AssociateFree account25 min
INC-1088 Lab 02: The Hardened Subnet That Broke Everything
Reporting service cannot reach the database after a NACL hardening change
NACL / Security GroupsAWS VPC
Cloud networking, at packet level
Master cloud networking by fixing real-world production outages.
Reading about VPC routing does not build intuition. Debugging a broken one does. Every lab hands you a Terraform file that deploys a genuinely broken environment and an incident ticket — no hints, no answer key until you ask for it.
- Diagnostic labs
- 7
- Learning tracks
- 4
- Guides
- 4
Trace a real failure — the outage behind Lab 01:
packet-trace10.0.11.34:49820 → 52.94.236.248:443
- EC2Batch instance10.0.11.34 · subnet-private-a
- SGSecurity group egresssg-app · allow 0.0.0.0/0
- NACLNetwork ACLdefault · allow all
- RTBPrivate route table0.0.0.0/0 → nat-0f8e
- NATNAT Gatewaynat-0f8e · state: available
- RTBNAT Gateway's own subnet route0.0.0.0/0 → itself (no IGW route)
- DESTapi.processor.example52.94.236.248:443
Run the trace to see where the packet dies.
Lab of the weekOpenAssociate~20 min
INC-1043
Lab 01: The Misplaced NAT Gateway
A batch job in a private subnet cannot reach a third-party API. The route table looks correct, the security groups are wide open, and the NAT Gateway reports Available. Find out why every outbound connection still hangs.
AWS VPCNAT Gateway
Open the ticketReported symptom
Outbound API calls from the private subnet time out after deploying the new VPC
Reported by Payments Platform
More labs
All labs →ProfessionalFree account30 min
INC-1142 Lab 03: The Spoke That Could Not Be Answered
Newly onboarded spoke VPC cannot reach shared services; the existing spoke works
Transit GatewayAWS VPC
SpecialtyFree account30 min
INC-1207 Lab 04: The Endpoint That Answered To Nobody
Application cannot reach the vendor API through its new PrivateLink endpoint
PrivateLinkNACL / Security GroupsAWS VPC
Learning tracks
Full roadmap →VPC Core & Subnet Topology
1 guideAddress planning, subnet tiering, route table scoping, and the boundary rules that decide whether a packet ever leaves the VPC.
Hybrid Connectivity
1 guideDirect Connect, Site-to-Site VPN, and the BGP attributes that control which path your traffic actually takes on the way back.
Traffic Inspection & Transit Gateway Routing
1 guideCentralized inspection topologies, appliance mode, route table associations, and propagation across attachments.
Egress Architecture & Cost Optimization
1 guideNAT Gateway placement, per-AZ data processing charges, gateway versus interface endpoints, and where egress spend actually accrues.
Latest deep dives
All posts →When the AWS docs contradict themselves: NLB client IP preservation
Two pages in the same Network Load Balancer user guide state opposite defaults for client IP preservation. The disagreement decides which security group rules are correct, and getting it wrong produces a target that passes health checks and refuses every client.
Networking5 minThree AWS networking limits that changed shape, not just value
A remembered quota is worse than no quota, because it feels like knowledge. Three AWS networking limits where the mechanism changed underneath the number, and the design decision each one now points at.
Networking6 min