Design a VPC on paper and defend every subnet

short · 40 min · Objective 1.3

Task

Design the network layer of a small cloud deployment — address space, public and private subnets, gateways, and the route tables that make them behave differently — and justify each decision. Cloud networking questions are addressing and routing questions wearing new vocabulary.

Steps

  1. Allocate 10.20.0.0/16 to the VPC. Split it for two availability zones, each with one public and one private subnet, each a /24. Write the four subnet addresses.
  2. Decide what goes where. Load balancer and bastion in public; application servers and database in private. Write one sentence for each explaining why.
  3. Design the route tables. The public subnets get a default route to an internet gateway. The private subnets get a default route to a NAT gateway that lives in a public subnet. State what each route table's 0.0.0.0/0 entry points at.
  4. Answer the question that separates the two gateways: what happens to an unsolicited inbound connection to a private instance, and why is that different from an outbound software update it initiates itself?
  5. Add the two remaining pieces from the objective. Where would a VPN gateway attach for a site-to-site link to your office, and what would VPC peering give you that routing through the internet gateway would not?

Verify

python3 -c "
import ipaddress
vpc = ipaddress.ip_network('10.20.0.0/16')
subs = list(vpc.subnets(new_prefix=24))[:4]
roles = ['az-a public','az-a private','az-b public','az-b private']
for s, r in zip(subs, roles):
    gw = 'internet gateway' if 'public' in r else 'NAT gateway'
    print(f'{str(s):<16}{r:<14}default route -> {gw}   usable {s.num_addresses-2}')
print('peering keeps traffic on the provider backbone, private addresses, no NAT')
"

Four subnets, two default routes pointing at different gateways. If your paper design has the private subnets routing to the internet gateway, you have built a public subnet and called it private.

Notes

The distinction the exam wants is direction. An internet gateway allows traffic both ways; a NAT gateway allows outbound only, because return traffic is permitted solely as part of a flow the instance started. That is the same stateful behaviour as the firewalls in domain 4, applied at the cloud edge.

The cloud providers each use different names for the same objects — VPC, VNet, transit gateway, virtual network gateway. The exam uses the generic terms, and the underlying design is what transfers.