DEV Community

Aisalkyn Aidarova
Aisalkyn Aidarova

Posted on

VPC, subnets, IGW, NAT, routing, firewall, DMZ, private DB, and troubleshooting part #2 

User (Internet)
   ↓
DNS (:contentReference[oaicite:0]{index=0})
   ↓
WAF (optional)
   ↓
Load Balancer (Public / DMZ)
   ↓
Private Web Tier (EC2 / App)
   ↓
Private DB Tier
   ↓
Private AWS Services (via VPC Endpoint)

Cross-VPC / Hybrid:
   ↔ VPC Peering / :contentReference[oaicite:1]{index=1}
   ↔ :contentReference[oaicite:2]{index=2}
   ↔ VPN / Direct Connect
Enter fullscreen mode Exit fullscreen mode

🚀 STEP 11 — ADD DNS (Route 53)

Why SRE adds this

Users should never access ALB DNS directly.
They use domain like:

app.company.com
Enter fullscreen mode Exit fullscreen mode

Go to: 

Route 53 → Hosted Zones → Create Hosted Zone
Enter fullscreen mode Exit fullscreen mode

If you already have domain → use it

Create record 

Record name: app
Type: A
Alias: YES
Target: ALB
Enter fullscreen mode Exit fullscreen mode

Expected result 

nslookup app.yourdomain.com
Enter fullscreen mode Exit fullscreen mode

Output:

Name: app.yourdomain.com
Address: ALB IP
Enter fullscreen mode Exit fullscreen mode

Why this matters

Now flow is:

User → DNS → ALB → Web
Enter fullscreen mode Exit fullscreen mode

SRE troubleshooting

If site down:

dig app.yourdomain.com
Enter fullscreen mode Exit fullscreen mode

Check:

  • does it resolve?
  • correct ALB?
  • TTL delay?

🚀 STEP 12 — ADD WAF (SECURITY LAYER)

Why

Security Groups = network firewall
WAF = application firewall (Layer 7)

Go to: 

WAF → Create Web ACL
Enter fullscreen mode Exit fullscreen mode

Attach to:

ALB
Enter fullscreen mode Exit fullscreen mode

Add rules

  • AWS Managed Rules
  • Rate limiting (1000 req/min)

Result

Now:

Bad traffic blocked BEFORE app
Enter fullscreen mode Exit fullscreen mode

SRE troubleshooting

If users blocked:

  • check WAF logs
  • check rule priority
  • false positives

🚀 STEP 13 — ADD CLOUDWATCH + ALB LOGS

Why

SRE must see traffic

Enable ALB logs 

EC2 → Load Balancer → Attributes → Enable Access Logs
Enter fullscreen mode Exit fullscreen mode

Store in S3

Expected log 

client_ip request_path target_status_code latency
Enter fullscreen mode Exit fullscreen mode

Why important

You can debug:

  • 500 errors
  • slow requests
  • bad clients

🚀 STEP 14 — ADD VPC FLOW LOGS

Already partially covered — now use it

Go to:

VPC → Flow Logs → Create
Enter fullscreen mode Exit fullscreen mode

Example output 

ACCEPT TCP 10.0.3.10 → 10.0.5.20 3306
REJECT TCP 1.2.3.4 → 10.0.5.20 3306
Enter fullscreen mode Exit fullscreen mode

Why this matters

You can prove:

  • traffic allowed
  • traffic blocked

🚀 STEP 15 — ADD VPC ENDPOINT (PRIVATE AWS ACCESS)

Why

Private EC2 should NOT go through internet for AWS services

Go to: 

VPC → Endpoints → Create
Enter fullscreen mode Exit fullscreen mode

Service:

S3
Type: Gateway
Enter fullscreen mode Exit fullscreen mode

Attach:

Private route table
Enter fullscreen mode Exit fullscreen mode

Result 

Private EC2 → S3 (no NAT, no internet)
Enter fullscreen mode Exit fullscreen mode

SRE importance

  • secure
  • cheaper
  • required in enterprise

🚀 STEP 16 — ADD VPC PEERING (MULTI-VPC)

