Friday, April 24, 2026

Cohort 3 | Project CloudIgnite Topics: VPC & Networking (NAT Gateway, Route Tables, Security Groups, NACLs) Duration: ~3 hours

📌 CLF-C02 Relevance: Sections marked with 🎯 EXAM are directly relevant to the AWS Certified Cloud Practitioner (CLF-C02) exam.

Key Takeaways

• NAT Gateway: outbound-only internet for private subnets; must be in public subnet with Elastic IP
• Route tables: 0.0.0.0/0 → IGW makes a subnet public; every subnet needs a route table
• Security Groups: instance-level, stateful, default deny all inbound, allow-only rules
• NACLs: subnet-level, stateless, default allow all, supports both allow and deny rules
• Explicit deny always wins in NACL; SG and NACL together provide two-layer firewall
• Labs 263/264: Create VPC manually + fix broken VPC (full troubleshooting checklist)

Table of Contents

1. CIDR Block Recap
2. AWS Reserved IP Addresses
3. NAT Gateway
4. Route Tables
5. Internet Gateway
6. Security Groups
7. Network ACL (NACL)
8. Security Group vs NACL Comparison
9. VPC Components Summary
10. IP Subnetting
11. Subnetting Benefits
12. IP Address Classes
13. Lab Walkthroughs
14. Knowledge Check (KC) Q&A
15. Key Commands

1. CIDR Block Recap

A CIDR block (Classless Inter-Domain Routing) expresses an IP address range using a prefix notation.

Example: 192.168.0.0/26

• /26 means 26 bits are fixed (network portion)
• Remaining 6 bits are flexible (host portion) → 2⁶ = 64 addresses

AWS VPC CIDR block range: /16 (largest) to /28 (smallest)

Calculating the Right CIDR Block

To find the mask for a required number of hosts, solve: 2ⁿ ≥ required hosts

Formula: If you need X hosts → find n where 2ⁿ ≥ X → mask = 32 − n

2. AWS Reserved IP Addresses

For every subnet, the following 5 IP addresses are reserved and cannot be used:

Example: A /26 subnet has 64 IPs → 59 usable IPs (64 − 5 reserved)

3. NAT Gateway

🎯 EXAM — NAT Gateway is a CLF-C02 exam topic

What is it? A managed AWS service that allows instances in a private subnet to initiate outbound connections to the internet, while preventing the internet from initiating connections back.

Key Points:

• Allows outbound traffic only (not inbound)
• Your EC2 instance remains private (unreachable from the internet)
• Useful when a private instance needs to download updates, software, or patches
• Must be placed in a public subnet
• Requires an Elastic IP

Use Case Example:

You have a database in a private subnet. It must not be accessible from the internet, but you still need to install updates on it. A NAT Gateway provides that outbound internet access.

Private Subnet (EC2/DB)  →  NAT Gateway (Public Subnet)  →  Internet
        ↑
   No inbound access allowed from internet

4. Route Tables

A route table is a set of rules (routes) that determines where network traffic is directed within your VPC.

Key Points:

• Every subnet must be associated with a route table
• A default route is created automatically for local VPC traffic (e.g., 10.0.0.0/16 → local)
• Adding 0.0.0.0/0 → Internet Gateway makes a subnet public

Example Route Table (Public Subnet):

0.0.0.0/0 means "everywhere" — all traffic not destined for the local VPC is forwarded to the Internet Gateway.

5. Internet Gateway

An Internet Gateway (IGW) is a VPC component that allows communication between your VPC and the internet.

Key Points:

• Acts as a door between your VPC and the internet
• A public subnet is useless without an Internet Gateway
• Must be attached to the VPC
• Must have a route table entry pointing to it (0.0.0.0/0 → IGW)

6. Security Groups

🎯 EXAM — Security Groups are a CLF-C02 exam topic

What is it? A virtual firewall that controls inbound and outbound traffic at the instance level.

Key Properties:

Common Ports to Know:

Analogy: Security Group = whitelist. Nothing gets in unless you explicitly allow it.

7. Network ACL (NACL)

🎯 EXAM — NACL vs Security Group is a CLF-C02 exam topic

What is it? An optional layer of security that acts as a firewall for controlling traffic at the subnet level.

Key Properties:

Analogy: NACL = blacklist. Everything is allowed unless you explicitly deny it.

8. Security Group vs NACL Comparison

🎯 EXAM — Highly likely to appear on CLF-C02

Troubleshooting tip: If you cannot connect to an EC2 instance via SSH, check both the Security Group (port 22 allowed?) and the NACL (port 22 not denied?). Both must pass for traffic to reach the instance.

9. VPC Components Summary

🎯 EXAM

AWS Services commonly deployed inside a VPC:

• EC2 (compute)
• RDS (relational database)
• EBS (block storage)
• EFS (file system)
• S3 (via VPC endpoint)

10. IP Subnetting

What Is an IP Address?

