The Core Networking Services

Lesson purpose

Networking moves data to and from AWS resources, and the right design depends on what the data is, how fast it must travel, how secure it must be, and who needs to reach it. This lesson builds the virtual network (Amazon VPC) from the ground up — address ranges, subnets, internet access, and firewalls — then covers the ways a VPC connects to other networks, the managed firewall services, DNS with Route 53, and content delivery with CloudFront. It supports CLF-C02 objectives 3.1, 3.2, and 3.5.

Learning objectives

• Explain what a VPC is and how default and nondefault VPCs differ.
• Read CIDR notation and choose VPC and subnet CIDR blocks.
• Explain subnets, Availability Zones, and public vs. private subnets.
• Describe internet gateways, route tables, public IP addresses, and Elastic IP addresses.
• Compare security groups and network ACLs.
• Compare VPC peering, site-to-site VPN, and Direct Connect.
• Describe Global Accelerator, AWS Network Firewall, Firewall Manager, and AWS WAF.
• Explain DNS name resolution, resource records, domain registration, and hosted zones in Route 53.
• Choose a Route 53 routing policy and health check for a scenario.
• Explain how CloudFront edge locations, price classes, and distributions speed up content delivery.

1. Amazon Virtual Private Cloud (VPC)

A VPC is a virtual network in AWS, logically isolated from every other network. It is the network backbone for EC2 and many other services.

• Default VPC — AWS creates one in every Region, with a default subnet in each Availability Zone and internet access already configured, so you can launch EC2 instances without any networking setup.
• Nondefault (custom) VPC — one you create. It is fully isolated until you explicitly connect it to the internet, other VPCs, or other networks. Production environments normally use custom VPCs designed on purpose.

A VPC belongs to one Region and spans all the Availability Zones in that Region.

2. CIDR blocks

Every VPC needs a Classless Inter-Domain Routing (CIDR) block — the range of private IPv4 addresses its resources can use. (CIDR is usually pronounced “cider.”)

• The number after the slash is the prefix length: how many bits are fixed. The smaller the number, the more addresses.
• VPC and subnet CIDRs must be between /16 (65,536 addresses) and /28 (16 addresses).
• The default VPC uses 172.31.0.0/16 (172.31.0.0–172.31.255.255).

CIDR	Range	Addresses
10.0.0.0/16	10.0.0.0 – 10.0.255.255	65,536
192.168.0.0/24	192.168.0.0 – 192.168.0.255	256
172.16.0.0/28	172.16.0.0 – 172.16.0.15	16

Quick math: addresses = 2^(32 − prefix). A /24 has 2^8 = 256.

Practical cautions:

• AWS reserves five addresses in every subnet (the first four and the last), so a /28 subnet has 11 usable addresses.
• Choose ranges that don’t overlap with office networks or other VPCs you may connect later — overlapping ranges can’t be peered or routed.
• A VPC can also get an Amazon-provided IPv6 /56 block on request.

3. Subnets

A subnet divides a VPC into smaller, isolated sections — for example, internet-facing web servers in one subnet and application or database servers in another.

• Each subnet’s CIDR is a subset of the VPC’s (for example, 172.31.16.0/20 inside 172.31.0.0/16).
• Each subnet exists in exactly one Availability Zone. For high availability, place matching subnets in at least two AZs (Lesson 4).
• Every EC2 instance is launched into a subnet.

4. Internet access

• An internet gateway is attached to a VPC and lets resources send and receive internet traffic.
• A route table controls where traffic from a subnet goes. A subnet whose route table has a default route (0.0.0.0/0) to the internet gateway is a public subnet. A subnet without that route is a private subnet.
• An instance also needs a public IP address:
  • Auto-assigned public IP — convenient, but it is released when the instance stops or terminates and can’t be moved.
  • Elastic IP (EIP) — allocated to your account, stays the same until you release it, and can be moved to another instance (useful for failover).

Modern note: AWS now charges an hourly fee for every public IPv4 address, including Elastic IPs, so release addresses you are not using.

