Computer Networks

Modern And Distributed Networking

Cloud Networking

a router the VPC route table

JrCodex·8 min read

Jr Codex Computer Networks Notes

Level: Advanced Prerequisites: Chapter 2: CDNs and Edge Caching Time to complete: ~20 minutes

Table of Contents

  1. The Same Concepts, Renamed
  2. The VPC
  3. Subnets, Public and Private
  4. Security Groups and Network ACLs
  5. Connecting to Other Networks
  6. Regions, Zones and Cost
  7. Summary & Next Steps

1. The Same Concepts, Renamed

The Translation Table
─────────────────────────────────────────
  PHYSICAL                CLOUD
  ─────────────────────────────────────────
  your datacentre         VPC / VNet
  a VLAN                  a subnet
  a router                the VPC route table
  a firewall              security groups + NACLs
  a NAT box               NAT gateway
  a leased line           Direct Connect /
                          ExpressRoute
  a site-to-site VPN      VPN gateway
  a load balancer         ALB / NLB / Cloud LB
─────────────────────────────────────────

Why This Chapter Is Short
─────────────────────────────────────────
  There is very little genuinely new here. Cloud
  networking is the previous six modules, exposed
  as an API.

  Subnetting is Module 3, Chapter 1. Routing is
  Module 3, Chapter 3. Firewall rules are Module 6,
  Chapter 4. Broadcast domains are Module 2,
  Chapter 4.

  If those are solid, cloud networking is
  vocabulary. If they are not, no amount of cloud
  documentation will help — which is why this
  module comes seventh rather than first.
─────────────────────────────────────────

2. The VPC

What It Is
─────────────────────────────────────────
  A logically isolated network within the
  provider's infrastructure, with a private address
  range you choose.

    10.0.0.0/16      65,536 addresses

  It is software-defined: the isolation is enforced
  by the hypervisor and network fabric, not by
  separate physical wiring.
─────────────────────────────────────────

CHOOSING THE CIDR — the decision you cannot undo
─────────────────────────────────────────
  Use RFC 1918 private space (Module 3, Chapter 1):
    10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

  RULES THAT SAVE YOU LATER:

  1. LEAVE ROOM. A /16 gives 65k addresses. A /24
     seems adequate until you add a second
     environment.

  2. DO NOT OVERLAP with anything you might ever
     peer with — your office, another VPC, an
     acquisition, a partner.
     Overlapping CIDRs CANNOT be peered. The only
     fix is renumbering an entire network.

  3. PLAN THE WHOLE ALLOCATION UP FRONT.
       10.0.0.0/16   production
       10.1.0.0/16   staging
       10.2.0.0/16   development
       10.10.0.0/16  reserved

  Everyone who used 10.0.0.0/16 for everything
  discovers rule 2 during a merger.
─────────────────────────────────────────

3. Subnets, Public and Private

The Distinction
─────────────────────────────────────────
  A subnet is PUBLIC or PRIVATE based on ONE thing:
  whether its ROUTE TABLE has a route to an
  INTERNET GATEWAY.

    PUBLIC   0.0.0.0/0 ──► internet gateway
    PRIVATE  0.0.0.0/0 ──► NAT gateway, or no
                           default route at all

  That is the entire difference. There is no
  "public" flag — it is Module 3, Chapter 3's
  default route, in the cloud.
─────────────────────────────────────────

The Standard Three-Tier Layout
─────────────────────────────────────────
  VPC 10.0.0.0/16

  PUBLIC SUBNETS      10.0.1.0/24  (zone A)
                      10.0.2.0/24  (zone B)
    ──► load balancers, NAT gateways, bastions

  PRIVATE APP         10.0.11.0/24 (zone A)
  SUBNETS             10.0.12.0/24 (zone B)
    ──► application servers. Outbound via NAT;
        NO inbound from the internet.

  PRIVATE DATA        10.0.21.0/24 (zone A)
  SUBNETS             10.0.22.0/24 (zone B)
    ──► databases. NO default route at all.
        Cannot reach the internet, and the internet
        cannot reach them.

  Note EVERY tier spans at least TWO availability
  zones. A single-zone deployment fails entirely
  when that zone does.
─────────────────────────────────────────

Why the Data Tier Has No Route Out
─────────────────────────────────────────
  Module 6, Chapter 4's EGRESS FILTERING, applied
  by construction.

  A compromised database server cannot exfiltrate
  data to the internet, because there is no path.
  Not blocked by a rule someone might change — it
  simply does not exist in the route table.

  It is the strongest form of the control, and it
  costs nothing.
─────────────────────────────────────────

4. Security Groups and Network ACLs

The Two Layers
─────────────────────────────────────────
  SECURITY GROUPS
    Attached to INSTANCES.
    STATEFUL — return traffic is automatically
    allowed (Module 6, Chapter 4).
    ALLOW rules only; the default is deny.
    Can reference ANOTHER SECURITY GROUP as a
    source.

  NETWORK ACLs
    Attached to SUBNETS.
    STATELESS — you must write BOTH directions,
    including ephemeral return ports.
    Allow AND deny rules, evaluated in order.
    A coarse second layer.
─────────────────────────────────────────

THE FEATURE THAT MATTERS MOST
─────────────────────────────────────────
  A security group can reference another SECURITY
  GROUP rather than an IP range.

    database SG:
      allow 5432 FROM sg-application

  This means: "any instance in the application
  group may reach the database on 5432."

  Autoscale the application from 3 to 300
  instances, replace them all, change their
  addresses — the rule never changes.

