AWS Network Basic Knowledge

AWS Basic Network

Note to learn aws network.

AWS

• Region (Barginia, Oregon, Tokyo...)
• Availability Zone (Phisically separated, )
• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html

IP Address

• IP Address

  • 8 bit * 4 = 32 bit 0.0.0.0 ~ 255.255.255.255
  • 00000000.00000000.00000000.0000000 ~ 11111111.11111111.11111111.11111111

• Network part

  • 192.168.1.0 ~ 192.168.1.255 -> Network part: 192.168.1 (24bit), Host part 0, 255(8bit)
  • 192.168.0.0 ~ 192.168.255.255 -> Network part: 192.168(16bit), Host part 0.0, 255.255(16bit)

• PrivateIP Addresses which is not used in internet

  • 10.0.0.0 ~ 10.255.255.255
  • 172.16.0.0 ~ 172.31.255.255
  • 192.168.0.0 ~ 192.168.255.255

• CIDR notation (show network part by bit which is called prefix)

  • 192.168.0.0 ~ 192.168.255.255 -> 192.168.0.0/16 [prefix:16bit]
  • 192.168.10.0 ~ 192.168.10.255 -> 192.168.10.0/24 [prefix:24bit]

• Subnet mask notation (show network part by 1)

  • 192.168.0.0 ~ 192.168.255.255 -> (11111111.11111111.00000000.00000000) -> 192.168.0.0/255.255.0.0
  • 192.168.10.0 ~ 192.168.10.255 -> 192.168.10.0/255.255.255.0

• Conclusion

  • These three expressions mean the same IP address range.
    • 192.168.0.0 ~ 192.168.255.255
    • 192.168.0.0/16
    • 192.168.0.0/255.255.0.0

• AWS Specification

  • When create VPC, more than 16 must be configured as prefix.
    • ex) 10.0.0.0/16 -> 10.0.0.0 ~ 10.0.255.255
  • Enable to confirm CIDR range easily here. http://cidr.xyz/

Practice

• Create VPC

  • IPv4 CIDR block
  • CIDR block: 10.0.1.0/24
  • https://docs.aws.amazon.com/ja_jp/vpc/latest/userguide/getting-started-ipv4.html

• Divide VPC into Subnet

  • pre-test-public : 10.0.1.0/24
  • The reason to divide: want to attach another subnet corresponding to the physical area, want to configure other security policy

• Connect pre-test-public to internet

  • Create an internet gateway
  • Attach VPC to the gateway
  • https://docs.aws.amazon.com/ja_jp/vpc/latest/userguide/VPC_Internet_Gateway.html

• Configure Route table

  • Route table: Configure the route to where depending on IP address.
  • Target: Who
  • Desitnation: to where
  • Enable to configure route table in each subnet
  • Default Desitination: 10.0.0.0/16, Target: local -> Send local network to CIDR 10.0.0.0/16 -> Cannot go out internet
  • In order to connect internet, need to send packet except for destination 10.0.0.0/16 to internet gateway
    • Create New Route Table
    • Add configuration in route table Destination: 0.0.0.0/0, Target: Internet Gateway
    • Connect route table to public subnet
  • https://docs.aws.amazon.com/ja_jp/vpc/latest/userguide/VPC_Route_Tables.html

• Create EC2 instance in public subnet

  • Network : Choose VPC
  • Subnet : Choose Subnet to put
  • Auto-assign Public IP: Enable
  • Network Interfaces, Primary IP: 10.0.1.10 (Public Subnet CIDR 10.0.1.0/24)
    • Cannot use top and bottom of CIDR block for instance private IP, since 10.0.1.0 means the whole subnet network, 10.0.1.255 means broadcast address( but aws does not support)
  • Skip Storage and tags and security group.

• Security Group

  • Security: Packet filtering = Firewall
  • Inboud: Who can come in
  • Outbound: Who can go out
  • https://docs.aws.amazon.com/ja_jp/vpc/latest/userguide/VPC_SecurityGroups.html

• DNS

  • No pulic DNS on the instance
  • Edit DNS Hostnames on VPC
  • public DNS is attached into instances which have public ip
  • https://docs.aws.amazon.com/ja_jp/vpc/latest/userguide/vpc-dns.html

• Private Subnet

  • Never connect from internet like Database
  • Enable to make subnet in other availability zone, but low latency
  • Create Subnet : Smae AZ with public subnet, CIDR block is 10.0.2.0/24
  • Unnecessary to configure route table (default is OK, since no need to connect internet)
  • Create EC2 instance as Database in private subnet
    • Network : Choose VPC
    • Subnet : Choose private Subnet to put
    • Auto-assign Public IP: Disable
    • Network Interfaces, Primary IP: 10.0.2.10 (Private Subnet CIDR 10.0.2.0/24)
    • SecurityGroup: Create a new secrutiy group.
    • Add MYSQL with 0.0.0.0/0
    • Add ALL ICMP with 0.0.0.0/0 for ping connection
    • If private IP of public subnet CIDR(10.0.1.0/24), secrutiy becomes more stronger
    • This instance does not have public IP and public DNS

• NAT

  • Network Address Tanslation
  • Databse server cannot connect internet now. How can we install databse server? -> NAT
  • With NAT, enable to connect to internet from private subnet, but disable to connect to private subnet from internet
  • 2 way to create NAT in AWS, one is NAT instance (Community AMIs), the other is NAT Gateway
  • Create NAT
    • VPC menu -> Create a NAT gateway
    • Choose public subnet
    • Allocate Elastic IP
    • Update Route Table
    • Open Route table for private subnet and add rule Destination: 0.0.0.0/0, Target: NAT Gateway
  • https://docs.aws.amazon.com/ja_jp/vpc/latest/userguide/vpc-nat.html

Trouble Shoot

• ping
  • ICMP(Internet Control Message Protocal)
  • If server does not open ICMP, ping cannot reach
• traceroute
  • ICMP
  • Check routing table function
• telnet
  • Check the port can be reached
  • telnet [target] [port]
• nslookup, dig
  • Request to solve domain

tools

• CloudWatch
  • AWS Managed Service