---
title: 8. Applied Networking for DevOps
collection: computer networks
author: Akash Kadlag
updated: 2026-09-17
source: https://docs.chaicode.com/networking/networking-for-devops
---

# 8. Applied Networking for DevOps

![Networking for DevOps](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/d0408198f1830b6a621e794812307fe934d874bb71ccc3382a349d7018fa4b72.png)

Networking for DevOps — Chap 8
Networking in the Cloud

![SSH](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/b51b23395122519e11a4a90ff97dcbc6fccea64bf13719661e8e6e1eb8e1d9a3.png)

SSH — Secure Shell is a cryptographic network protocol that lets you securely connect to and control a remote machine over an unsecured network
You have a server running somewhere in a data centre could be Mumbai, Singapore, Virginia, anywhere. You want to run commands on that server. Install software, check logs, configure a service, deploy your application.
You are not physically sitting in front of that server. You are at your laptop. SSH gives you a secure terminal session on that remote machine.
Everything travels encrypted. Your commands going to the server encrypted. The server's output coming back encrypted. Anyone intercepting the traffic sees nothing useful.

![SSH](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/0a5aef2162ee381ff618b57f9869b8b9d90ef124ddc0423fd1c9b8c4c9ac3c65.png)

SSH — SSH runs on port 22 by default a number worth remembering because you will configure firewall rules to allow SSH access constantly in cloud environments.
SSH supports two ways to authenticate password-based and key-based. Key-based is universal standard because passwords can be brute-forced.
Key-based authentication uses a pair of cryptographic keys - a private key and a public key.
The public key goes on the server in a file called authorized_keys. It is not secret.
The private key stays on your machine in your ~/.ssh/ directory. It is secret. Never share it. Never put it in a repository. Treat it like a password you can never change.

![SSH](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/53f6d1c97b7fba9227bf0afcf63d4a7b4d249389716b0e298a8afef46a93e238.png)

SSH — When you connect SSH uses your private key to prove your identity mathematically, without ever sending the key over the network. The server verifies using the public key. If they match access granted. No password needed.
SSH supports tunneling, allowing traffic to travel securely through an encrypted SSH connection. One common use of SSH tunneling is port forwarding, where traffic from one port is securely forwarded to another machine or service.
Using tunnelling you securely access resources that have no public exposure.

![A diagram showing a Cloud Provider containing three isolated blocks labeled VPC 1, VPC 2, and VPC 3.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/00e10930cf6569cd0d330e58d8eb57b3ce1acde0eeceb5404803cafbb30647fd.png)

Virtual Private Cloud — When applications are deployed in the cloud, they often run on infrastructure that is shared by many customers.
To ensure security and separation, cloud providers create a dedicated private network for each customer.
This private network logically isolates a customer’s resources from those of other customers, helping prevent unauthorized access and providing a secure environment for running applications and services.
Cloud Provider
VPC 1
VPC 2
VPC 3

![A diagram showing an AWS environment containing three distinct VPCs: Development, Staging, and Production.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/ffc9fa744631021f575683ae066b221b99d524f7471040378fd906559b34de05.png)

AWS VPC — A Virtual Private Cloud (VPC) is a private, isolated network within AWS where you can launch and manage your cloud resources.
It gives you complete control over your networking environment like
Subnetting
Routing
Firewalls (NACLs, Security Grps)
Gateways
Each AWS account can have multiple VPCs.

![AWS Regions](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/62816e1ce12ffe3d62b0e1e9c382156f0a122a719cbc936cda62cb6f8348bedb.png)

AWS Regions — A Region is a geographic area where a cloud provider operates multiple data centers
Each Region contains multiple Availability Zones (AZs).
Regions help organizations meet data residency, compliance, and latency requirements.
Cloud providers operate Regions in different parts of the world so customers can deploy applications closer to their users.
When choosing a Region, consider factors such as latency, compliance, service availability, and cost.
AWS Global Infrastructure

![A diagram of an AWS environment comparing two regions, ap-south-1 and us-east-1, showing a Virtual Private Cloud (VPC) located entirely within ap-south-1.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/c6e36340462e1cd8d9db21af7d44afaf5f18b7976779a3ed3f4b0b3edb31fc24.png)

AWS Regions & VPC — Each VPC exists entirely within a single AWS Region.
This regional limitation means that resources within a VPC are confined to that specific region.

