Learn: Networking VPC Part 2

Overview

Welcome! In this learning article, we’re diving deep into advanced AWS networking concepts as they relate to Virtual Private Cloud (VPC) design—specifically the topics featured in your quiz. By the end, you’ll understand how and when to use AWS Transit Gateway, Egress-Only Internet Gateways, Network Firewall features, VPC Traffic Mirroring, IPv6 connectivity, Bastion Hosts, and cost-optimization strategies for network traffic. You'll also pick up practical troubleshooting skills and recognize common mistakes in AWS networking scenarios.

---

Concept-by-Concept Deep Dive

AWS Transit Gateway: Centralized Network Hub

What it is:
AWS Transit Gateway acts as a scalable, highly available hub that connects VPCs and on-premises networks. It simplifies complex network topologies by serving as a single point of connectivity rather than requiring a mesh of direct VPC peering connections.

Key Components:

• Attachments: These logical links connect VPCs, VPNs, or Direct Connect gateways to the Transit Gateway.
• Route Tables: Each attachment can use its own route table, controlling how traffic is forwarded.
• Inter-Region Peering: Facilitates cross-region VPC connectivity without internet routing.

Step-by-Step Usage:

1. Identify use case: Multi-VPC architectures or hybrid environments.
2. Create Transit Gateway: In the AWS console or via CLI.
3. Attach VPCs: Connect each VPC to the gateway.
4. Configure Route Tables: Define how traffic flows to and from each attachment.
5. Test connectivity: Ensure instances in different VPCs can communicate as intended.

Common Misconceptions:

• Myth: All VPC traffic automatically routes via Transit Gateway. Fix: You must attach VPCs and configure appropriate route tables.
• Myth: Transit Gateway replaces VPC Peering for every scenario. Fix: Peering is still useful for simple, low-latency, or transitive routing needs.

---

AWS Network Firewall: Domain List Filtering and Outbound Control

What it is:
AWS Network Firewall is a managed service that provides network layer protection for VPCs. It supports stateful and stateless inspection, intrusion prevention, and domain-based filtering.

Features:

• Rule Groups: Define rules for allowing or blocking traffic.
• Domain List Filtering: Block or allow traffic based on fully qualified domain names (FQDNs).
• Suricata Compatibility: Use familiar open-source rule syntax.

How to Use Domain List Filtering:

1. Create a Firewall Policy: Attach rule groups for domain filtering.
2. Define Domain Lists: Specify FQDNs to block or allow.
3. Associate Firewall Endpoint: Attach to relevant subnets in your VPC.

Misconceptions:

• Myth: Security Groups or NACLs can block specific domains. Fix: Only AWS Network Firewall (with domain rules) filters by FQDN at the network edge.

---

VPC Traffic Mirroring: Deep Packet Inspection

What it is:
Traffic Mirroring allows you to capture and inspect network traffic from EC2 instances in your VPC. This is useful for threat detection, performance monitoring, and troubleshooting.

Key Points:

• Mirror Source: ENIs (Elastic Network Interfaces) of EC2 instances.
• Mirror Target: ENIs of monitoring appliances or collection servers.
• Session Filters: Define which traffic (e.g., by port or protocol) to mirror.

Implementation Steps:

1. Create Mirror Target: The destination for mirrored packets.
2. Set Up Mirror Filter: Specify filter criteria (e.g., TCP port 80).
3. Create Mirror Session: Connect source, target, and filter.

Misconceptions:

• Myth: Mirroring is always on by default. Fix: Sessions must be explicitly created and filtered.

---

Egress-Only Internet Gateway (EIGW) & IPv6 in VPCs

What it is:
EIGW is designed for IPv6 traffic. It allows outbound-only internet access for resources in your VPC, preventing unsolicited inbound connections.

Components:

• IPv6 Subnets: Must be configured with an EIGW route.
• Statelessness: Unlike NAT Gateway (for IPv4), EIGW is exclusively for IPv6.

How EIGW Works:

1. Create an EIGW: In the VPC dashboard.
2. Update Route Table: Route IPv6 traffic (::/0) to the EIGW.
3. Assign IPv6 addresses: To EC2 instances or ENIs as needed.

Misconceptions:

• Myth: EIGW provides NAT for IPv4. Fix: EIGW only supports IPv6; use NAT Gateway or Instance for IPv4.

---

Bastion Hosts: Secure Administrative Access

What it is:
A Bastion Host (or Jump Box) is an EC2 instance configured to securely access instances in private subnets. It acts as a controlled bridge for administrative tasks.