8. Applied Networking for DevOps

Networking for DevOps

01

Notes

Chap 8 Networking in the Cloud

SSH

02

Notes

Secure Shell is a cryptographic network protocol that lets you securely connect to and control a remote machine over an unsecured network You have a server running somewhere in a data centre could be Mumbai, Singapore, Virginia, anywhere. You want to run commands on that server. Install software, check logs, configure a service, deploy your application. You are not physically sitting in front of that server. You are at your laptop. SSH gives you a secure terminal session on that remote machine. Everything travels encrypted. Your commands going to the server encrypted. The server's output coming back encrypted. Anyone intercepting the traffic sees nothing useful.

SSH

03

Notes

SSH runs on port 22 by default a number worth remembering because you will configure firewall rules to allow SSH access constantly in cloud environments. SSH supports two ways to authenticate password-based and key-based. Key-based is universal standard because passwords can be brute-forced. Key-based authentication uses a pair of cryptographic keys - a private key and a public key. The public key goes on the server in a file called authorized_keys. It is not secret. The private key stays on your machine in your ~/.ssh/ directory. It is secret. Never share it. Never put it in a repository. Treat it like a password you can never change.

SSH

04

Notes

When you connect SSH uses your private key to prove your identity mathematically, without ever sending the key over the network. The server verifies using the public key. If they match access granted. No password needed. SSH supports tunneling, allowing traffic to travel securely through an encrypted SSH connection. One common use of SSH tunneling is port forwarding, where traffic from one port is securely forwarded to another machine or service. Using tunnelling you securely access resources that have no public exposure.

Virtual Private Cloud

05

A diagram showing a Cloud Provider containing three isolated blocks labeled VPC 1, VPC 2, and VPC 3.

Notes

When applications are deployed in the cloud, they often run on infrastructure that is shared by many customers. To ensure security and separation, cloud providers create a dedicated private network for each customer. This private network logically isolates a customer’s resources from those of other customers, helping prevent unauthorized access and providing a secure environment for running applications and services. Cloud Provider VPC 1 VPC 2 VPC 3

AWS VPC

06

A diagram showing an AWS environment containing three distinct VPCs: Development, Staging, and Production.

Notes

A Virtual Private Cloud (VPC) is a private, isolated network within AWS where you can launch and manage your cloud resources. It gives you complete control over your networking environment like Subnetting Routing Firewalls (NACLs, Security Grps) Gateways Each AWS account can have multiple VPCs.

AWS Regions

07

Notes

A Region is a geographic area where a cloud provider operates multiple data centers Each Region contains multiple Availability Zones (AZs). Regions help organizations meet data residency, compliance, and latency requirements. Cloud providers operate Regions in different parts of the world so customers can deploy applications closer to their users. When choosing a Region, consider factors such as latency, compliance, service availability, and cost. AWS Global Infrastructure

AWS Regions & VPC

08

A diagram of an AWS environment comparing two regions, ap-south-1 and us-east-1, showing a Virtual Private Cloud (VPC) located entirely within ap-south-1.

Notes

Each VPC exists entirely within a single AWS Region. This regional limitation means that resources within a VPC are confined to that specific region.

AWS Availability Zones

09

Notes

An Availability Zone (AZ) is one or more data centers within a cloud region. Each AZ has its own power, networking, and infrastructure. Multiple AZs in a region are connected through high-speed, low-latency networks. Communication between AZs is encrypted and secure. If one AZ experiences an outage, applications can continue running in another AZ. Availability Zones are located far enough apart to reduce impact of local disruptions, but close enough (typically within 100 km / 60 miles) to provide fast and reliable communication between them.

AWS Availability Zones

10

A diagram representing the AWS cloud containing the ap-south-1 region, which consists of three availability zones labeled az-1, az-2, and az-3.

Notes

ap-south-1 az-1 az-2 az-3

AWS Availability Zones & VPC

11

A diagram showing a Virtual Private Cloud (VPC) spanning three availability zones (az-1, az-2, az-3) within the AWS region ap-south-1.

Notes

ap-south-1 VPC az-1 az-2 az-3 Virtual Private Cloud

Types of VPC

12

A diagram of an AWS environment in the region ap-south-1 depicting both a Default VPC and a Custom VPC.

Notes

AWS provides two types of Virtual Private Clouds (VPCs): • Default VPCs: Automatically created in every region when you open an AWS account. They include preconfigured settings designed for quick access and straightforward deployment. • Custom VPCs: Require manual configuration of settings such as internet connectivity, subnets, and security policies.

Default VPC

13

Notes

Every region has one default VPC. The default VPC is assigned a /16 CIDR block, specifically 172.31.0.0/16, offering 65,536 IP addresses. For each availability zone in a region, a default subnet is created. Subnets are typically configured with a /20 mask. An Internet Gateway is automatically attached to the default VPC which ensures that every subnet within the default VPC is public. Default security groups and Network Access Control Lists (NACLs) are set up to manage and control traffic.