(Instances in private subnets usually reach the internet for updates through a NAT gateway, which lets them start outbound connections without being reachable from the internet.)

5. Firewalls inside the VPC: security groups and NACLs

Security groups

A security group is a firewall attached to an instance (more precisely, its network interface). Every instance must have at least one.

• Inbound rules control who may send traffic to the instance; outbound rules control where the instance may send traffic.
• Allow rules only — anything not allowed is denied.
• Default behavior: no inbound rules (no unsolicited traffic gets in) and an outbound rule allowing all traffic.
• Stateful — if an instance sends a request out, the reply is allowed back in automatically, regardless of inbound rules.
• Every VPC has a default security group you can modify.

Example: to make a web server public, add an inbound rule allowing HTTP (TCP 80) and HTTPS (TCP 443) from 0.0.0.0/0. Allow SSH (TCP 22) only from your own IP address.

Network access control lists (NACLs)

A NACL is a firewall at the subnet boundary.

• Controls traffic entering and leaving the subnet; it cannot filter traffic between instances in the same subnet.
• The default NACL allows all inbound and outbound traffic. (A new custom NACL denies everything until you add rules.)
• Has allow and deny rules, evaluated in number order.
• Stateless — return traffic must be explicitly allowed.
• Each subnet is associated with one NACL; one NACL can serve many subnets.

	Security group	Network ACL
Applies to	Instance (network interface)	Subnet
Rules	Allow only	Allow and deny
State	Stateful	Stateless
Default	Deny all inbound, allow all outbound	Default NACL allows all
Typical use	Main, detailed access control	Broad subnet-level guardrail, blocking specific addresses

6. Connecting a VPC to other networks

Option	Connects	Path	Key traits
VPC peering	Exactly two VPCs	Private AWS network	Same or different Regions or accounts; no internet needed; not transitive
Site-to-site VPN	VPC ↔ office or data center	Encrypted tunnel over the internet	Quick and inexpensive; performance depends on the internet
Direct Connect	VPC and AWS public services ↔ your network	Dedicated private link	Consistent speed and latency; costs more; no internet access included

VPC peering

A private, point-to-point connection between two VPCs so their resources (such as instances or network load balancers) can talk over AWS’s private network. It is fast, reliable, and secure. Peering is not transitive: if A peers with B and B peers with C, A cannot reach C through B. (Connecting many VPCs is usually done with AWS Transit Gateway, a hub for VPCs and VPNs.)

Site-to-site VPN

• Create a virtual private gateway and attach it to the VPC.
• Configure the customer gateway — your physical or virtual router or firewall (AWS has tested devices from Cisco, Juniper, Palo Alto Networks, Check Point, and others).
• Traffic is encrypted with AES 128- or 256-bit encryption. Routes can be static or exchanged dynamically with Border Gateway Protocol (BGP).
• A VPC can have up to 10 VPN connections.

AWS Direct Connect

• A dedicated network link between your location and AWS, provided through AWS partners, with consistent performance instead of unpredictable internet latency.
• Reaches your VPCs and public AWS services such as S3 without using the internet.
• Dedicated connections run at high speeds (the book lists 1 and 10 Gbps; faster options now exist). Hosted connections from partners offer lower speeds, from 50 Mbps up.
• Does not provide internet access — keep a separate internet connection.
• More expensive than VPN; choose it for large, steady data transfer or strict performance needs. Many organizations add a VPN as a backup.

7. AWS Global Accelerator

When an application runs in several Regions, managing separate addresses per Region is awkward. Global Accelerator provides two static anycast IPv4 addresses advertised from AWS points of presence (POPs) worldwide.

• Users connect to the nearest POP, and traffic then travels over the AWS global network rather than the public internet.
• If a POP fails, users are routed to another automatically.
• A listener receives connections and forwards them to endpoints you choose: Elastic IPs, load balancers, or EC2 instances, in any Region.

