网络课程笔记

00:00 Hello and welcome to this lecture subnets, route tables and the Internet Gateway.

00:04 So in the earlier lecture what we have seen, uh, how to address the VPC using Cidr notation and what

00:10 that Cidr means.

00:11 And then how to subdivide the VPC address range in the form of subnets.

00:15 And we saw how to size your subnets.

00:18 Now let's deep dive further into the subnets route tables and the internet gateways.

00:23 So when you create a VPC the first thing you need to decide is which region you want to create that

00:28 the scope of the VPC is region level.

00:31 Now as you know, every region comes with multiple availability zones.

00:34 So VPC can have uh, its presence in uh, multiple availability zones.

00:39 And it is decided by subnet.

00:41 Subnet has a scope at easy level.

00:43 That means when you create a VPC and when you create a subnet, you have to at that moment decide the

00:50 subnet would be in AZ one or AZ two.

00:52 Now subnet cannot be in two phases at the same time right?

00:55 Subnet would be restricted to a given availability zone.

00:59 Now when you create a VPC it also creates two things for you.

01:03 One there is a local router.

01:05 Now this router is responsible for all the communication between all the subnets within the VPC.

01:10 And then there is a main route table which actually contains the rule which dictates how the traffic

01:17 would flow between the subnets inside a VPC.

01:21 So what you do is you create multiple subnets.

01:24 Now here you can see I created two subnets uh subnet A in AZ one and subnet B in AZ two.

01:30 And I have allocated uh cider range uh like we saw in the earlier lecture.

01:36 Now the question is when you create this kind of subnets and then suppose you launch EC2 instances within

01:41 these subnets it will get uh IP address.

01:44 It's a private IP again from the subnet range.

01:47 Now by default it will pick a random IP address from the subnet range.

01:51 But if you want you can also choose the one of the IP address from the given subnet range.

01:57 But there are some IP addresses which you cannot use.

01:59 And we'll see that shortly.

02:01 So uh, these are the two instances in two different subnets.

02:04 Now the question is can instance a for example talk to instance b in subnet B.

02:10 So how it is decided that whether the network uh is can be established between these two instances.

02:17 So of course when instance A uh wants to communicate to instance B, uh it will look at the subnet route

02:25 table, right.

02:26 Whether there is a route exist between a traffic from subnet A to subnet B.

02:31 Now if you closely look at the route table which is here right.

02:36 It just has one entry by default which looks something like this.

02:39 It has a destination address as VPC address.

02:42 And the target is a local router.

02:44 Now this local router is responsible for any communication for which the destination address is inside

02:52 this range.

02:53 Ten .10.00 16 now from this instance, if I do a ping to this machine, the target address is this machine's

03:00 address, which is ten .1.1.11.

03:03 Now if you closely look at this, this address is a part of my VPC address range.

03:08 That means when this instance initiates the connection or a ping request and it will go to the route

03:16 table, it will check is there a route to reach to this IP address.

03:20 So it will look at this address.

03:21 This is a superset of this address.

03:23 So yes there is a destination and the target is local.

03:28 So it will take the path from local router.

03:31 It will reach to the instance.

03:33 That means by default whenever you create a VPC and you create multiple subnets, every instance in

03:40 every subnet can communicate with any other instance in any other subnet.

03:44 That's because there is always this rule in all the route tables within the VPC.

03:50 Right now there is just one route table which is a main route table.

03:53 But even if you create a custom route table, it will always have this entry.

03:57 And you cannot remove this.

03:58 That means there will always be a network connectivity between all the subnets within the VPC.

04:04 So this could be a question in your exam sometimes.

04:06 And you need to remember that always all subnets uh and EC2 instances within the subnet can communicate

04:12 with each other by default.

04:14 And we are still not talking about the firewalls.

04:17 Uh, what do I mean by that?

04:19 Is maybe instance B can stop the network traffic from instance A at firewall level.

04:25 But we are not talking about firewall.

04:27 We are talking about the network connection which is always there.

04:30 So these are two different things.

04:31 And please remember that okay.

04:35 So that means instance A can talk to instance B uh through this local router and by following the main

04:40 route table.

04:41 Now the question comes can my instances communicate with the internet.

04:46 Right.

04:47 Of course the answer is no.

04:48 But why.

04:49 So there are multiple reasons to it.

04:50 First, this VPC itself has no gateway which can connect this VPC to the internet.

04:57 If you remember in the last lecture I talked.

04:59 About VPC is a private IP address isolated private IP address.

05:03 Right.

05:04 So that means, uh, this network is not connected to internet directly.

05:08 If you want to do that, the first thing you need to do is to, uh, add an internet gateway attached

05:14 to your VPC.

05:15 And, uh, it enables the internet connectivity for your VPC, but just adding internet gateway, does

05:22 that solve the problem?