![AWS Availability Zones](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/9c30ff48f5ea289885557e568d86ce2c7c0e486e8b13cc61b99180ad8994ce88.png)

AWS Availability Zones — An Availability Zone (AZ) is one or more data centers within a cloud region.
Each AZ has its own power, networking, and infrastructure.
Multiple AZs in a region are connected through high-speed, low-latency networks.
Communication between AZs is encrypted and secure.
If one AZ experiences an outage, applications can continue running in another AZ.
Availability Zones are located far enough apart to reduce impact of local disruptions, but close enough (typically within 100 km / 60 miles) to provide fast and reliable communication between them.

![A diagram representing the AWS cloud containing the ap-south-1 region, which consists of three availability zones labeled az-1, az-2, and az-3.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/4566bcc05839c38c741bb72cc546597e1a43e56b1765ba7c79f7b9bec679f875.png)

AWS Availability Zones — ap-south-1
az-1
az-2
az-3

![A diagram showing a Virtual Private Cloud (VPC) spanning three availability zones (az-1, az-2, az-3) within the AWS region ap-south-1.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/0d5e88e448ddc594c913c39aa9a3806658680bcc7bba0db23b6b2334c7ba514f.png)

AWS Availability Zones & VPC — ap-south-1
VPC
az-1
az-2
az-3
Virtual Private Cloud

![A diagram of an AWS environment in the region ap-south-1 depicting both a Default VPC and a Custom VPC.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/bcc23b7f9d4ad0fbaec7b6dd29a0bf7c321d34d29360778caf4fc1607606c473.png)

Types of VPC — AWS provides two types of Virtual Private Clouds (VPCs):
• Default VPCs: Automatically created in every region when you open an AWS account. They include preconfigured settings designed for quick access and straightforward deployment.
• Custom VPCs: Require manual configuration of settings such as internet connectivity, subnets, and security policies.

![Default VPC](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/a32d3cea2068e846eeaba97cd8bb8be3cf56ce9744e0d949d22a46be9a21d8ce.png)

Default VPC — Every region has one default VPC.
The default VPC is assigned a /16 CIDR block, specifically 172.31.0.0/16, offering 65,536 IP addresses.
For each availability zone in a region, a default subnet is created. Subnets are typically configured with a /20 mask.
An Internet Gateway is automatically attached to the default VPC which ensures that every subnet within the default VPC is public.
Default security groups and Network Access Control Lists (NACLs) are set up to manage and control traffic.

![AWS Subnets](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/c204479f0c18aa9ad5856bb8989db4ec680ba0a24f936fd3536be9fb322f32a8.png)

AWS Subnets — In AWS, a subnet is a contiguous range of IP addresses within a VPC.
Each subnet resides in a Single Availability Zone (AZ)
AWS supports subnet sizes from /16 (65,536 IPs) down to /28 (16 IPs).
AWS reserves five IPs in each subnet.
For example VPC 192.168.0.0/16 Subnet 192.168.10.0/24.
192.168.10.0 - Network Address
192.168.10.1 - VPC Router
192.168.10.2 - DNS
192.168.10.3 - AWS future Use
192.168.10.255 - Broadcast Address

![A diagram illustrating an AWS VPC with CIDR block 192.168.0.0/16 in the ap-south-1 region, divided into Availability Zone 1 containing Subnet 1 (192.168.0.0/24) and Availability Zone 2 containing Subnet 2 (192.168.1.0/24).](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/1fc679d1ae0e9a0f5b925d996562aba982604e09e753cbc6dd7f74e0ef482c34.png)

AWS VPC and Subnets — ap-south-1
192.168.0.0/16
Virtual Private Cloud
Availability Zone 1
Subnet 1
192.168.0.0/24
Availability Zone 2
Subnet 2
192.168.1.0/24

![Architecture diagram of an AWS VPC in region ap-south-1 showing two Availability Zones with a public subnet routing through an Internet Gateway and hosting a NAT Gateway that connects to a private subnet in another zone.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/71e860963a16f3c084035b333168b075662ce6af8eacd16c29b65a5999d42e7e.png)

