VPC Overview
Build a Custom VPC
Network and Content Delivery - VPC - Your VPCs - create VPC - add name,IPv4 CIDR block = 10.0.0.0/16,Enable Amazon provided IPV6 CIDR block,Tenancy = default - yes,create - Now automatically new Route Table,Network ACLs,Security Groups creates.
Go to Subnets - create Subnet - add name tag,select the VPC you created,select availability zone,IPv4 CIDR block = 10.0.1.0/24 -
yes create - Go to Subnets - create Subnet - add name tag,select the VPC you created,select another availability zone,IPv4 CIDR block = 10.0.2.0/24 - yes create
Go to Internet Gateway - create Internet Gateway - add name tag - yes create - Attach to VPC - yes attach
Go to Route Tables - select the Route table - Subnet Association - There will be no subnet association - Create Route Table - add name tag,select VPC - yes create - Routes(To enable internet) - Edit - Add another route - Destination(0.0.0.0/0),Target = select the internet gateway - save - Edit(To add ipv6) - Add another route - Destination(::/0),Target = select the internet gateway - save - subnet Association - Edit - select subnet(IPv4 CIDR block = 10.0.1.0/24) - save(10.0.1.0/24 = public network,10.0.2.0/24 = private network) - Go to subnets - select 10.0.1.0/24 subnet - subnet Actions - Modify auto-assign IP settings - Enable auto-assign public ipv4 address - save - Launch an EC2 Instance - configure Instance - Network(select the created VPC),select subnets(10.0.1.0/24) - Security Group(Add ssh,http,https rule) - Launch(Public Instance) - Launch another EC2 Instance - configure Instance - Network(select the created VPC),select subnets(10.0.2.0/24) - Launch(Private Instance)
Network and Security - Security Groups - create security Group - add name,select created VPC - Inbound(Add rule - SSH,MYSQL/AURORA,HTTP,HTTPS,ALL ICMP - Source = 10.0.1.0/24 for all rules) - create - Add this Security Group to created Private Instance - Action - Networking - Change Security Group - select and Assign Security Groups
Now login to Public Instance that we created - check Internet is available or not(Internet will be available) - Ping private Instance IP - you will get pinging output - Now copy the login-key of Private Instance to Public Instance - Then login to private Instance from Public Instance - Here Internet will not available
Network Address Translation(NAT)
EC2 - Launch an Instance - choose AMI - community AMIs - amazon-ami-vpc-nat-hvm-.... - select - Configure Instance - Network(select the created VPC),select subnets(10.0.1.0/24) - Security Group(Add ssh,http,https rule) - Launch - Select the NAT instance - choose Actions - Networking - Change source/destination check - choose Stop - save
VPC - Route tables - select main VPC Route table - Routes - Edit - Add another route - Destination(0.0.0.0/0),Target = select the NAT Instance gateway - save
Now log in private instance from public instance and check internet.Now you will get internet.Now Terminate the nat instance and then we loose internet connection.
VPC - NAT gateway - create Nat gateway - select subnet(Public subnet 10.0.1.0/24 ) - Create new EIP(Elastic ip) - create a NAT Gateway - Go to Route Table - select main VPC Route table - Routes - Remove old route - Add another route -Destination(0.0.0.0/0),Target = select the NAT gateway - save
Now log in private instance from public instance and check internet.Now you will get internet.
Access Control Lists (ACLs)
VPC - Network ACLs - create Network ACLs - add name,select the created VPC - yes,create
In created Public Instance do the below codes
yum update -y
yum install httpd -y
service httpd start
chkconfig httpd on
echo "<html><h1>Hello Cloud Gurus!</h1></html>" > /var/www/html/index.html
Now we get the website in web-browser http://ipaddress of Public Instance
VPC - Network ACLs - select the newly created ACL - Inbound Rule - Edit - Add another rule - Rule = 100,Type = HTTP(80),source = 0.0.0.0/0 - Rule = 200,Type = HTTPS(443),source = 0.0.0.0/0 - Rule = 300,Type = SSH(22),source = 0.0.0.0/0 - save - Outbound Rule - Edit - Add another rule - Rule = 100,Type = HTTP(80),source = 0.0.0.0/0 - Rule = 200,Type = HTTPS(443),source = 0.0.0.0/0 - Rule = 300,Type = Custom TCP Rule,Port Range = 1024 - 65535,source = 0.0.0.0/0 - save - subnet Association - select public subnet(10.0.1.0/24) - save
Now if we add Inbound Rule - Edit - Add another rule - Rule = 101,Type = HTTP(80),source = myipaddress/subnet,Allow/Deny = Deny - Now we get the website in web-browser http://ipaddress of Public Instance
Now if we add Inbound Rule - Edit - Add another rule - Rule = 99,Type = HTTP(80),source = myipaddress/subnet,Allow/Deny = Deny - Now we donot get the website in web-browser http://ipaddress of Public Instance
Here Rule = 99 which comes first in Inbound Rule and that rule get preference first.
VPC End Points
IAM - Role - create role - EC2 - EC2 - Next - AmazonS3FullAccess - Next - Add role-name - create role - Add the role to Private Instance - Action - Instance settings - Attach/Replace IAM Role - select the role - Apply
VPC - Network ACLs - select newly created default Network ACL - subnet association - Edit - Select Public subnet (10.0.1.0/24) - save
Now login to private Instance from Public Instance
sudo su
aws s3 ls
Now you get S3 bucket list.
Go to VPC - Route Tables - select newly created main Route Table - Routes - Edit - Remove(0.0.0.0/0) - save
Now if you use the command shown below you cannot see S3 bucket list.
aws s3 ls
Go to Endpoint - create Endpoint - select s3 gateway(com.amazonaws.us-east-1.s3) - select created VPC - select main private route table - create Endpoints
Now using "aws s3 ls" you get S3 bucket list.
Go to VPC - Route Tables - select newly created main Route Table - Routes - Now you can see VPC Endpoints(This is not behind NAT gateway this is VPC Endpoints)
Custom VPCs and Application Load Balancers
EC2 - Load Balancer - create Load Balancer - create Application Load Balancer - select the created VPC - Here you need atleast 2 Availabilty Zone of Public Instance
VPC Flow Logs
Go to VPC - Select the created VPC - Action - Create Flow Log - click on Set Up Permission link - view Policy Document - Allow - Go back select the role now created - create Flow Log - But this will show an error because we need to create Destination Log Group - Go to Cloudwatch - Logs - create Log group - add a name - create Log Group - Go to Flow Log - add log group - create flow log
NAT's Vs Bastions
VPC Clean Up
EC2 - Select Public and Private Instance - Actions - Instance state - Terminate - Yes Terminate
VPC - NAT Gateways - select nat gateway - Action - Delete NAT Gateway - EndPoints - select Endpoints - Action - Delete Enpoints - Internet Gateway - select Internet Gateway - Detach from VPC - yes,Delete - your VPC - select VPC - Action - Delete
Top comments (0)