AWS Subnets

14

Notes

In AWS, a subnet is a contiguous range of IP addresses within a VPC. Each subnet resides in a Single Availability Zone (AZ) AWS supports subnet sizes from /16 (65,536 IPs) down to /28 (16 IPs). AWS reserves five IPs in each subnet. For example VPC 192.168.0.0/16 Subnet 192.168.10.0/24. 192.168.10.0 - Network Address 192.168.10.1 - VPC Router 192.168.10.2 - DNS 192.168.10.3 - AWS future Use 192.168.10.255 - Broadcast Address

AWS VPC and Subnets

15

A diagram illustrating an AWS VPC with CIDR block 192.168.0.0/16 in the ap-south-1 region, divided into Availability Zone 1 containing Subnet 1 (192.168.0.0/24) and Availability Zone 2 containing Subnet 2 (192.168.1.0/24).

Notes

ap-south-1 192.168.0.0/16 Virtual Private Cloud Availability Zone 1 Subnet 1 192.168.0.0/24 Availability Zone 2 Subnet 2 192.168.1.0/24

Types of Subnets

16

Architecture diagram of an AWS VPC in region ap-south-1 showing two Availability Zones with a public subnet routing through an Internet Gateway and hosting a NAT Gateway that connects to a private subnet in another zone.

Notes

ap-south-1 VPC Virtual Private Cloud Availability Zone 1 Subnet 1 Public NAT Gateway Availability Zone 2 Subnet 2 Private Internate Gateway

VPC Routing

17

A route table entry snippet showing Destination as 10.10.0.0/16 and Target as Local.

Notes

When you create a VPC, it automatically comes with a local router. This local router allows resources within the VPC to communicate with each other. Every VPC also includes a main route table by default. The main route table contains a route for the VPC’s CIDR block with the target set to local. This means that traffic destined for resources inside the VPC is routed internally through the local router. Custom route tables enable distinct public/private routing behaviors.

Internet Gateway

18

Notes

By default, all newly created subnets are private. An Internet Gateway allows resources in a VPC to communicate with the internet. There is only one Internet Gateway per VPC. Steps to connect subnet to internet 1. Create an Interet Gateway 2. Attach IGW to VPC 3. Create a Custom Route Table 4. Associate subnet to Route Table. 5. Add a default Route in Route Table 0.0.0.0/0 and point to the IGW

NAT Gateway

19

Notes

Private subnet instances often need internet access for: OS Updates, Package Downloads, Accessing external APIs and Services NAT Gateways allows subnets to talk to the internet but the connection must be initiated from within the VPC. It requires an Internet Gateway on the VPC for upstream connectivity. Each NAT Gateway requires an Elastic IP. Ensure you have available Elastic IPs or allocate new ones before deployment. Uses Elastic IP for consistent public IPs. Deploy a NAT Gateway in each AZ where you have private subnets.

Firewalls

20

Notes

A firewall monitors traffic flows and only allows connections matching predefined rules. Each rule controls: Inbound: Connections to your resource Outbound: Connections from your resource Stateless firewalls Treats inbound and outbound traffic independently. You must explicitly allow both directions for every connection. Stateful firewalls Tracks connection state. Once you allow an incoming request, the outbound response is automatically permitted (and vice versa).

Network ACLs

21

A diagram of a Virtual Private Cloud containing ACLs connected to a Public Subnet and a Private Subnet.

Notes

NACLs act as firewalls at the subnet level. They are stateless. So we must configure rules for both ingress (incoming) and egress (outgoing) traffic. They do not filter traffic between resources within the same subnet.

Security Groups

22

A diagram illustrating a Virtual Private Cloud governed by ACLs, containing a Public Subnet with a compute instance protected by a firewall and a Private Subnet with a database protected by a firewall.

Notes

Security groups act as individualized firewalls for AWS resources such as EC2 instances, load balancers, and RDS databases. They are stateful, meaning you need to define only the initial traffic direction; the return traffic is allowed automatically. You can attach multiple security groups to a single resource or use one security group across multiple resources VPC Virtual Private Cloud ACLs Public Subnet Private Subnet

AWS Elastic Load Balancers

23

An illustration of a person balancing between two weighing scales, with arrows directing traffic from a cloud at the top down to three server racks below.

AWS Elastic Load Balancers

24

Notes

ELB Acts as a single entry point for client requests. Distributes incoming traffic across multiple servers. Prevents one server from becoming overloaded. Improves Availability Scalability Reliability AWS offers two main ELB types.

Application Load Balancer

25

Notes

Operates at Layer 7 (HTTP/HTTPS). Supports advanced request routing: Path-based routing (e.g., /api vs /images) Host-based routing (route by domain/subdomain) Query-string-based routing Can modify HTTP headers before forwarding requests. Supports multiple load balancing algorithms like Round robin, least outstanding requests, weighted random.