Scenario

You have:

VPC-A → your app
VPC-B → shared services
Enter fullscreen mode Exit fullscreen mode

Create second VPC

CIDR:

10.1.0.0/16
Enter fullscreen mode Exit fullscreen mode

Go to: 

VPC → Peering → Create
Enter fullscreen mode Exit fullscreen mode

Update routes BOTH SIDES 

10.1.0.0/16 → peering
10.0.0.0/16 → peering
Enter fullscreen mode Exit fullscreen mode

Result 

Private communication between VPCs
Enter fullscreen mode Exit fullscreen mode

SRE troubleshooting

  • routes missing?
  • SG blocking?
  • CIDR overlap?

🚀 STEP 17 — ADD TRANSIT GATEWAY (ENTERPRISE LEVEL)

Instead of many peerings:

Go to: 

VPC → Transit Gateway → Create
Enter fullscreen mode Exit fullscreen mode

Attach VPCs 

Attach VPC-A
Attach VPC-B
Enter fullscreen mode Exit fullscreen mode

Result 

Central network hub
Enter fullscreen mode Exit fullscreen mode

Why SRE uses this

  • scalable
  • cleaner architecture
  • used in large companies

🚀 STEP 18 — ADD PRIVATELINK (ADVANCED)

Scenario

Expose ONLY service, not full network

Flow 

Consumer VPC → Endpoint → NLB → Service VPC
Enter fullscreen mode Exit fullscreen mode

Why

  • secure
  • no full VPC access
  • SaaS architecture

Difference 

Peering → full network
PrivateLink → one service
Enter fullscreen mode Exit fullscreen mode

🚀 STEP 19 — ADD VPN (HYBRID CLOUD)

Scenario

Company has on-prem server

Go to: 

VPC → VPN → Create Site-to-Site VPN
Enter fullscreen mode Exit fullscreen mode

Result 

On-prem → encrypted → AWS
Enter fullscreen mode Exit fullscreen mode

SRE checks

  • tunnel UP?
  • routes correct?
  • firewall open?

🚀 STEP 20 — ADD DIRECT CONNECT (THEORY)

What

Private fiber connection

When used

  • banks
  • large companies

Difference 

VPN → internet
Direct Connect → private line
Enter fullscreen mode Exit fullscreen mode

🚀 STEP 21 — FINAL SRE TESTING (REAL SCENARIOS)

Scenario 1 — ALB down

Check:

DNS → OK?
ALB → Active?
Target → Healthy?
Enter fullscreen mode Exit fullscreen mode

Scenario 2 — App slow

Check:

ALB logs
Latency
DB connection
Enter fullscreen mode Exit fullscreen mode

Scenario 3 — DB not reachable

Check:

SG rules
Port 3306
Private routing
Enter fullscreen mode Exit fullscreen mode

Scenario 4 — Private EC2 no internet

Check:

NAT
Route table
IGW
Enter fullscreen mode Exit fullscreen mode

Scenario 5 — DNS issue 

dig app.domain.com
Enter fullscreen mode Exit fullscreen mode

🔥 WHAT YOU HAVE NOW (REAL SRE LEVEL)

You built:

✔ Multi-tier architecture
✔ DMZ design
✔ Private networking
✔ Load balancing
✔ Firewall (SG + WAF)
✔ DNS routing
✔ Observability (logs + flow logs)
✔ Private AWS access (VPC endpoint)
✔ Multi-VPC (peering + transit)
✔ Service exposure (PrivateLink)
✔ Hybrid cloud (VPN)

💬 FINAL INTERVIEW ANSWER

You say:

I built a production-grade AWS architecture with DNS using Route 53, public access through an Application Load Balancer in DMZ subnets, private application and database tiers, secure communication using security groups, outbound internet via NAT Gateway, private AWS access via VPC endpoints, and network observability using VPC Flow Logs and ALB logs. I also implemented multi-VPC connectivity using VPC peering and Transit Gateway, and secure service exposure using PrivateLink, along with hybrid connectivity using VPN.

-

Top comments (0)