AWS VPC

September 10, 2024 6 minute read

What is VPC?

Amazon Virtual Private Cloud (Amazon VPC) is a service that allows us to create our own isolated virtual network in AWS. It gives us full control over our network environment, including IP address ranges, subnets, routing, and security.

From Traditional On-Premises Network to the Cloud

In a traditional on-premises environment, organizations need to build and maintain their own physical network infrastructure. This includes purchasing networking devices, configuring cables, managing IP addresses, and ensuring the network remains secure and available.

With Amazon VPC, all of these networking capabilities are virtualized and managed through AWS. We can design our network architecture within minutes without worrying about the underlying physical hardware, while still maintaining a high level of control over connectivity and security.

VPC Building Blocks

A VPC is made up of several networking components that work together to control connectivity and security.

Component	Purpose
VPC	Creates an isolated virtual network.
Subnet	Divides the VPC into smaller network segments.
Route Table	Determines how network traffic is routed.
Internet Gateway (IGW)	Enables communication between the VPC and the internet.
NAT Gateway	Allows private resources to access the internet without being publicly accessible.
Security Group	Acts as a virtual firewall for individual resources.
Network ACL (NACL)	Provides subnet-level traffic filtering.
VPC Endpoint	Enables private access to supported AWS services without using the public internet.

VPC CIDR

A CIDR (Classless Inter-Domain Routing) block defines the IP address range available within your VPC. Every resource launched inside the VPC, such as an EC2 instance or an RDS database, receives a private IP address from this range.

When creating a VPC, one of the first decisions we need to make is selecting an appropriate CIDR block. This choice determines the maximum number of private IP addresses the VPC can allocate.

CIDR Notation

A CIDR block consists of an IP address followed by a slash (/) and a number, for example:

10.0.0.0/16

The number after the slash is called the prefix length. It indicates how many bits are reserved for the network portion of the IP address, while the remaining bits are used for host addresses.

The number of available IP addresses can be calculated using the following formula:

Number of IP addresses = 2^(32 - prefix length)

For example:

CIDR Block	Host Bits	Total IP Addresses
`/16`	16	65,536
`/20`	12	4,096
`/24`	8	256
`/28`	4	16

As the prefix length increases, the network becomes smaller, resulting in fewer available IP addresses.

Calculating CIDR

Suppose we create a VPC with the following CIDR block:

10.0.0.0/16

32 - 16 = 16 host bits

2^16 = 65,536 IP addresses

This means our VPC owns all IP addresses from 10.0.0.0 to 10.0.255.255.

We can divide the VPC into multiple subnet, for example:

VPC: 10.0.0.0/16
│
├── Public Subnet
│   └── 10.0.1.0/24
│
└── Private Subnet
    └── 10.0.2.0/24

Each /24 subnet contains 256 IP addresses.

However, AWS reserves the first four IP addresses and the last IP address in every subnet, leaving 251 usable IP addresses for our resources.

Notes! A VPC CIDR block cannot overlap with the CIDR blocks of other VPCs or on-premises networks that we plan to connect using VPC Peering, Transit Gateway, or Site-to-Site VPN. Careful IP planning at the beginning helps avoid networking conflicts as our infrastructure grows.

Subnet

A subnet is a smaller network created by dividing a VPC’s CIDR block into multiple IP address ranges. Subnets help organize resources, improve security, and separate workloads with different networking requirements.

Here is the illustration when we divide VPC CiDR Block into multiple subnets:

VPC: 10.0.0.0/16
│
├── Public Subnet A
│   └── 10.0.1.0/24
│
├── Public Subnet B
│   └── 10.0.2.0/24
│
├── Private Subnet A
│   └── 10.0.11.0/24
│
└── Private Subnet B
    └── 10.0.12.0/24

Each subnet has its own range of IP addresses, allowing resources to be grouped based on their purpose.

Subnets are commonly categorized as:

Public Subnet – Contains resources that require direct internet access, such as web servers or load balancers.
Private Subnet – Contains internal resources, such as databases or application servers, that should not be directly accessible from the internet.

A subnet is not inherently public or private. Its behavior depends on the associated route table and whether traffic can reach an Internet Gateway.

Route Tables

A Route Table defines how network traffic is routed within a VPC. Every subnet must be associated with a route table, and AWS uses its routes to determine where packets should be sent.

Every route consists of two parts:

Destination – The IP address range for the traffic.
Target – Where the traffic should be forwarded.

A route table with only the local route means resources can communicate only with other resources inside the VPC.

AWS automatically creates the Local route when a VPC is created. This route cannot be removed because it enables communication between subnets within the same VPC.

Internet Gateway (IGW)

An Internet Gateway (IGW) is a highly available, managed AWS resource that enables communication between a VPC and the public internet.

By itself, attaching an Internet Gateway to a VPC does not make resources publicly accessible. Internet connectivity requires all of the following:

An Internet Gateway attached to the VPC.
A route table with a default route (0.0.0.0/0) pointing to the Internet Gateway.
A resource with a public IPv4 address or Elastic IP address.
Security Groups and Network ACLs that allow the required traffic.

The illustration will looks like:

Internet
    │
    ▼
Internet Gateway
    │
    ▼
Route Table
(0.0.0.0/0 → IGW)
    │
    ▼
Public Subnet
    │
    ▼
EC2 Instance
(Public IP)

Without an Internet Gateway, resources inside the VPC can still communicate with each other, but they cannot send or receive traffic from the public internet.

Firewalls in VPC

Amazon VPC provides two layers of firewall protection which is Security Groups and Network Access Control Lists (NACLs).

Security Groups

A Security Group acts as a virtual firewall for an individual AWS resource. It controls which inbound and outbound traffic is allowed to reach that resource.

Security Group only contains allow rules. Any traffic that is not explicitly allowed is automatically denied.

For example, the following Security Group allows SSH and HTTP traffic: | Type | Protocol | Port | Source | | —- | ——– | —- | —————– | | SSH | TCP | 22 | 203.0.113.10/32 | | HTTP | TCP | 80 | 0.0.0.0/0 |

Security Groups are stateful, which means we don’t have to specify the outbound rules to response to traffic.

Network ACL (NACL)

A Network Access Control List (NACL) provides firewall protection at the subnet level. Every resource inside the subnet is affected by the same NACL.

Unlike Security Groups, NACLs support both:

Allow rules
Deny rules

Rule #	Type	Protocol	Port	Source	Action
100	HTTP	TCP	80	`0.0.0.0/0`	Allow
110	SSH	TCP	22	`203.0.113.10/32`	Allow
*	All Traffic	All	All	`0.0.0.0/0`	Deny

Unlike Security Groups, NACLs are stateless.

If inbound traffic is allowed, the corresponding outbound response is not automatically allowed. So we must explicitly configure both inbound and outbound rules.

For example:

Inbound  : Allow TCP 80
Outbound : Must also allow ephemeral ports

If the outbound rule is missing, the response packet will be dropped even though the inbound request was accepted.

Share on

X Facebook LinkedIn Bluesky

Nugroho