Types of Subnets — ap-south-1
VPC
Virtual Private Cloud
Availability Zone 1
Subnet 1
Public
NAT Gateway
Availability Zone 2
Subnet 2
Private
Internate Gateway

![A route table entry snippet showing Destination as 10.10.0.0/16 and Target as Local.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/f1b9405553ecb8b52b90d37510f538612c5c3f002d52fcdda29abc63286bfa66.png)

VPC Routing — When you create a VPC, it automatically comes with a local router.
This local router allows resources within the VPC to communicate with each other.
Every VPC also includes a main route table by default.
The main route table contains a route for the VPC’s CIDR block with the target set to local.
This means that traffic destined for resources inside the VPC is routed internally through the local router.
Custom route tables enable distinct public/private routing behaviors.

![Internet Gateway](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/b78728aefb5d6c8032566fe0d1904779e049593db6ffa8bb8bcc191617642fdc.png)

Internet Gateway — By default, all newly created subnets are private.
An Internet Gateway allows resources in a VPC to communicate with the internet.
There is only one Internet Gateway per VPC.
Steps to connect subnet to internet
1. Create an Interet Gateway
2. Attach IGW to VPC
3. Create a Custom Route Table
4. Associate subnet to Route Table.
5. Add a default Route in Route Table 0.0.0.0/0 and point to the IGW

![NAT Gateway](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/8392a6e519ab215f6d9ac46b54f9889003698827dfa8c56d41786961966042ae.png)

NAT Gateway — Private subnet instances often need internet access for:
OS Updates, Package Downloads, Accessing external APIs and Services
NAT Gateways allows subnets to talk to the internet but the connection must be initiated from within the VPC.
It requires an Internet Gateway on the VPC for upstream connectivity.
Each NAT Gateway requires an Elastic IP. Ensure you have available Elastic IPs or allocate new ones before deployment.
Uses Elastic IP for consistent public IPs.
Deploy a NAT Gateway in each AZ where you have private subnets.

![Firewalls](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/4ad20a4b549717fb33a14b4984cfc6b05816f032218c6e43d28ef4a16f0e07dc.png)

Firewalls — A firewall monitors traffic flows and only allows connections matching predefined rules. Each rule controls:
Inbound: Connections to your resource
Outbound: Connections from your resource
Stateless firewalls
Treats inbound and outbound traffic independently.
You must explicitly allow both directions for every connection.
Stateful firewalls
Tracks connection state.
Once you allow an incoming request, the outbound response is automatically permitted (and vice versa).

![A diagram of a Virtual Private Cloud containing ACLs connected to a Public Subnet and a Private Subnet.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/cd88704c66de599ff1a8e32646c8661effe2286cf289aa3a6c2a08ef1ef2ed61.png)

Network ACLs — NACLs act as firewalls at the subnet level.
They are stateless. So we must configure rules for both ingress (incoming) and egress (outgoing) traffic.
They do not filter traffic between resources within the same subnet.

![A diagram illustrating a Virtual Private Cloud governed by ACLs, containing a Public Subnet with a compute instance protected by a firewall and a Private Subnet with a database protected by a firewall.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/96c7bfc43ea42458bbba5ea67a833f54094e8a6dc5211f583a5c7e846fdc5e27.png)

Security Groups — Security groups act as individualized firewalls for AWS resources such as EC2 instances, load balancers, and RDS databases.
They are stateful, meaning you need to define only the initial traffic direction; the return traffic is allowed automatically.
You can attach multiple security groups to a single resource or use one security group across multiple resources
VPC Virtual Private Cloud
ACLs
Public Subnet
Private Subnet

![An illustration of a person balancing between two weighing scales, with arrows directing traffic from a cloud at the top down to three server racks below.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/9c1395065e988733d75d47f6f27b4374afcf9dea042a4c87452ba2239d89dec6.png)

AWS Elastic Load Balancers

![AWS Elastic Load Balancers](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/95766ea0401acf39393095e928985beedbaa94dfcec6b31e6df30a32a36287dc.png)

AWS Elastic Load Balancers — ELB Acts as a single entry point for client requests.
Distributes incoming traffic across multiple servers.
Prevents one server from becoming overloaded.
Improves
Availability
Scalability
Reliability
AWS offers two main ELB types.

