AssociateFree account25 min
INC-1088 Lab 02: The Hardened Subnet That Broke Everything
Reporting service cannot reach the database after a NACL hardening change
NACL / Security GroupsAWS VPC
Cloud networking, at packet level
Master cloud networking by fixing real-world production outages.
Reading about VPC routing does not build intuition. Debugging a broken one does. Every lab hands you a Terraform file that deploys a genuinely broken environment and an incident ticket — no hints, no answer key until you ask for it.
- Diagnostic labs
- 27
- Learning tracks
- 5
- Guides
- 9
Trace a real failure — the outage behind Lab 01:
packet-trace10.0.11.34:49820 → 52.94.236.248:443
- EC2Batch instance10.0.11.34 · subnet-private-a
- SGSecurity group egresssg-app · allow 0.0.0.0/0
- NACLNetwork ACLdefault · allow all
- RTBPrivate route table0.0.0.0/0 → nat-0f8e
- NATNAT Gatewaynat-0f8e · state: available
- RTBNAT Gateway's own subnet route0.0.0.0/0 → itself (no IGW route)
- DESTapi.processor.example52.94.236.248:443
Run the trace to see where the packet dies.
Lab of the weekOpenAssociate~20 min
INC-1043
Lab 01: The Misplaced NAT Gateway
A batch job in a private subnet cannot reach a third-party API. The route table looks correct, the security groups are wide open, and the NAT Gateway reports Available. Find out why every outbound connection still hangs.
AWS VPCNAT Gateway
Open the ticketReported symptom
Outbound API calls from the private subnet time out after deploying the new VPC
Reported by Payments Platform
More labs
All labs →ProfessionalFree account30 min
INC-1142 Lab 03: The Spoke That Could Not Be Answered
Newly onboarded spoke VPC cannot reach shared services; the existing spoke works
Transit GatewayAWS VPC
SpecialtyFree account30 min
INC-1207 Lab 04: The Endpoint That Answered To Nobody
Application cannot reach the vendor API through its new PrivateLink endpoint
PrivateLinkNACL / Security GroupsAWS VPC
Learning tracks
Full roadmap →VPC Core & Subnet Topology
2 guidesAddress planning, subnet tiering, route table scoping, and the boundary rules that decide whether a packet ever leaves the VPC.
Ingress Architecture & Load Balancing
3 guidesWhat a target actually sees as the source address, how health checks decide which zones receive traffic, and the defaults that silently change both.
Egress Architecture & Cost Optimization
1 guideNAT Gateway placement, per-AZ data processing charges, gateway versus interface endpoints, and where egress spend actually accrues.
Traffic Inspection & Transit Gateway Routing
1 guideCentralized inspection topologies, appliance mode, route table associations, and propagation across attachments.
Hybrid Connectivity
2 guidesDirect Connect, Site-to-Site VPN, and the BGP attributes that control which path your traffic actually takes on the way back.
Latest deep dives
All posts →The CloudFront prefix list proves a request came from CloudFront, not from your CloudFront
A security group rule on the managed prefix list admits every CloudFront origin-facing server on earth, including the ones serving someone else's distribution pointed at your origin. AWS's own guidance puts a secret header first and the prefix list as an optional extra, the list costs 55 of your 60 rules, and VPC origins replace both with a service-managed security group that is scoped to your distributions and nothing else.
Networking7 minStop and start an instance and one of its four addresses changes, which is the one in the firewall
Private IPv4, IPv6 and an Elastic IP all survive a stop and start. The auto-assigned public IPv4 does not: it is released on stop and a new one is assigned on start, and the old one can never be recovered. Associate an Elastic IP later and the public address is released then too. Every address costs the same $0.005 an hour, so the one that changes is the one with no reason to exist.
Networking6 minAn S3 endpoint policy that names only your buckets breaks dnf and docker pull
Amazon Linux package repositories and ECR image layers are S3 objects in buckets AWS owns. Lock a gateway endpoint policy down to your own buckets and both stop working, with an access-denied that names a bucket you have never heard of. The policy language has three more traps, and the default policy is the only one that cannot hit them.
Networking7 minDual-stack on a Network Load Balancer is a listener rule, not a checkbox
Flip an NLB to dualstack and IPv6 clients connect, but every one of them reaches an IPv4 target as the load balancer's own address, because translated traffic is never source-preserved. The fix is a listener rule that routes by address family to an IPv6 target group, and it brings four requirements the checkbox never mentioned, one of which makes a UDP service fail to build at all.
Networking7 min