VPC
Big picture: a VPC is an address space you define in an AWS account. A subnet is one link inside that space. The instance is a machine on that link. The public address is a rewrite at the edge.
Related: The network · NAT · CIDR · AWS inventory
Terms
- VPC
- A private address space in one AWS account, in one region. On the drawing it is
10.0.0.0/16. You choose that prefix when you create the VPC. AWS stores it. - Subnet
- One block inside that space, and one link. On the drawing, the instance's table has
10.0.1.0/24. The VPC router's table has the whole10.0.0.0/16. - ENI
- The instance's interface. The address belongs to it. A security group is the filter on that interface.
- Internet gateway
- Attached to the VPC. It rewrites the ENI's private address to a public one. On the drawing,
10.0.1.20becomes198.51.100.20.
The drawing
Where the prefix is stored
You choose 10.0.0.0/16 when you create the VPC. AWS stores that prefix on the VPC. You choose 10.0.1.0/24 when you create the subnet, and AWS stores that as a piece of the VPC prefix.
The subnet route table, which is the VPC router's table, holds 10.0.0.0/16. The instance holds 10.0.1.0/24, taken from the mask on its ENI, the way the laptop takes 192.168.1.0/24 from the mask on Wi-Fi. The instance's table has no row for the rest of 10.0.0.0/16. A packet to 10.0.2.20 matches the instance's default route, and the VPC router is what still knows the whole space.
The next hop
The instance's table:
| Destination | Where to send it |
|---|---|
10.0.1.0/24 |
the ENI |
0.0.0.0/0 |
10.0.1.1 |
10.0.1.21 matches the subnet row, so the instance delivers it on the subnet. The security group on the ENI filters what that interface accepts and sends.
The subnet route table:
| Destination | Where to send it |
|---|---|
10.0.0.0/16 |
local |
0.0.0.0/0 |
the internet gateway |
10.0.2.20 matches 10.0.0.0/16, so the VPC router forwards it and the packet stays in the VPC. 1.1.1.1 matches the default route and goes to the internet gateway.
198.51.100.20 is a one-to-one rewrite of 10.0.1.20 at that gateway. The ENI keeps 10.0.1.20. A private subnet points its default route at a NAT gateway instead, and that gateway does the shared rewrite from the NAT page.
A container running on the instance
In bridge mode the packet is rewritten twice. The instance turns 172.17.0.2 into the ENI address 10.0.1.20. The internet gateway or the NAT gateway then rewrites 10.0.1.20 to a public address.
In awsvpc mode the task's eth0 is an ENI on the subnet. Its packets use that subnet's route table.
A network ACL is the filter on the subnet. A security group remembers the connection, so a reply to allowed outbound traffic is allowed back. A network ACL has a rule for each direction.
Key takeaways
- The VPC is the address space. The subnet is one link inside it. The instance is a machine on that link.
- You choose the prefixes. AWS stores them. The instance stores only its subnet row.
- The ENI keeps its private address. The public address is a rewrite at the internet gateway.
- A security group filters at the ENI.
Gotchas
10.0.1.1is the address reserved on the subnet for the VPC router. It is not a name the instance gives an interface.- The instance's table holds
10.0.1.0/24. The VPC router holds10.0.0.0/16. - The security group on the ENI filters the packet after the route matches.