![Application Load Balancer](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/b19efdb9f8cc8a655feb06f1084e407e167075371711cd59c3369b74b1852453.png)

Application Load Balancer — Operates at Layer 7 (HTTP/HTTPS).
Supports advanced request routing:
Path-based routing (e.g., /api vs /images)
Host-based routing (route by domain/subdomain)
Query-string-based routing
Can modify HTTP headers before forwarding requests.
Supports multiple load balancing algorithms like Round robin, least outstanding requests, weighted random.

![A network architecture diagram showing an AWS Region containing a Virtual Private Cloud (VPC) spanning Availability Zone 1 and Availability Zone 2, each containing a public subnet.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/e3b79789a5d614bc2fc0e33be9bcecc8db959012cf2a476f0809ea66cf95bacd.png)

Application Load Balancer — Region
VPC Virtual Private Cloud
Availability Zone 1
Public Subnet 1
Availability Zone 2
Public Subnet 2

![An architectural diagram depicting a Region and a Virtual Private Cloud connected via an Internet Gateway to two Availability Zones, each containing a public subnet with a server.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/1603275a1d92a0c9f90d7b8e805ee98d555d86138c4a6fbe5b31f651b4ec4bfd.png)

Application Load Balancer — Region
VPC Virtual Private Cloud
Internate Gateway
Availability Zone 1
Availability Zone 2
Public Subnet 1
Public Subnet 2
Server 1
Server 2

![An architecture diagram showing a Region containing a Virtual Private Cloud (VPC) with an Internet Gateway routing traffic to Server 1 in Public Subnet 1 of Availability Zone 1 and Server 2 in Public Subnet 2 of Availability Zone 2.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/a349b56b2a6df4c49ccaa53979d1c0e1b9568a67424113ae1bfb0b9b2b1eb3a1.png)

Application Load Balancer — Region
Virtual Private Cloud
Internate Gateway
Availability Zone 1
Availability Zone 2
Public Subnet 1
Public Subnet 2
Server 1
Server 2

![An architecture diagram illustrating an AWS Region enclosing a Virtual Private Cloud with an Internet Gateway routing traffic to two Availability Zones, each containing a public subnet with a server.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/bd7cd095313916811b8b43a4289aae19c275b4ecce9f25720240d772e07f1269.png)

Application Load Balancer — Region
VPC Virtual Private Cloud
Internate Gateway
Availability Zone 1
Availability Zone 2
Public Subnet 1
Public Subnet 2
Server 1
Server 2

![Architecture diagram depicting an Application Load Balancer routing traffic from an Internet Gateway to two servers across different subnets and availability zones within a Virtual Private Cloud.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/e9a36429af61b702c426165626f4e4ade33e2b50d66723cbd9b93944774ec87d.png)

Application Load Balancer — Region
VPC
Virtual Private Cloud
Internate Gateway
ALB- L7
AZ 1
Subnet 1
Server 1
AZ 2
Subnet 2
Server 2

![Network Load Balancer](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/779d1781609a1b0ae373dc7d125279601868ef024fe8760102171609722e98d1.png)

Network Load Balancer — Operates at Layer 4.
Extremely fast with very low latency.
Protocol support: TCP, UDP, TLS, and now QUIC
Provides Static IP Addresses.
Supports both IPv4 and IPv6 targets
Supports weighted target groups - distribute traffic unevenly across targets by assigned weight

![Architecture diagram depicting a Network Load Balancer (NLB- L4) connected to an Internet Gateway and balancing traffic across two availability zones (AZ 1 and AZ 2) containing Server 1 and Server 2 within their respective subnets in a Virtual Private Cloud (VPC) inside a Region.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/f375cb309c8cf26a9bd0fc939f3d1aed10645b9004f8f4ce9467c52e4195a832.png)

Network Load Balancer — Region
VPC
Virtual Private Cloud
Internate Gateway
NLB- L4
AZ 1
Subnet 1
Server 1
AZ 2
Subnet 2
Server 2