05:23 Does that mean my instance here can talk to internet now?

05:27 So again the answer depends on now uh next part of the things.

05:31 Right.

05:32 So if you want to communicate with the internet your instance in a public subnet, it must also have

05:38 the public IP address.

05:39 So assuming we also grant or attach a public IP address to this instance how to do that.

05:44 We'll see later.

05:45 But assume that along with this private IP it also has a public IP.

05:48 Now can this instance talk to internet.

05:51 Right now.

05:52 The next part is it will look at the main route table.

05:56 Again.

05:57 It will check.

05:58 Is there a route to go to the public internet.

06:00 So for example you are trying to reach to Amazon.com and it would have some public IP address.

06:05 So is there a way I can reach to Amazon.com IP address by looking at this route table?

06:10 No, there is no entry to that.

06:11 That means this instance can still cannot talk to internet because there is no route for the internet

06:18 IP address.

06:19 Now what if you add this IP address?

06:22 You know that any address can be matched with 0.0.0.0/0.

06:27 That means now I'm adding a route entry in this route table.

06:31 And I'm saying if the traffic is for this IP address range that is internet IP address range, uh,

06:37 traffic will flow through the internet gateway.

06:39 And I'm modifying this main route table.

06:41 So if I do that and if I my instance has a public IP, actually I can communicate with the internet.

06:49 Right.

06:49 So this is how, uh, internet connectivity can be established.

06:53 Now please pardon me for the public IP address.

06:55 I haven't shown that.

06:56 But assume that along with the private IP, there is also a public IP.

07:00 Right.

07:01 Uh, only with private IP directly.

07:04 Uh, your instances cannot talk to the internet.

07:07 Okay.

07:08 So that's, uh, uh, that's what we wanted to see.

07:11 Now, the next part is, uh, what if I only want, uh, this instance to talk to internet and not this

07:19 instance if I modify the main route table and add an route entry for internet gateway, my both the

07:26 instances in both the subnets would be able to talk to internet.

07:29 That's because both these subnets are following the main route table by default.

07:33 Right.

07:33 So many a times it would happen like you would you would want to control, uh, a traffic differently

07:39 based on what kind of workloads you have and whether they are part of a public subnet or a private subnet.

07:44 For an example, if it's a database, you won't put your databases in the, uh, public subnet.

07:50 Right.

07:50 You will keep that, uh, in a private subnet and only instances maybe your web server, which is there

07:56 in a public subnet, can talk to your database in a private subnet.

07:59 In that case, you don't want to expose your database to the internet.

08:02 So you want to make sure you control the traffic from your subnets.

08:07 And in that case, what you will do rather than following the main route table, you can also create

08:14 your custom route table right.

08:16 So you can create a custom route table for subnet A and attach it to the subnet A.

08:21 And then you can add corresponding route here say if traffic is going uh, to internet then uh route

08:28 it through internet gateway.

08:30 And now as soon as you attach this route table to subnet A it, it stops following the main route table.

08:36 That means now it no more looks at the main route table.

08:39 It will always follow the, uh, its own route table.

08:42 That's the first thing.

08:43 But as as of now, the subnet B will still follow the main route table because we haven't created a

08:49 custom route table for the subnet B.

08:52 So now, uh, you can also create a dedicated route table for subnet B.

08:56 And as I said you don't want to enable the internet connectivity for subnet B.

09:00 In that case it would have again a single entry, which uh comes by default with when you create a new

09:06 route table.

09:06 Right.

09:07 And it would have the entry ten .0.00 16 and route the traffic through local router similar to your

09:13 main route table, but just that we, uh, explicitly created one route table and attach it to subnet.

09:20 Right.

09:20 So if you create, uh, two subnets now and attach to your uh, corresponding, uh, subnets, uh,

09:26 these subnets would not follow the main route table.

09:29 Now, any changes you make to the main route table will not affect your this subnets routes in any way.

09:37 Okay.

09:37 So I hope, uh, this is clear.

09:39 That means you can create a custom route table, and you can add and remove the routes as you want,

09:44 except this route, which will always be there in any of the route table within the VPC.

09:50 Okay.

09:50 So that means, uh, my instance B actually cannot talk to the internet.

09:56 And now subnets are not following the main route.

10:01 Okay, so I hope this is clear.

10:03 So, uh, what is route table?

10:05 It contains the rules to route the traffic in and out of your subnet.

10:09 The way we just saw, there is always a main route table at the VPC level, which you cannot delete.

10:15 Uh, if you create a subnet and do not create a dedicated route table for the subnet, your subnet would

10:20 always follow the main route table.

10:23 Now you can create a custom route table at the subnet level.