Global Accelerator vs. CloudFront: CloudFront caches content at the edge; Global Accelerator routes traffic (any TCP/UDP application) over AWS’s network to the best healthy endpoint.

8. Managed firewall services

• AWS Network Firewall — a scalable, managed firewall that protects multiple VPCs and subnets, even across accounts. It provides stateless and stateful packet filtering, web (domain) filtering, and intrusion detection and prevention. Route tables send traffic through it. Charged per hour and per GB.
• AWS Firewall Manager — centrally configures and enforces consistent rules across an AWS Organization: security groups, Network Firewall, Route 53 DNS Firewall, AWS WAF rules, and more. It reports noncompliant resources and can fix them automatically.
• AWS WAF (Web Application Firewall) — inspects HTTP and HTTPS requests to Application Load Balancers, CloudFront, and similar services. Unlike security groups and NACLs, which look only at addresses, ports, and protocols, WAF examines the request itself to block SQL injection, cross-site scripting (XSS), abnormally long query strings, and traffic from particular IP ranges or countries. Lambda functions can update block lists, for example from threat feeds or from logs showing an HTTP flood.

Layering example: WAF filters malicious web requests, the load balancer’s security group allows only web traffic, the instances’ security group allows traffic only from the load balancer, and a NACL blocks a known-bad address range at the subnet.

9. Amazon Route 53 (DNS)

Route 53 is AWS’s global Domain Name System (DNS) service. DNS translates human-friendly names (example.com) into IP addresses — name resolution:

1. Your computer asks its configured DNS server for example.com.
2. That server asks the domain’s authoritative DNS server.
3. The authoritative server replies with the IP address, and the browser connects.

Resource records

DNS stores more than IPv4 addresses. A record’s key fields are name, type, and value:

Name	Type	Value
benpiper.com	A (IPv4 address)	93.184.216.34
www.benpiper.com	A (IPv4 address)	93.184.216.34
benpiper.com	MX (mail exchange)	10 in1-smtp.messagingengine.com

Other common types: AAAA (IPv6 address), CNAME (alias to another name), TXT (arbitrary text, often used to verify domain ownership). MX records are how email finds the right mail server.

Domain registration vs. DNS hosting

• A public domain name can be resolved by anyone on the internet and must be registered with a registrar under a top-level domain (TLD) such as .com, .net, or .org. Registration lasts 1–10 years and can be renewed indefinitely. Domains can be transferred to Route 53 (adding at least a year).
• Registration (owning the name) and DNS hosting (answering queries for it) are separate jobs; Route 53 does both, but they can be different companies.

Hosted zones

• Public hosted zone — hosts the records for a public domain. Registering a domain with Route 53 creates one automatically.
• Private hosted zone — resolves names only inside the VPCs you associate with it. Example: db.example.com points to a database server, so applications don’t hard-code IP addresses. Private names need no registration.

Routing policies

Policy	What it does	Example
Simple (default)	One name → one value; no health checks	A single web server
Weighted	Splits traffic by ratio	Send 10% of users to a new server version
Latency	Sends users to the Region with the lowest latency for them	Europeans to eu-west-1, Americans to us-east-1
Failover	Primary unless unhealthy, then secondary	Disaster recovery site
Geolocation	Routes by the user’s continent, country, or state	Country-specific content or legal requirements
Multivalue answer	Returns several healthy records in random order	Simple load spreading
Geoproximity (Traffic Flow)	Routes by physical distance to resources, adjustable with a bias	Shift traffic between nearby Regions

Health checks

Every policy except Simple can use health checks, run every 10 or 30 seconds:

• Endpoint — connects over HTTP, HTTPS, or TCP from health checkers in several Regions.
• CloudWatch alarm — treats a resource as unhealthy when an alarm fires (for example, high latency).
• Calculated — combines the results of other health checks.

Traffic Flow

For complex routing, the Traffic Flow visual editor builds a diagram (a traffic policy) and applies it to a domain through a single policy record, which carries a monthly charge. Traffic Flow is the way to use geoproximity routing.