Application Load Balancer

26

A network architecture diagram showing an AWS Region containing a Virtual Private Cloud (VPC) spanning Availability Zone 1 and Availability Zone 2, each containing a public subnet.

Notes

Region VPC Virtual Private Cloud Availability Zone 1 Public Subnet 1 Availability Zone 2 Public Subnet 2

Application Load Balancer

27

An architectural diagram depicting a Region and a Virtual Private Cloud connected via an Internet Gateway to two Availability Zones, each containing a public subnet with a server.

Notes

Region VPC Virtual Private Cloud Internate Gateway Availability Zone 1 Availability Zone 2 Public Subnet 1 Public Subnet 2 Server 1 Server 2

Application Load Balancer

28

An architecture diagram showing a Region containing a Virtual Private Cloud (VPC) with an Internet Gateway routing traffic to Server 1 in Public Subnet 1 of Availability Zone 1 and Server 2 in Public Subnet 2 of Availability Zone 2.

Notes

Region Virtual Private Cloud Internate Gateway Availability Zone 1 Availability Zone 2 Public Subnet 1 Public Subnet 2 Server 1 Server 2

Application Load Balancer

29

An architecture diagram illustrating an AWS Region enclosing a Virtual Private Cloud with an Internet Gateway routing traffic to two Availability Zones, each containing a public subnet with a server.

Notes

Region VPC Virtual Private Cloud Internate Gateway Availability Zone 1 Availability Zone 2 Public Subnet 1 Public Subnet 2 Server 1 Server 2

Application Load Balancer

30

Notes

Region VPC Virtual Private Cloud Internate Gateway ALB- L7 AZ 1 Subnet 1 Server 1 AZ 2 Subnet 2 Server 2

Network Load Balancer

31

Notes

Operates at Layer 4. Extremely fast with very low latency. Protocol support: TCP, UDP, TLS, and now QUIC Provides Static IP Addresses. Supports both IPv4 and IPv6 targets Supports weighted target groups - distribute traffic unevenly across targets by assigned weight

Network Load Balancer

32

Notes

Region VPC Virtual Private Cloud Internate Gateway NLB- L4 AZ 1 Subnet 1 Server 1 AZ 2 Subnet 2 Server 2

VPC Peering

33

Notes

Every VPC is an isolated private network. Resources inside one VPC cannot communicate with another VPC by default. VPC Peering establishes a private network connection between two VPCs, allowing instances to communicate as if they were on the same network. We can pair VPCs within the same AWS Region VPCs across different regions VPCs in separate AWS accounts

VPC Peering - Single Region

34

Architecture diagram illustrating a VPC Peering connection established between Virtual Private Cloud - 1 and Virtual Private Cloud - 2 within a single AWS Region.

Notes

Region Virtual Private Cloud - 1 VPC Peering Virtual Private Cloud - 2

VPC Peering - Cross Region

35

VPC Peering

36

Notes

Steps to peer VPCs Request Peering Accept Peering Configuring Route Tables VPC Peering is non-transitive. If VPC1 peers with VPC2, and VPC2 peers with VPC3, VPC1 cannot reach VPC3 through VPC2. Each pair requires its own peering connection.

VPC Peering

37

A diagram showing a fully connected mesh network on the left, and a full mesh peering connection among four VPCs (VPC-1, VPC-2, VPC-3, and VPC-4) on the right.

Notes

What if our organization has 10 VPCs? Every pair needs its own peering connection.

Transit Gateway

38

Notes

A Transit Gateway is a Layer 3 virtual router that connects multiple VPCs using a central hub. We attach each VPC to the Transit Gateway. So all VPCs communicate through the hub, with automatic transitive routing.

Transit Gateway Attachment

39

A diagram illustrating a VPC connected across three Availability Zones (AZ-1, AZ-2, AZ-3) via Subnet-A, Subnet-B, and Subnet-C to TGW Attachments leading to a Transit Gateway.

Notes

AWS requires one subnet from each Availability Zone. If your VPC uses AZ-1, AZ-2, and AZ-3, choose one subnet from each AZ. These subnets are used by the Transit Gateway to route traffic.

Transit Gateway - Intra Region

40

A diagram showing two Transit Gateways connected via intra-region peering inside a single region, with each gateway connected to four VPCs.

Notes

Region Intra Region Peering

Transit Gateway - Cross Region

41

A network diagram illustrating Cross Region Peering between two AWS Transit Gateways, each connecting multiple VPCs within Region 1 and Region 2 respectively.

Notes

Region 1 Region 2 Cross Region Peering

Applied Networking for DevOps

42

Notes

Networking in the Cloud SSH Virtual Private Cloud Subnets in VPC Virtual Machines (EC2) Route Tables Internet & NAT Gateway Security Group and NACL VPC Peering & Transite Gateway In the next bootcamp, we’ll dive into the world of Linux.