网络课程笔记

00:00 Hello, and welcome to this exercise.

00:02 We are continuing the previous setup that we had created,

00:05 where we had one VPC with a public subnet,

00:08 and then we just launched one EC2 instance

00:11 and connected to it over Internet.

00:13 Now we are extending the same exercise,

00:15 and this time we want to

00:16 add one more subnet to the same setup.

00:19 But this will be a private subnet.

00:22 So as it's a private subnet,

00:24 we will create one route table for the subnet

00:27 and we won't add any additional rule there.

00:31 It would have a default route for our local router.

00:35 So I hope you remember what is private and public subnet.

00:39 And we are just going to do the same.

00:41 So essentially, we will create this subnet.

00:43 We will have now another EC2 instance in this subnet

00:47 as being a private subnet,

00:48 we will launch a private EC2 instance

00:51 with just one private IP address.

00:53 It won't have the public IP address.

00:55 Now, the question is, how do you reach to this instance?

00:59 Can you reach to this instance from Internet directly?

01:02 No, because it's not in a public subnet

01:04 and it does not have the public IP address.

01:08 So if you think, the only way to reach to these instances

01:12 from this EC2 instance.

01:13 Because you can reach to this public instance

01:16 and because these are part of the same VPC.

01:19 You know that there is a route

01:21 which is this local route,

01:22 which allows a traffic to go from this particular EC2

01:25 instance to this particular EC2 instance.

01:28 So this is what we are going to do in this exercise.

01:32 So the steps are,

01:33 we will be creating one more subnet

01:35 with a different CIDR,

01:37 and then we'll create one more route table

01:40 and we won't add

01:41 any additional routes there.

01:44 Then we will associate this route table

01:45 with the private subnet that we created.

01:48 And similarly,

01:49 we will launch one more EC2 instance

01:52 in this private subnet.

01:53 But this time, it won't have the public IP address.

01:56 Also we'll create a security group for this instance.

01:59 We'll call this instance as EC2-B.

02:01 Now you need to think what should be the inbound rule

02:05 in the security group of this EC2-B instance.

02:10 Now, if you, again, look at this particular diagram,

02:13 the traffic, this instance will receive is only

02:16 from this instance

02:17 or this sub-net, for example.

02:19 So you need to open a security group inbound rule

02:22 only for either this instance,

02:24 or you want to make it like available

02:26 for all the instances in this subnet.

02:27 You can add the subnet CIDR,

02:30 which is a private IP CIDR.

02:32 So there are multiple options,

02:33 but understand that you can't reach to this instance

02:36 directly from the Internet.

02:37 So adding my IP or Internet,

02:40 but they won't help likewise.

02:43 So let's do the exercise.

02:45 I'm just going to continue with the same steps

02:49 that have been shown here.

02:51 And I'll come to this additional step just

02:54 after we create an infrastructure.

02:56 So I'm going to my EC2 instance again.

03:00 This time first, I'll go to the VPC.

03:02 I'll go to the subnets, and I will create a new subnet.

03:07 I will call it my,

03:09 just a minute.

03:10 It's refreshing.

03:12 So I'll call this subnet as a name of my VPC,

03:15 just so that I can identify

03:17 and I call it private.

03:20 I will select my VPC

03:22 and I will select another

03:23 availability zone this time,

03:25 just to make sure I have subnet

03:28 across two different availability zone

03:30 and the CIDR 10.100.1.0/24.

03:34 If you remember,

03:35 we already had a 0024 allocated to public subnet.

03:39 That's where we can't use the same range here.

03:41 If you tried to do that,

03:43 it will say that it already exist.

03:45 So we are just making it 1.0/24.

03:50 Okay. The subnet has been created.

03:52 Now. I want to create also a dedicated route table

03:56 for this subnet.

03:57 I will just do the same thing.

03:59 My VPC.

04:01 This is my private subnet.

04:04 And

04:06 now if you look at this subnet,

04:09 which is private,

04:11 and you look at the route inside this route table,

04:17 just as this local route.

04:18 And we don't need to add a Internet route here

04:21 because it's a private.

04:23 So I'm just making sure I associate with the subnet

04:26 that I just created

04:28 so that my private subnet

04:30 follows the corresponding route table and the rules.

04:34 Let's verify that.

04:35 Let's go to the subnet.

04:37 Let's look at the private one.

04:39 And you see there is only one route.

04:41 So that's the network that we wanted to set up.

04:44 If you look at this,

04:46 this is what we did.

04:47 We just created these two things.

04:50 Now let's go to EC2,

04:53 and this time launch another EC2 instance.

04:56 So I'm going here again.

04:58 I'm selecting the Amazon Linux again.

05:03 Let's select Amazon Linux2,

05:07 and select t2 micro.

05:11 Now here is the place where you select VPC and the subnets.

05:14 So there is just one VPC.

05:17 And here you make sure you select

05:18 your private subnet and auto send public IP is disabled

05:22 by default because we did not

05:23 enable that subnet level.

05:25 Even if it is enabled,

05:26 it does not really make sense

05:28 because subnet is private.

05:30 So even if you allocate a public IP,

05:34 you can't connect to instance from the Internet.

05:36 So rather, we will keep it disabled here.

05:40 We'll just go with the rest of the things as a default,

05:43 just reliable and tax so that we can identify our instance,

05:47 We'll call it EC2-B.

05:50 And now comes the security group.

05:53 As I said, you need to think just what rule it should have.

05:59 So we want to connect it over SSH port 22,

06:03 and the source should be, again

06:06 either this particular EC2 instance

06:09 or this subnet CIDR.