10. Amazon CloudFront

CloudFront is AWS’s content delivery network (CDN). Without it, users far from the Region hosting a site see more latency. CloudFront caches content at edge locations worldwide (the book says 150+; there are now hundreds) and sends each user to the edge location with the best performance — usually the closest. Copies at many edge locations also improve availability.

Price classes

You can’t pick individual edge locations; instead choose a price class — more locations cost more:

• United States, Canada, and Europe
• United States, Canada, Europe, Asia, and Africa
• All edge locations (best performance)

Distributions and origins

A distribution defines what CloudFront caches and where it gets the content — the origin, the authoritative source (a web server, load balancer, or S3 bucket). Users reach it over HTTP or HTTPS. Distributions deliver static and dynamic content, including web pages, images, and live or on-demand video.

Corrections to the book:

• The book describes separate Web and RTMP distributions. AWS discontinued RTMP distributions in 2020; today every distribution is a web distribution, and streaming uses HTTP-based formats.
• The book says an S3 origin must be public. Current practice is the opposite: keep the bucket private and let only CloudFront read it using Origin Access Control (OAC), so users can’t bypass CloudFront.

CloudFront also integrates with AWS WAF and AWS Shield for protection at the edge.

Classroom application

• Design a VPC on paper: Given 10.0.0.0/16, create a public and a private subnet in each of two AZs (for example, four /24s). Mark which route table points to the internet gateway.
• Console tour: In the default VPC, find the CIDR, the default subnets and their AZs, the route table’s 0.0.0.0/0 route, the internet gateway, and the default security group and NACL.
• Firewall practice: Write security group rules for a public web server, an application server that accepts traffic only from the web tier, and a database that accepts traffic only from the application tier.
• Connectivity choice: A small office needs occasional access to one VPC (VPN); a hospital transfers terabytes daily and needs predictable latency (Direct Connect, with VPN backup); two VPCs in different accounts must share a service (peering).
• Routing policy match: A/B test of a new site (weighted), global users wanting speed (latency), DR site (failover), content restricted by country (geolocation).
• DNS lookup: Run nslookup or dig on a familiar domain and identify the A and MX records.

Common misconceptions

• “A subnet can span Availability Zones.” Each subnet lives in exactly one AZ; the VPC spans the Region.
• “A bigger prefix number means a bigger network.” It is the reverse: /16 is much larger than /28.
• “An internet gateway alone makes a subnet public.” The subnet’s route table must also route 0.0.0.0/0 to it, and instances need public IPs.
• “Security groups and NACLs are the same thing.” Security groups are stateful, allow-only, and instance-level; NACLs are stateless, allow-and-deny, and subnet-level.
• “Direct Connect gives me internet access.” It connects to AWS only.
• “VPC peering is transitive.” Each pair of VPCs needs its own peering connection (or use Transit Gateway).
• “Registering a domain and hosting its DNS are the same.” They are separate services that Route 53 happens to offer together.
• “CloudFront needs a public bucket.” Use a private bucket with Origin Access Control.

Lesson summary

A VPC is a logically isolated virtual network in one Region, defined by a CIDR block between /16 and /28 and divided into subnets that each live in one Availability Zone. An internet gateway plus a default route makes a subnet public, and instances reach the internet with auto-assigned public IPs or movable Elastic IPs. Security groups are stateful, allow-only firewalls on instances; NACLs are stateless, allow-and-deny firewalls on subnets. VPCs connect to each other with peering, to offices over encrypted site-to-site VPNs, and to data centers over private Direct Connect links. Global Accelerator provides static anycast addresses that route users over AWS’s network, while Network Firewall, Firewall Manager, and WAF add managed network, organization-wide, and web-application protection. Route 53 registers domains and hosts DNS in public and private hosted zones, using simple, weighted, latency, failover, geolocation, multivalue, and geoproximity routing with health checks. CloudFront caches content at edge locations worldwide through distributions that pull from an origin, improving speed and availability.