DEV Community

Aisalkyn Aidarova
Aisalkyn Aidarova

Posted on

VPC, subnets, IGW, NAT, routing, firewall, DMZ, private DB, and troubleshooting part #1

🔥 LAB GOAL (PRODUCTION STYLE)

You will build:

Internet
   ↓
Load Balancer (DMZ / Public)
   ↓
Web Server (Private)
   ↓
Database (Private)
Enter fullscreen mode Exit fullscreen mode

With:

  • Public subnets (DMZ)
  • Private subnets (App + DB)
  • NAT Gateway
  • Security Groups (firewall)
  • Route tables (routing)

🚀 STEP 0 — WHAT YOU MUST HAVE

Already created:

✔ VPC
✔ 2 Public subnets
✔ 2 Private subnets
✔ Internet Gateway
✔ NAT Gateway

🚀 STEP 1 — FIX ROUTING (VERY IMPORTANT)

Public Route Table

Go to VPC → Route Tables → Public RT

Make sure:

0.0.0.0/0 → Internet Gateway
Enter fullscreen mode Exit fullscreen mode

Associate:

  • Public Subnet 1
  • Public Subnet 2

Private Route Table

Make sure:

0.0.0.0/0 → NAT Gateway
Enter fullscreen mode Exit fullscreen mode

Associate:

  • Private Subnet 1
  • Private Subnet 2

✔ Result:

  • Public = internet access
  • Private = outbound only

🚀 STEP 2 — CREATE SECURITY GROUPS (FIREWALL DESIGN)

1. Load Balancer SG (alb-sg)

Allow:

HTTP 80 → 0.0.0.0/0
Enter fullscreen mode Exit fullscreen mode

2. Web Server SG (web-sg)

Allow:

HTTP 80 → alb-sg
SSH 22 → your IP
Enter fullscreen mode Exit fullscreen mode

3. Database SG (db-sg)

Allow:

MySQL 3306 → web-sg
Enter fullscreen mode Exit fullscreen mode

✔ Result:

  • Internet → only ALB
  • ALB → Web
  • Web → DB
  • Users CANNOT access DB

👉 This is real firewall architecture

🚀 STEP 3 — CREATE LOAD BALANCER (DMZ)

Use:
Application Load Balancer

Where:

EC2 → Load Balancers → Create

Config:

  • Type: Application LB

  • Scheme: Internet-facing

  • Subnets:

    • Public Subnet 1
    • Public Subnet 2

  • Security Group:

    • alb-sg

✔ Result:

👉 Entry point for users

🚀 STEP 4 — CREATE WEB SERVERS (PRIVATE)

Launch 2 EC2:

  • Subnet:

    • private-subnet-1
    • private-subnet-2

  • Security Group:

    • web-sg

  • NO public IP

Install nginx: 

sudo apt update
sudo apt install nginx -y
Enter fullscreen mode Exit fullscreen mode

Customize page: 

echo "Hello from Web Server 1" | sudo tee /var/www/html/index.html
Enter fullscreen mode Exit fullscreen mode

✔ Result:

👉 Private app servers running

🚀 STEP 5 — CONNECT ALB → WEB

Create Target Group:

  • Type: Instance
  • Port: 80

Add both EC2 instances

Attach to Load Balancer

✔ Result:

👉 ALB sends traffic to web servers

🚀 STEP 6 — TEST

Open:

http://<ALB-DNS>
Enter fullscreen mode Exit fullscreen mode

✔ Result:

👉 You see your web page

Refresh:
👉 It switches between servers

🚀 STEP 7 — CREATE DATABASE (SIMULATION)

You can use EC2 or:
Amazon RDS

For simple lab (EC2 DB):

Launch EC2:

  • Subnet: private-subnet-1
  • SG: db-sg

✔ Result:

👉 Private DB server

🚀 STEP 8 — TEST NETWORK SECURITY

Try:

From your laptop:

  • Access DB → ❌ FAIL

From web EC2:

  • Connect DB → ✔ WORK

👉 This proves firewall working

🚀 STEP 9 — TEST NAT (VERY IMPORTANT)

SSH into web EC2:

ping google.com
Enter fullscreen mode Exit fullscreen mode

✔ Result:

👉 Works → NAT is correct

🚀 STEP 10 — BREAK & DEBUG (SRE LEVEL)

Now simulate failures:

Scenario 1 — Remove NAT route

👉 Private EC2 cannot reach internet

Fix:
👉 Add NAT route back

Scenario 2 — Remove SG rule (web → db)

👉 App cannot reach DB

Fix:
👉 Add rule back

Scenario 3 — Stop one EC2

👉 App still works via ALB

👉 This is real SRE behavior

🔥 WHAT YOU JUST LEARNED

You implemented:

✔ VPC design
✔ Subnet segmentation (DMZ / Private)
✔ Routing (IGW + NAT)
✔ Firewall (SG)
✔ Load balancing
✔ Secure DB access
✔ Failure testing

💬 INTERVIEW ANSWER

I built a multi-tier architecture in AWS with public and private subnets, configured routing using Internet Gateway and NAT Gateway, secured communication using security groups, deployed web servers behind an Application Load Balancer, and validated failover and connectivity through testing scenarios.

Top comments (0)