06:11 Or you can add the security group of this EC2 instance,

06:14 or you can add whole VPC as a range,

06:17 because this is ultimately a part of my VPC CIDR.

06:21 So anything works,

06:22 I'll just make it like at VPC level.

06:25 So that any instance in the VPC

06:27 can connect to this instance.

06:29 Additionally,

06:30 I also want to enable the PING

06:32 so that my EC2-B instance

06:34 can PING to EC2-B.

06:37 So PING is ICMP.

06:39 So I'm just making all ICMP.

06:41 And again, for the same IP address range.

06:46 Okay. That's it.

06:48 I'll be just launching the instance.

06:50 I'm using same SSH key pair.

06:52 As you know,

06:53 you can use the same key pair for any number

06:56 of the instances.

06:57 And I'm just launching the instance.

07:00 Okay. So instance has been launched.

07:03 It will take a minute or so

07:04 to get into completely running state.

07:08 Now thing to consider here is that

07:11 how do you connect to this instance?

07:13 So as you know,

07:14 the first step is to connect to public EC2 instance,

07:16 which I had shown in the earlier lecture.

07:19 And from there,

07:20 now we want to connect to this EC2 instance.

07:22 But how would you connect?

07:23 Again, it would be an SSH connection.

07:26 And that means you also need to authenticate

07:30 using the same private key

07:32 while you log in from here to here.

07:35 Now for that,

07:36 there are a couple of options with SSH,

07:38 you can do SSH channeling as well,

07:40 or SSH forwarding as well.

07:42 But simplest way is you get your SSH private key

07:46 onto this machine.

07:47 And then while executing the SSH command

07:51 to get to this instance,

07:52 you use that same private key.

07:56 And this is what we are going to do.

07:59 So steps are already listed here.

08:01 In order to connect to EC2-B,

08:03 you first need to copy

08:05 your SSH key file to EC2-A instance.

08:09 You can create a vi with vi editor

08:12 or any other editor that you know.

08:14 You can create a file,

08:15 copy the content of the pem file,

08:19 save the file.

08:20 You can change the permission

08:22 because this is what is needed.

08:23 Permission should be 600 or below

08:26 for the key file.

08:28 And then you use that key file

08:29 to connect to your EC2-B instance.

08:32 So let's do that.

08:34 First thing, let's try to connect to EC2-A.

08:37 So this is my earlier session.

08:39 I'm just restarting this session.

08:42 If your session get killed,

08:44 you can always go and restart it.

08:47 So this is my EC2-A machine.

08:50 What I need to do is actually create one key file,

08:53 which I'll use to log in to EC2-B

08:55 So I'm just doing vikey.pem.

08:58 I'm pressing I to get into the insert mode.

09:00 Now these are all vi editor commands.

09:02 If you are comfortable with some other editor,

09:04 feel free to use that.

09:06 I'm just copying my pem file content,

09:09 testing it here,

09:11 and saving the file.

09:13 And finally,

09:14 I'm just changing the five permissions to 600,

09:17 or you can even do the 400 as well.

09:22 That's it.

09:22 Now what I can do is I can do a SSH-I,

09:26 I can use this file

09:27 and then I need to log in to EC2-B.

09:30 For that, I need to give a private IP address of EC2-B.

09:34 So I know at least first three octet of my EC2,

09:38 the last IP address I don't know

09:40 because it is located from the DSCP.

09:42 So I need to go to my console again

09:45 and see the private IP,

09:47 which is 198.10.1.198.

09:53 This one is the IP address.

09:56 And you see my IP is this.

09:58 That means I am into my EC2 instance,

10:01 EC2-B instance.

10:02 So this is what we wanted to do.

10:03 Also, I'm just exiting.

10:05 It takes me to EC2 instance E.

10:07 Let's see if we can PING to EC2-B from here

10:10 because we had enabled the ICMP traffic.

10:13 And yes we can.

10:14 So our connectivity is set up the way we wanted.

10:18 If you, again, go back

10:19 and look at your architecture diagram,

10:24 it has been set up the way it has been shown here.

10:27 So always follow the diagram.

10:29 If you really draw the diagram well,

10:31 probably you need not see your steps.

10:35 You can implement everything, just looking at the diagram.

10:38 Just one more thing before we move to the next lecture.

10:42 Do you think from this EC2-B instance,

10:45 we can connect to Internet?

10:47 What I'm trying to say is

10:50 now we are here in the console.

10:52 From here, if I do PING to say amazon.com,

10:56 should I be able to do that?

10:59 Now let's validate that.

11:01 First thing is we need to see

11:03 if a route table

11:06 has a route to go to Internet.

11:07 Does it?

11:08 It does not.

11:09 Now even if you are that,

11:11 we need to work?

11:12 It won't because instance also need a public IP address,

11:16 which this instance does not have.

11:18 That means this instance cannot talk to Internet.

11:21 Let's try to make sure I'm just doing ping amazon.com.

11:28 Now this is instance E by the way,

11:29 that's where it's working.

11:31 So let me go back to instance B,

11:34 and now let's try to do

11:35 ping amazon.com.

11:38 And it does not

11:40 because there is no connectivity.

11:41 And we know that for sure.

11:43 So how to fix that,

11:44 we'll see that in the following lectures,

11:46 where we'll understand what is NAT

11:49 and how to enable the outbound

11:51 Internet connectivity

11:52 using the NAT gateway.

11:54 So that's it for this lecture.

11:57 You can also do this exercise on your own.

11:59 And best luck.

12:01 Thank you.