Setting up VPC, Public and Private Subnets, NAT, Internet Gateway, and Route Tables on AWS

If you're new to Amazon Web Services (AWS) and looking to set up your Virtual Private Cloud (VPC) along with subnets, NAT, Internet Gateway, and route tables? In this guide, we'll take a look at some use cases and walk you through the process of setting up these services step by step, making it easy for you to understand and implement.

In today's digital landscape, businesses and individuals alike are embracing the power and flexibility of cloud computing to drive innovation, streamline operations, and scale their applications. As the leading cloud services provider, Amazon Web Services (AWS) offers a comprehensive suite of tools and services to meet the diverse needs of cloud users worldwide. Whether you're a seasoned IT professional or a newcomer to the world of cloud computing, understanding the foundational elements of AWS is essential for success.

Before we begin, have a look at the architecture diagram that illustrates how the VPC will be structured. These diagrams are crucial for visualizing our setup and guiding us towards our objectives. They also serve as a useful tool for testing whether the implemented configuration aligns with our desired outcomes. We'll also have a look at some use cases to help with better understanding.

Use Cases:

To understand how these services all come together we'll break down how each component (subnets, internet gateway, route tables, and NAT gateway) into the following use cases:

Web Application Hosting:
-Internet Gateway: Allows resources in public subnets to communicate with the internet, enabling access to web servers.
-Subnets: You'll have public subnets for hosting web servers accessible to users on the internet. Backend application servers and databases will be placed in private subnets for enhanced security.
-Route Tables: Routes traffic from public subnets to the internet gateway for outbound internet access.
-NAT Gateway: Not typically used in this scenario unless backend servers need to initiate outbound connections.

Big Data Processing:
-Internet Gateway: Used for data ingestion tools in public subnets to access external data sources or services.
-Subnets: Public subnets host data ingestion and analysis tools, while private subnets contain databases and processing clusters.
-Route Tables: Routes traffic between public and private subnets, allowing communication between data processing tools and databases.
-NAT Gateway: May be used in private subnets for outbound internet access if necessary.

Multi-tier Architecture:
-Internet Gateway: Allows communication between front-end servers and the internet.
-Subnets: Front-end tier hosted in public subnet, middle-tier application servers in another public subnet, and back-end database tier in private subnet.
-Route Tables: Directs traffic between different tiers of the application, ensuring proper communication and security.
-NAT Gateway: Used for outbound internet access from the private subnet, if required for backend processes.

Hybrid Cloud Deployment:
-Internet Gateway: Facilitates connectivity between on-premises infrastructure and AWS resources.
-Subnets: Used to segment resources between on-premises infrastructure and AWS resources.
-Route Tables: Routes traffic between on-premises network and AWS VPC, ensuring proper communication.
-NAT Gateway: May be used for outbound internet access from private subnets within the VPC.

VPN Connectivity:
-Internet Gateway: Enables secure connection between corporate network and VPC.
-Subnets: Provide connectivity between a corporate network and VPC resources.
-Route Tables: Directs VPN traffic between a corporate network and VPC, ensuring secure communication.
-NAT Gateway: This may be used for outbound internet access from private subnets, depending on the VPN setup.

Containerized Workloads:
-Internet Gateway: Allows containers in public subnets to communicate with external services if needed.
-Subnets: Used to deploy containerized applications, with public or private subnets based on access requirements.
-Route Tables: Directs traffic between containers and other resources within the VPC, ensuring proper communication.
-NAT Gateway: May be used for outbound internet access from private subnets containing containers.

Each component plays a crucial role in facilitating communication, security, and connectivity within the VPC environment, tailored to specific use cases and networking requirements.

Why do we use a VPC?

Think of a VPC as your own virtual data center in the AWS cloud. By creating a VPC, you're essentially defining the boundaries of your network environment. Just like in a physical data center, where you set up walls to separate different areas, creating a VPC allows you to isolate your resources logically. This step establishes the foundation of your network infrastructure in AWS. With a VPC, you can securely separate and manage your resources in the AWS cloud, much like you would with a network in a traditional on-premises environment.

