Amazon VPCCIDRAdvanced~2h

AWS: Networking

Read the network, not the diagram

A VPC is four decisions stacked on each other: an address plan, a route table, a door out, and two filters that disagree about what a connection is. This is all four, drilled on configurations generated fresh — until you can be handed one you have never seen and name the line that stopped the packet.

Start this project See the modules

Modules: 5
Drills: 9
Build steps: 2
Time: ~2h

Walk out able to

Take a VPC you did not build and say which packets get through, which do not, and which single line decided it.

What you drill

Blocks and what is left

CIDR arithmetic, and the five addresses you never get.

Tables and routes

Which table governs a subnet, and which row wins.

Gateways and NAT

Which way a thing can talk, and which door it uses.

Groups versus ACLs

Stateful, stateless, rule numbers, and the reply.

The pitch

What you practise, and what you leave with

A reading speed, plus an address plan for a two-zone workload with every subnet counted by hand.

You will practise

Subnet arithmetic and the reserved five
Route tables and longest-prefix match
Internet gateways, NAT, and reachability
Security groups, ACLs, and rule order

Afterwards you can

Say how many addresses a subnet really gives
Pick the winning route out of a real table
Decide whether a reply gets back
Name the rule number that stopped it

Modules

5 modules, 17 items

Lessons explain one idea. Drills repeat it until it sticks. Build steps make something that exists afterwards.

1
Carve the address space
~33 min
Size a VPC and its subnets, and count what is actually left to hand out.
- LessonWhy read the configuration5 min
- LessonSize a VPC before you build in it9 min
- DrillCount the addresses you actually get10 min
- DrillCut a block into equal subnets9 min
2
Send it somewhere
~19 min
Find the table that governs a subnet, then pick the route that wins inside it.
- DrillFind the table that governs the subnet8 min
- DrillPick the route that wins11 min
3
The two doors out
~21 min
Decide which way a thing can talk to the internet, and which door it would use.
- DrillDecide which way it can talk10 min
- DrillFind the fault in the NAT path11 min
4
Groups, lists, and the reply
~33 min
Decide a reply against a filter that remembers, and against one that does not.
- DrillDecide whether the reply gets back13 min
- DrillName the rule that decided it10 min
- DrillRead a rule that names a group10 min
5
Find the one that broke
~39 min
Diagnose an unfamiliar VPC without help, then plan an address space of your own.
- LessonDiagnose a batch job with no internet6 min
- LessonDiagnose HTTP working and HTTPS not5 min
- LessonDiagnose a worker that cannot connect5 min
- LessonDiagnose a request with no response5 min
- Build stepLay out six subnets and count them11 min
- Build stepAttach the tables, and leave room7 min