• A unique identifier for a device in a network
• IPv4 = 4 octets (32 bits), e.g., 192.168.1.10
• Windows: ipconfig | Mac/Linux: ifconfig or ip a

Subnet Mask

• Alternative representation of the CIDR block
• Expressed in dotted decimal (e.g., 255.255.255.0 = /24)
• Convert to binary: count the number of 1s to get the prefix length
  • 255.255.255.0 → 11111111.11111111.11111111.00000000 → /24

Key Subnet Terms

Subnetting Rule in AWS

Your subnet CIDR mask must be larger (numerically) than your VPC mask.

• If VPC = /18, subnets can be /19, /20, /21… but not /18 or lower
• Subnets must belong to the VPC's IP range — you cannot use a different IP block

11. Subnetting Benefits

1. Better Security — Each subnet can have different NACLs and Security Groups; isolate sensitive resources (e.g., databases) in private subnets
2. Increased Speed — Smaller networks = less broadcast traffic and fewer collisions; packets travel to a specific subnet, not the whole network
3. Reduced Network Traffic — Traffic is routed to specific subnets, reducing unnecessary packet distribution

Real-world example:

University Network
├── Student Subnet     (public — internet access allowed)
└── Teacher Subnet     (private — restricted access only)

12. IP Address Classes

Classes D and E are not used for normal hosts. You will never encounter them in standard networking tasks.

Private IP ranges (cannot be routed on public internet):

• 10.x.x.x
• 172.16.x.x – 172.31.x.x
• 192.168.x.x

13. Lab Walkthroughs

Lab 263 — Create a VPC with a Public Subnet (Paolo's Scenario)

Requirements: At least 15,000 IPs, starts with 192.x.x.x, one public subnet with ≥50 IPs

Step-by-step:

1. Calculate VPC CIDR → Need ≥15,000 IPs → 2¹⁴ = 16,384 ✅ → /18
   • Use 192.168.0.0/18 (or 192.0.0.0/18)
2. Public Subnet CIDR → Need ≥50 IPs → 2⁶ = 64 ✅ → /26 (gives 59 usable)
   • Use 192.168.0.0/26
3. Go to VPC Console → Create VPC (choose "VPC and more")
4. Set 1 availability zone, 1 public subnet, 0 private subnets
5. Customize subnet CIDR to /26
6. Create VPC

Lab 264 — Fix a Broken VPC (Brock's Scenario)

Problem: VPC exists, EC2 instance cannot ping the internet.

Diagnosis checklist:

1. ✅ VPC created with correct CIDR
2. ✅ Public subnet created inside VPC
3. ✅ Internet Gateway created and attached to VPC
4. ✅ Route table has rule: 0.0.0.0/0 → IGW
5. ✅ Route table associated with the public subnet
6. ✅ NACL created — inbound rule 100: Allow all; outbound rule 100: Allow all
7. ✅ Security Group has inbound rules: SSH (22), HTTP (80), HTTPS (443)
8. ✅ EC2 instance launched in the correct VPC, Auto-assign public IP enabled

Step-by-step (manual VPC build):

1. Create VPC (VPC only) → CIDR: 192.168.0.0/18
2. Create Subnet → Name: "public-subnet", CIDR: 192.168.0.1/26, AZ: any
3. Create Route Table → Name: "public-route-table", attach to VPC
4. Create Internet Gateway → Name: "IGW-test-VPC"
5. Attach IGW → Actions → Attach to VPC → select test VPC
6. Edit Route Table → Add rule: 0.0.0.0/0 → IGW → Save
7. Edit Subnet Associations → add public-subnet → Save
8. Create NACL → Inbound rule 100: All Traffic Allow | Outbound rule 100: All Traffic Allow
9. Create Security Group → Inbound: SSH(22), HTTP(80), HTTPS(443) from Anywhere
10. Launch EC2 → pick test VPC, public subnet, enable Auto-assign public IP, use security group
11. Connect via SSH → ping 8.8.8.8 or google.com to verify

14. Knowledge Check (KC) Q&A

Q: Which statement describes Amazon VPC?

✅ It enables you to create a private network in the AWS Cloud.

Q: Which resource must be specified when creating a VPC?

✅ IP address range (CIDR block)

Q: Which resource would benefit from being in a private subnet?

✅ A database — it should not be publicly accessible from the internet.

Q: What is the purpose of route tables?

✅ It determines where network traffic is directed within the VPC.

Q: Which statement describes a Security Group?

✅ It acts as a stateful firewall that controls inbound and outbound network traffic. (Denies all by default; must explicitly allow traffic.)

15. Key Commands

CLF-C02 Exam Relevance Summary

The following topics covered in this lecture are directly tested on the AWS Certified Cloud Practitioner (CLF-C02) exam:

💡 Top exam tip from instructor: "Security Group by default will block everything (whitelist). ACL by default will allow everything (blacklist). This is a common exam question."

Notes compiled from AWS/Re/Start Cohort 3 – Project CloudIgnite lecture, April 24, 2026.