Step 1: Create a VPC

1. Sign in to the AWS Management Console.
2. Navigate to the VPC dashboard.
3. Click on "Create VPC."
4. Specify the CIDR block for your VPC. This defines the range of IP addresses for your VPC.
5. Configure any additional settings as needed, such as DHCP options.
6. Click on "Create VPC" to create your VPC.

What you should see after creating:

What is an Internet Gateway used for?

An Internet Gateway is like a bridge that connects your VPC to the internet. It allows resources within your public subnets to communicate with the outside world. Without an Internet Gateway, your public-facing resources wouldn't be reachable from the internet, much like a house without a driveway can't be accessed from the street.

Step 2: Configuring Internet Gateway (IGW)

1. Navigate to the "Internet Gateways" section in the VPC dashboard.

1. Click on "Create internet gateway."
2. Attach the newly created internet gateway to your VPC by selecting the VPC and clicking on "Attach internet gateway."

Why do we use Subnets?

Think of your VPC like a piece of land, and subnets as different parts of that land. Public subnets are like streets in a city where everyone can go, such as sidewalks where people walk freely. This is where you'd put things like web servers that need to be reached from the internet. Meanwhile, private subnets are more like gated communities, where only residents can enter. It's similar to neighborhoods where houses are private. Here, you'd deploy things like databases and application servers that don't need to be accessed directly from the internet, making them more secure by keeping them away from public access.

Step 3: Setting up Public and Private Subnets

1. After creating the VPC, navigate to the "Subnets" section in the VPC dashboard.

1. Click on "Create subnet."
2. Choose the VPC that you created earlier.
3. Specify the CIDR block for the subnet.
4. Choose the availability zone for the subnet.

1. Repeat the process to create both public and private subnets, ensuring that each subnet is associated with the correct route table.

Why do we need route tables?

Route tables act as maps for directing traffic within your VPC. Just as you need road signs to navigate through a city, route tables determine where network traffic should go based on its destination. By configuring route tables, you're essentially telling AWS how to route traffic between different subnets and out to the internet. For example, you'll set up routes to direct traffic destined for the Internet to the Internet Gateway and routes to direct internal traffic between subnets.

Step 4: Configure Route Tables

1. Go to the "Route Tables" section in the VPC dashboard.
2. Create a route table associated with your VPC.

1. Add a route to the internet gateway (0.0.0.0/0) to enable outbound internet access for resources in the public subnet.

1. Go to the Subnet Association tab and click on Edit Subnet Association

1. Select the route table associated with your subnet

This is how it should look like

1. Select the route table associated with your private subnet.
2. Add routes for any services or resources that your private subnet needs to access, such as NAT Gateway or Virtual Private Gateway.

What is a NAT Gateway used for?

Setting up a NAT Gateway for your private subnet is like having a translator. It lets devices in your private area talk to the internet without revealing their private details. Picture it as a receptionist at a gated community. They take requests from residents who want to send packages (network requests) outside, but they don't share where those residents live (private IP addresses) to keep things safe.

Step 5: Set Up NAT Gateway (for Private Subnet)

1. Navigate to the "NAT Gateways" section in the VPC dashboard.
2. Click on "Create NAT Gateway."
3. Choose the subnet for the NAT Gateway (typically the public subnet).
4. Allocate an Elastic IP address for the NAT Gateway.
5. Create the NAT Gateway.

Step 6: Update Route Tables for Private Subnet

1. After creating the NAT Gateway, update the route table associated with the private subnet.
2. Add a route to the NAT Gateway (0.0.0.0/0) to enable outbound internet access for resources in the private subnet.

After setting up the NAT Gateway, you need to update the route tables associated with your private subnets to ensure that outbound traffic is directed through the NAT Gateway. This ensures that resources in your private subnets can access the internet securely via the NAT Gateway.

Conclusion

Congratulations! You've successfully set up your VPC infrastructure on AWS, laying the foundation for your cloud projects. With a secure and scalable network environment in place, you're ready to deploy and manage your applications with confidence. Whether you're hosting web applications, processing big data, or extending your on-premises infrastructure to the cloud, a well-designed VPC ensures optimal performance, security, and connectivity. As you continue your journey in the cloud, remember to adhere to AWS best practices and explore additional services to unlock the full potential of the AWS platform. Happy cloud computing!

P.S. Don't forget to delete all the resource instances we've created when you're done.