  It is IDENTITY-BASED rather than
  LOCATION-BASED access control, which is exactly
  Module 6, Chapter 4's zero trust principle
  expressed in infrastructure.

  Writing IP ranges into security groups throws
  this away, and is the most common cloud
  networking mistake.
─────────────────────────────────────────

# Terraform. Note the source_security_group_id — no IP addresses anywhere.
resource "aws_security_group" "database" {
  name   = "database"
  vpc_id = aws_vpc.main.id
}
 
resource "aws_security_group_rule" "db_from_app" {
  type                     = "ingress"
  from_port                = 5432
  to_port                  = 5432
  protocol                 = "tcp"
  security_group_id        = aws_security_group.database.id
  source_security_group_id = aws_security_group.application.id   # ← identity, not IP
}
 
# NOTE: no egress rule for the database. It needs none.
Stateless NACLs Catch People Out
─────────────────────────────────────────
  Allowing inbound 443 on a NACL is not enough. The
  RESPONSE leaves from port 443 to the client's
  EPHEMERAL port (Module 4, Chapter 1), so you must
  also allow outbound to 1024-65535.

  Forgetting this produces connections that
  establish and then hang — a confusing symptom
  with an obvious cause once you remember NACLs are
  stateless.

  In practice: use security groups for real policy
  and NACLs as a blunt subnet-wide backstop.
─────────────────────────────────────────

5. Connecting to Other Networks

The Options
─────────────────────────────────────────
  VPC PEERING
    Direct private connection between two VPCs.
    + simple, no bandwidth bottleneck
    - NOT TRANSITIVE. A–B and B–C does not give
      A–C. N VPCs need N(N-1)/2 peerings — the same
      scaling problem as symmetric keys (Module 6,
      Chapter 2).
    - CIDRs must not overlap

  TRANSIT GATEWAY
    A hub-and-spoke router. Every VPC connects
    once, and routing between them is central.
    ── the answer beyond a handful of VPCs

  VPN GATEWAY
    IPsec over the internet to your office.
    Cheap, quick, and subject to internet latency
    and variability.

  DIRECT CONNECT / EXPRESSROUTE
    A dedicated private circuit.
    Consistent latency, high bandwidth, and weeks
    to provision.

  PRIVATELINK / PRIVATE ENDPOINTS
    Reach a provider service — object storage, a
    managed database — WITHOUT traversing the
    internet or needing a NAT gateway.
    ── keeps the data tier's "no route out"
       property intact while still using managed
       services
─────────────────────────────────────────

PrivateLink Is Underused
─────────────────────────────────────────
  Without it, an instance in a private subnet
  reaching object storage goes:

    instance ──► NAT gateway ──► internet ──►
    the storage service's public endpoint

  You pay NAT data processing charges, the traffic
  leaves your network, and you need a route out.

  With a private endpoint, the traffic stays on the
  provider's network. Cheaper, faster, and the
  subnet keeps its no-internet-route property.
─────────────────────────────────────────

6. Regions, Zones and Cost

The Hierarchy
─────────────────────────────────────────
  REGION              a geographic area. Separate
                      regions are far apart, with
                      real propagation delay
                      between them (Chapter 2).

  AVAILABILITY ZONE   one or more datacentres
                      within a region, with
                      INDEPENDENT power, cooling
                      and networking.
                      Inter-zone latency is
                      typically 1-2 ms.

  RULE: spread across zones for AVAILABILITY.
  Spread across regions for DISASTER RECOVERY and
  for LATENCY to distant users — and accept the
  complexity that comes with it.
─────────────────────────────────────────

DATA TRANSFER COSTS — the surprise on every bill
─────────────────────────────────────────
  Roughly, and directionally:

    INBOUND from the internet          free
    WITHIN one availability zone       free or
                                       negligible
    BETWEEN zones in a region          small charge,
                                       BOTH ways
    BETWEEN regions                    larger
    OUT to the internet                THE
                                       EXPENSIVE
                                       ONE

  CONSEQUENCES
    - a chatty service pair split across zones
      costs real money for no benefit; keep tightly
      coupled services zone-aligned while still
      being multi-zone overall
    - egress is why a CDN often REDUCES total cost
      despite being an extra service — it serves
      from cache instead of from your origin's
      egress
    - cross-region replication is a recurring cost,
      not a one-off
─────────────────────────────────────────

The Design Rule
─────────────────────────────────────────
  In cloud networking, TOPOLOGY IS A COST DECISION
  as well as a performance one.

  On-premises, moving data between two racks is
  free. In the cloud it is billed. That single
  difference changes how you place services, and
  it is not obvious until the invoice arrives.
─────────────────────────────────────────

7. Summary & Next Steps

Key Takeaways

  • Cloud networking is the previous six modules exposed as an API; a subnet is public purely because its route table points at an internet gateway.
  • Choose the VPC CIDR to leave room and never overlap with anything you might peer with, because overlapping networks cannot be joined without renumbering.
  • Security groups referencing other security groups give identity-based rather than location-based access control, which survives autoscaling and instance replacement.
  • Giving the data tier no default route makes exfiltration impossible by construction rather than by rule, and private endpoints preserve that while still using managed services.

Concept Check

  1. What single property makes a subnet public rather than private?
  2. Why is referencing a security group better than an IP range, and what does it correspond to conceptually?
  3. Why do connections through a stateless NACL establish and then hang if you only allow inbound 443?

Next Chapter

→ Chapter 4: Service-to-Service Communication

Jr Codex — 1-on-1 Personalized Coaching | Back to Module Index | Back to Computer Networks Index