Chapter 1: Networking Fundamentals
1.9 How these concepts map to AWS
Come on, friends, let's see where all these pieces sit in AWS. Treat the diagram below as a typical company setup: the web server in a public subnet, the database in a private subnet, and a NAT Gateway for updates. We will build this whole setup ourselves in Chapter 15.
चला मित्रांनो, आता हे सगळे तुकडे AWS मध्ये कुठे बसतात ते बघू. खालचा diagram एक typical company setup समजा: public subnet मध्ये web server, private subnet मध्ये database, आणि updates साठी NAT Gateway. हा पूर्ण setup आपण Chapter 15 मध्ये स्वतः बनवणार आहोत.
चलो दोस्तों, अब देखते हैं कि ये सारे टुकड़े AWS में कहाँ बैठते हैं. नीचे वाले diagram को एक typical company setup समझो: public subnet में web server, private subnet में database, और updates के लिए NAT Gateway. यह पूरा setup हम Chapter 15 में खुद बनाएँगे.
Internet
|
+---------------+
| Internet GW | (1:1 NAT for public / Elastic IPs)
+---------------+
|
+------------------ VPC 10.0.0.0/16 ------------------------------+
| Public subnet 10.0.1.0/24 Private subnet 10.0.11.0/24 |
| +-----------------------+ +------------------------+ |
| | EC2 web server | | EC2 / RDS database | |
| | private 10.0.1.25 | -------> | private 10.0.11.40 | |
| | public 13.233.10.25 | | (no public IP) | |
| +-----------------------+ +-----------+------------+ |
| | | outbound only |
| +-------------+ <-------------------------+ |
| | NAT Gateway | (lets private hosts download updates) |
| +-------------+ |
+-----------------------------------------------------------------+
| Networking concept | AWS feature | Key points |
|---|---|---|
| Private IP | Primary private IPv4 of an EC2 ENI | From the subnet CIDR; stays the same for the life of the instance (even across stop/start) |
| Dynamic public IP | Auto-assigned public IPv4 | Released on stop; a new one is given on start. Lost for ever on terminate |
| Static public IP | Elastic IP (EIP) | Stays with your account until you release it; can be re-mapped to another instance. Charged hourly like all public IPv4 addresses |
| Private network | VPC with CIDR (e.g. 10.0.0.0/16) |
Choose from RFC 1918 ranges; /16 to /28 |
| Subnet | Subnet (lives in one AZ) | Public subnet = route 0.0.0.0/0 → Internet Gateway |
| NAT | NAT Gateway / Internet Gateway | IGW does 1:1 NAT for public IPs; NAT GW does many-to-one for private subnets |
| Firewall on ports | Security Group (stateful, instance level) and Network ACL (stateless, subnet level) | Allow 22 only from My IP; 80/443 from anywhere |
| DNS | Route 53 (Chapter 9), and public DNS names like ec2-13-233-10-25.ap-south-1.compute.amazonaws.com |
Mumbai and Hyderabad regions
For users in Maharashtra, the Asia Pacific (Mumbai) ap-south-1 region gives the lowest latency. ap-south-2 (Hyderabad) is the other Indian region.
Public IP changes after stop/start
If your website stops working after you stop and start an instance, check the public IP — it has probably changed. Use an Elastic IP (or a load balancer / DNS name) for anything that must keep a fixed address — we practise this in Chapter 14.
Ravindra Bagale's Tip
In interviews many students mix up the Security Group and the Network ACL. Remember: a Security Group works at the instance level and is stateful; a Network ACL works at the subnet level and is stateless. So in an SG the reply to an allowed request goes back automatically, but in a NACL you need rules in both directions.
Ravindra Bagale's Tip – मराठी
Interview मध्ये बरेच students Security Group आणि Network ACL उलटं सांगतात. लक्षात ठेवा: Security Group instance level ला आहे आणि stateful; Network ACL subnet level ला आहे आणि stateless. म्हणजे SG मध्ये allow केलेल्या request चा reply आपोआप परत जातो, पण NACL मध्ये दोन्ही दिशांचे rules लागतात.
Ravindra Bagale's Tip – हिंदी
Interview में बहुत से students Security Group और Network ACL उल्टा बताते हैं. याद रखो: Security Group instance level पर है और stateful; Network ACL subnet level पर है और stateless. मतलब SG में allow की गई request का reply अपने आप वापस जाता है, लेकिन NACL में दोनों दिशाओं के rules चाहिए.
Lab
AWS console madhe VPC → Your VPCs ughda aani default VPC cha CIDR (172.31.0.0/16) bagha. Mag Subnets madhe pratyek subnet cha CIDR aani AZ liha, aani Route tables madhe 0.0.0.0/0 → Internet Gateway cha route kuthe aahe te shodha.
Go deeper: Amazon VPC
Chapter 15 builds this exact picture hands-on: What is a VPC? Default VPC vs custom VPC · Route tables: public and private subnets · Security group vs NACL. Quick guides: Create a custom VPC · Public vs private subnet.