Cloud networking: VPCs and load balancers
Renting servers in the cloud still means building a network, only now it is drawn in software. Build one VPC step by step: a private address range cut into a public and a private subnet, route tables that decide which is which, an internet gateway and a NAT gateway, two filters (security groups and a network ACL), a load balancer that shares visitors between servers and skips a sick one, and a VPN that brings the office in.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01What makes a subnet 'public'?
Both subnets use private ranges from the VPC. The only difference is the default route: the public one points at the internet gateway, the private one at the NAT gateway.
02A private server needs to download an update. What lets it reach the internet without letting the internet reach it?
The NAT gateway swaps the server's private source address for its own public one and lets the replies back. A new connection from outside matches nothing and is dropped.
03Why must a network ACL allow outbound TCP to ports 1024-65535, when a security group needs no such rule?
A security group is stateful and lets replies of an allowed connection out automatically. A network ACL judges every packet on its own, so the replies to clients' temporary ports must be allowed explicitly.
04Server B stops answering its health checks. What does the load balancer do?
Health checks are how the balancer knows who can take traffic. It stops using B until B passes its checks again.
05The office (192.168.1.0/24) is joined to the VPC (10.0.0.0/16) by a VPN. Why does it matter that the ranges do not overlap?
Routing chooses a path by destination address. If both sides use the same addresses, a packet for one of them is ambiguous, so joined networks need separate ranges.
Glossary
- VPC
- Virtual private cloud: your own private network inside a cloud provider, with an address range you choose (Azure calls it a virtual network).
- Subnet
- A smaller address range cut out of the VPC, for one group of machines, such as the public or private subnet.
- Route table
- The list each subnet follows: for each destination range, where packets go next. The most specific range wins.
- Internet gateway
- The VPC's door to the internet; it maps public addresses to private ones for things in a public subnet.
- NAT gateway
- NAT is network address translation. A NAT gateway is a gateway in the public subnet that lets private servers open connections out, under its own public address, but lets nobody start one in.
- Security group
- A stateful firewall attached to each server: it lists what may come in, and replies go out automatically.
- Network ACL
- A stateless filter at a subnet's edge with numbered allow and deny rules, read lowest number first.
- Load balancer
- A service that spreads incoming requests over several servers and uses health checks to skip ones that fail.
Notes and sources
- 10.0.0.0/16 and 192.168.1.0/24 are RFC 1918 private ranges; 192.0.2.7, 203.0.113.20, 203.0.113.30, 198.51.100.80 and 198.51.100.1 are RFC 5737 documentation addresses. Port numbers picked by the load balancer, NAT gateway and clients are illustrative.
- The terms are the common ones. AWS and Google Cloud say VPC, Azure says virtual network; Google Cloud has no separate internet gateway object (a default route to the internet does the job); Azure’s nearest thing to a security group is a network security group. The ideas are the same.
- Clouds reserve a few addresses in every subnet for their own use (on AWS the first four and the last), so not every address in a range can be given to a server.
- The network ACL allows replies to ports 1024-65535 because operating systems pick their temporary ports from different ranges (IANA suggests 49152-65535, Linux uses 32768-60999).
- With IPv6 there is usually no NAT (NPTv6 and NAT64 exist for special cases): servers can have public addresses, and an outbound-only gateway (AWS calls it an egress-only internet gateway) plays the NAT gateway’s role of letting connections out but not in.
- Here the load balancer ends the HTTPS connection and talks plain HTTP to the servers inside the VPC; many setups encrypt that hop too.
- NIST SP 800-145: The NIST Definition of Cloud Computing
- RFC 1918: Address Allocation for Private Internets
- RFC 3022: Traditional IP Network Address Translator
- RFC 4301: Security Architecture for the Internet Protocol (IPsec)
- AWS: How Amazon VPC works
- AWS: Control subnet traffic with network ACLs
- Google Cloud: VPC networks
- Microsoft Azure: What is Azure Virtual Network?
Quiz Unlocks after the last step.