![VPC Peering](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/11d9d162f56aaf67801a774a4be183f5d89a697f6d960a02b5e27f0ad09ec5b3.png)

VPC Peering — Every VPC is an isolated private network.
Resources inside one VPC cannot communicate with another VPC by default.
VPC Peering establishes a private network connection between two VPCs, allowing instances to communicate as if they were on the same network.
We can pair
VPCs within the same AWS Region
VPCs across different regions
VPCs in separate AWS accounts

![Architecture diagram illustrating a VPC Peering connection established between Virtual Private Cloud - 1 and Virtual Private Cloud - 2 within a single AWS Region.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/cc662cb9a8d29096234d855f098055ceed08a44fe37fe2c435c9b1e3ead6a19e.png)

VPC Peering - Single Region — Region
Virtual Private Cloud - 1
VPC Peering
Virtual Private Cloud - 2

![Diagram illustrating cross-region AWS VPC Peering connecting Virtual Private Cloud - 1 in Region 1 to Virtual Private Cloud - 2 in Region 2.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/5befbabfd4a24d7b3a54c4e0247717cac6ac4b777f9edf449b2c283e456f1a8f.png)

VPC Peering - Cross Region

![VPC Peering](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/4779e0039a77dcc7d47dfbe9ac99306b171e98b9688663005b0e8d6d4980da70.png)

VPC Peering — Steps to peer VPCs
Request Peering
Accept Peering
Configuring Route Tables
VPC Peering is non-transitive.
If VPC1 peers with VPC2, and VPC2 peers with VPC3, VPC1 cannot reach VPC3 through VPC2.
Each pair requires its own peering connection.

![A diagram showing a fully connected mesh network on the left, and a full mesh peering connection among four VPCs (VPC-1, VPC-2, VPC-3, and VPC-4) on the right.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/0f1354d38a2a1bb26f91602917d0d0547d4f0be87439384e46f601a076098d41.png)

VPC Peering — What if our organization has 10 VPCs?
Every pair needs its own peering connection.

![A network diagram showing five VPCs connected in a hub-and-spoke topology to a central Transit Gateway router.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/cc1795ec6ba4a821eeeb8fbb2514bf6fe52578f936287634e322cf7a28624bcc.png)

Transit Gateway — A Transit Gateway is a Layer 3 virtual router that connects multiple VPCs using a central hub.
We attach each VPC to the Transit Gateway. So all VPCs communicate through the hub, with automatic transitive routing.

![A diagram illustrating a VPC connected across three Availability Zones (AZ-1, AZ-2, AZ-3) via Subnet-A, Subnet-B, and Subnet-C to TGW Attachments leading to a Transit Gateway.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/8ed15066ddb2f05f2e7b7a31debeed908b5fd295355a48fea0752413c1f27804.png)

Transit Gateway Attachment — AWS requires one subnet from each Availability Zone.
If your VPC uses AZ-1, AZ-2, and AZ-3, choose one subnet from each AZ.
These subnets are used by the Transit Gateway to route traffic.

![A diagram showing two Transit Gateways connected via intra-region peering inside a single region, with each gateway connected to four VPCs.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/f6aee02b32415b3a0649c9f4824a7dd306466b713b37a7450526188f281014dc.png)

Transit Gateway - Intra Region — Region
Intra Region Peering

![A network diagram illustrating Cross Region Peering between two AWS Transit Gateways, each connecting multiple VPCs within Region 1 and Region 2 respectively.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/227802838b0f37c3d974691ed41c4e9b3ec854604b326b371005bdc54cf9d283.png)

Transit Gateway - Cross Region — Region 1
Region 2
Cross Region Peering

![Applied Networking for DevOps](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/302945d18a6a1b28f73cecddbda865895f1df6e878ee18d4f433b5699b183fe3.png)

Applied Networking for DevOps — Networking in the Cloud
SSH
Virtual Private Cloud
Subnets in VPC
Virtual Machines (EC2)
Route Tables
Internet & NAT Gateway
Security Group and NACL
VPC Peering & Transite Gateway
In the next bootcamp, we’ll dive into the world of Linux.