VPCs, subnets, routes, gateways and firewalls

Why and what

A VPC is an isolated virtual network with address ranges, subnets and routing. A subnet belongs to one AZ. “Public subnet” means its route table has a route to an internet gateway; it does not mean every resource in it is automatically public. An IPv4 EC2 instance also needs a public address and permitted security rules for direct internet access.

Design the lab

1. Create the VPC with DNS support; create these subnets in the intended AZs.
2. Attach an internet gateway to the VPC. Create a public route table with 0.0.0.0/0 → IGW and associate only the public subnet.
3. Leave the private route table with local routes initially. Create a public NAT gateway only if outbound IPv4 internet access from private subnets is needed, and review its hourly/data cost.
4. If using NAT, route private 0.0.0.0/0 → NAT. NAT is an outbound connection path; it does not provide arbitrary inbound access to a private server.
5. Create web-sg for HTTP/HTTPS and db-sg with 3306 sourced from web-sg, not the whole internet.

Security groups versus NACLs

Security groups are stateful allow rules associated with network interfaces/resources. NACLs are stateless subnet-level allow/deny rules evaluated in number order. Return traffic must be considered explicitly in NACLs, including ephemeral ports. A security-group reference identifies permitted resources; it does not create a route or grant SQL privileges.

Verification

Deploy a small instance in each subnet. Confirm the private instance has no public IP. Use Session Manager with the required endpoint access, or an authorized bastion, to administer it. Test application-to-database reachability rather than opening 3306 publicly. Use VPC Flow Logs to inspect accepted/rejected flows, remembering that logs do not capture packet payloads.

Break/fix and cleanup

Remove a lab route and predict which paths fail. Restore it before changing firewalls. Delete NAT gateways and release their unused Elastic IPs when the lab finishes; retained gateways can cost money even without active instances.

Interview question

Does putting an RDS database in a private subnet eliminate database authentication? No. Network isolation and database authorization are separate controls.

Official references

VPC routing Security groups NACLs

Interview and revision check

Does a NAT gateway allow arbitrary inbound SSH to a private instance?

No. It supports outbound-initiated IPv4 connections and their return traffic. Use an intended private management path.