bring up AWS to support to get it back again so just be 169
careful when you're when you're doing it make sure you follow on very carefully 170
and not delete your your VPC and and not get it back again so what I'm going 171
to do is I'm going to remove that entry so all of a sudden the router in our 172
VPC doesn't know how to direct traffic for the wider internet it only knows how 173
to do it for local traffic within the VPC so if we go to the ec2 management 174
console and if we again go to that public DNS for our public IP website and 175
we open that up okay so it's still there I forgot to click on save okay so now 176
saving that router table so now if I do that again because I have saved the rare 177
table and we go to that again we will find that it just hangs there 178
forever and eventually times out now if we put 179
that back again somebody's going to click on edit I'm going to put it back 180
on again and I'll select that Internet gateway so all of a sudden we've got our 181
wider Internet traffic going to our internet gateway we know how to route 182
that now and I'll click on save this time okay so that's saved and now if we 183
go to that DNS again we've got our website back again which is great so 184
when you're using VPC or your launch and ec2 instance and you don't have your 185
word your your server up and running for whatever reason your WordPress 186
application or whatever it is few things you can check make sure that you've got 187
a public IP address that's a no-brainer and make sure that you've got an 188
Internet gateway you've got a route table associated with the subnet that 189
you've launched your ec2 instance into and make sure there's a route table 190
entry that defines how to route traffic between that subnet and the internet 191
gateway so that's all I'll have to tell you for now about VPC I hope you've 192
learned a lot and I look forward to seeing you in hang on before we do that 193
we have to clean this up so before I say goodbye let's clean this up because we 194
don't want to get a bill so again we'll go into here into actions instance state 195
and terminate yes terminate very important make sure we clean up after 196
ourselves so now I'll say goodbye and I'll look forward to seeing you in the 197
next one