10:26 And uh, all the route tables within the VPC where there is a main route table or a custom route table

10:31 would always have an immutable local route entry, uh, where the destination address is same as your

10:37 VPC Cidr address range, and you can modify even the main route table as well.

10:43 That means if, uh, you know that all the subnets in my VPC want to have the same kind of network connectivity.

10:50 So rather than creating an individual route table for every subnet and adding the same rules there,

10:56 uh, it would make sense that you just modify the main route table and add all the routes there.

11:00 Right.

11:01 And then you don't need to create a custom, uh, route table at subnet level.

11:05 So this is up to you how you want to design, uh, your VPC and the route tables.

11:10 So again a few things you need to remember.

11:13 Subnet has two terms I can say a public subnet and a private subnet.

11:18 So the distinction is just about the route table.

11:21 Basically if the subnet route table has an entry for Internet gateway uh it is called a public subnet.

11:28 So typically you will have your Nat gateways or web server or load balancer inside the public subnet

11:34 because they need to communicate with the internet directly.

11:39 So that's a public subnet.

11:41 And the subnet which does not have a direct route for the internet gateway is called a private subnet.

11:47 So here I'm just showing a public subnet a subnet route table.

11:51 Uh always there is a local route as you know, as per the VPC address range.

11:54 And there will be IP address range and corresponding internet gateway.

11:59 Similarly private subnet no route to internet instances receives only private IP addresses, and they

12:04 are typically used uh uh for, say, databases or application server, which need not be accessed from

12:11 internet directly.

12:12 Right.

12:13 So that's the purpose of private subnets.

12:15 So it would only have by default the route uh for uh VPC destination.

12:21 Uh, as you know, we cannot even remove this route.

12:24 So that's essentially a public and a private subnet.

12:28 So just last part of it, this very important that you remember this part.

12:33 Any subnet that you create five IP addresses are reserved.

12:37 And you cannot use those five IP addresses in a given subnet.

12:41 Now if you create a subnet of Cidr say ten .0.0.0, slash 24, then first four addresses and the last

12:50 address in this subnet cannot be used.

12:52 Uh, when I say cannot be used, that means you cannot allocate that IP address to EC2 instance, which

12:57 also means in this subnet, uh, total IP addresses are 256 and five are gone.

13:03 So you can only use 251 addresses.

13:06 And that means you can only host 251 EC2 instances in this subnets.

13:11 Maximum.

13:12 Right.

13:12 So you need to remember that the first address is a network address.

13:16 The second address is uh reserved by AWS for inter VPC communication.

13:21 Address plus two is for DNS.

13:23 And we'll see that in a DNS lecture.

13:26 Uh address three is reserved by uh reserve for a future use.

13:30 And you know, in the network typically the last address is a broadcast address.

13:35 And AWS does not support the broadcasting.

13:37 And that's where even this address cannot be used.

13:40 So remember that, uh, when you want to select the subnet Sidr, uh, prefix, for example, whether

13:47 it should be 24 or 20 5 or 26, you need to make calculations.

13:51 Suppose you want 29 IP addresses, uh, in a subnet.

13:55 Then you cannot, uh, choose the subnet size with uh, 27 because as you know, no, uh, it would

14:02 mean that 32 -27 is five.

14:05 So two raised to five.

14:06 You would have 32 IP addresses if you create the subnet with prefix 27.

14:11 And out of this 32 five IP addresses you cannot use, that means only 27 addresses would be, uh, useful.

14:19 But you need 29 addresses.

14:21 Right.

14:22 And which means you need to create a subnet with uh, at least slash 26, uh, prefix.

14:28 So if you create with slash 26, you get 59 usable IP address, actually 64 minus five which are reserved.

14:36 So 59 and 59 of course is more than 29.

14:40 So you need to create a subnet with prefix slash 26.

14:43 So this kind of questions might come where given uh the requirement of number of IP address within the

14:49 subnet, you have to choose the minimum uh Sidr prefix.

14:55 Right.

14:55 So make sure you consider these additional five IP addresses.

14:59 Right.

14:59 You cannot use it.

15:00 Now that means the smallest size subnet you create is slash 28.

15:04 Right from the last lecture you might remember, uh, with slash 28, uh, you get two raised to four.

15:10 That is 16 IP addresses in the subnet.

15:13 And out of 16 five IP addresses you cannot use, that means only 11 EC2 instances you can create in

15:20 a subnet with the Cidr slash 28.

15:22 So these are just a calculations.

15:24 And I hope now you can make those calculations.

15:27 Uh, given a scenario okay.

15:29 With this.

15:29 Let's stop here for this lecture.

15:31 In the following lecture we will see different types of the IP addresses.

15:36 Uh, in a VPC, uh public private elastic.

15:39 And also we will see IPv4 and IPv6 addresses.

15:43 So thanks for watching and see you in the next lecture.