Creating an AWS VPC

By Paul Heinlein | Nov 15, 2017 (updated Dec 4, 2017)

It’s sometimes the case that you’d like to wrap your Amazon EC2 instances, and perhaps some EFS file stores, up in a nice private environment, as if you had your own little data center. You’d have your own network segments, with perhaps a DMZ or a NAT gateway. You’d be able to define ingress and egress rules for each segment.

AWS bundles those capabilities up in their Virtual Private Cloud (VPC) service.

Configuring a VPC isn’t particularly intuitive; it took a couple of us who already have AWS experience a few hours to work through the options.

The process distilled below outlines two of the most common scenarios:

  1. a single Internet-facing subnet
  2. a segmented network containing both a DMZ and a private subnet routed through NAT

The steps below can all be scripted and done from a command line, but I’m going to walk you through them using the AWS web console.

Address block

Regardless of which scenario appeals to you, you first need to choose an IPv4 address block for your VPC. You can use any RFC 1918 address you’d like, taking a couple things into consideration:

  • Make the block big enough to expand. Once you’ve allocated a CIDR block to a VPC, you can’t expand it. There’s no reason to use a /16 block if you’re only going to run a few VMs, but it’s wise to think ahead for future expansion.

  • Avoid any address overlap with your other networks, including your home LAN (and those of any collaborators). You may end up with a VPN at some point. If so, you’ll want discreet address blocks to facilitate easy routing.

Also, decide before you begin whether or not you want IPv6 addressing as part of your setup. I’m a big fan of IPv6, but I’ll be the first to admit that it complicates routing and firewall rules.

Create a VPC

Both of the two scenarios outlined start with the same step:

Task: Create a VPC

  1. Navigate to AWS > VPC > Your VPCs.
  2. Press Create VPC button.
  3. Name tag: Choose a name. Make it descriptive.
  4. IPv4 CIDR block: use all or part of subnet chosen above
  5. IPv6, yes or no?
  6. Tenancy: unless you have highly sensitive data, default is fine here.
  7. The artifact of this task is a VPC ID.

Fork in the road

At this point, you need to answer a couple questions.

  • Will your VPC need multiple subnets?
  • If so, how will routing be configured?

One of your subnets needs a direct route to the Internet, but not all of them do. Others can be put behind a NAT gateway.

Simple case: one Internet-connected subnet

Task: Create Subnet

  1. Navigate to AWS > VPC > Subnets.
  2. Press Create Subnet button.
  3. Choose and enter a name.
  4. VPC: use one just created
  5. Verify CIDRs
  6. Choose Availability Zone (unnecessary for simple cases)
  7. IPv4 CIDR block: use entire VPC CIDR block

Optionally, you can modify the subnet to auto-assign public IPv4 addresses.

  1. Navigate to AWS > VPC > Subnets.
  2. Select new subnet.
  3. Press Subnet Actions button.
  4. Choose Modify auto-assign IP settings.
  5. Select to Auto-assign IPs and Save.

Task: Create Internet Gateway

  1. Navigate to AWS > VPC > Internet Gateways.
  2. Press Create Internet Gateway button.
  3. Choose and enter a name.
  4. Attach to VPC.

Task: Edit Route Tables

  1. Navigate to AWS > VPC > Route Tables.
  2. Select route table for new VPC.
  3. In botton pane, select Routes tab and press Edit button.
    • Press Add another route button.
    • Destination: 0.0.0.0/0
    • Select Target, which will be your newly created Internet gateway.
    • Press Save.
  4. In botton pane, select Subnet Associations tab and press Edit button.
    • Select your new subnet.
    • Press the Save button.

From there, you can proceed to creating EC2 or EFS instances that will reside in your new VPC/Subnet. At least one of your EC2 instances will need an Amazon-issued public address in order for you to be able to log into any of them; in this scenario, however, probably all of them will benefit from public addresses.

VPC containing DMZ and private subnet, with NAT

The AWS VPC-NAT instructions are tremendously helpful for understanding what’s going on here.

First off, you’ll need to break your VPC CIDR into at least two subnets. At least one you’ll want to designate as “public” and at least one as “private.” Don’t stress over those designations; they have more to do with routing than address space.

The instructions below capture the simplest case, with only two subnets.

Task: Create “public” subnet

  1. Navigate to AWS > VPC > Subnets.
  2. Press Create Subnet button.
  3. Choose and enter a name.
  4. VPC: use one just created
  5. Verify CIDRs
  6. Choose Availability Zone (unnecessary for simple cases)
  7. IPv4 CIDR block: use only part of VPC CIDR(s)

Optionally, you can configure the public subnet to auto-assign public IPv4 addresses. Instructions can be found earlier in this document.

Task: Create Internet Gateway

  1. Navigate to AWS > VPC > Internet Gateways.
  2. Press Create Internet Gateway button.
  3. Choose and enter a name.
  4. Attach to VPC.

Task: Create Internet Route

  1. Navigate to AWS > VPC > Route Tables
  2. Press Create Route Table button.
  3. Choose and enter a name.
  4. Attach to VPC.
  5. Select newly created route table
  6. In botton pane, select Routes tab and press Edit button.
    • Press Add another route button.
    • Destination: 0.0.0.0/0
    • Select Target: your newly create Internet Gateway
    • Press Save
  7. In botton pane, select Subnet Assocations tab and press Edit button.
    • Choose the public subnet
    • Save

Task: Create Elastic IP

  1. Naviate to AWS > VPC > Elastic IPs
  2. Press Allocate new address and follow the prompts

Task: Create “private” subnet

  1. Follow the instructions for the public subnet, using a different part of the VPC’s CIDR block and, obviously, a different name. Do not configure this subnet to auto-assign public IPv4 addresses.

Task: Create NAT Gateway

  1. Naviate to AWS > VPC > NAT Gateways
  2. Press Create NAT Gateway button.
  3. In Subnet, associate it with your public subnet
  4. In Elastic IP Allocation ID, assign your Elastic IP.

Note Under the hood, a NAT gateway is special-use virtual machine. The process to create it may take several minutes.

At this point, you may have to wait a while if your NAT Gateway has not yet been created and brought online.

Task: Create NAT Route

  1. Navigate to AWS > VPC > Route Tables
  2. Press Create Route Table button.
  3. Choose and enter a name.
  4. Attach to VPC.
  5. Select newly created route table
  6. In botton pane, select Routes tab and press Edit button.
    • Press Add another route button.
    • Destination: 0.0.0.0/0
    • Select Target: your newly created NAT Gateway
    • Press Save
  7. In botton pane, select Subnet Assocations tab and press Edit button.
    • Choose the private subnet
    • Save

Further steps

You’ll want to create at least one EC2 instance in the public subnet, and assign it a public IPv4 address, so you can SSH into that host and, from there, into the private subnet.

The default rules will allow your “DMZ” hosts full access to the VMs in the “private” subnet. You can edit the subnet’s ingress and egress rules if that’s not what you want.

Note that an AWS NAT gateway cannot be configured for functions like port forwarding or VPN termination. You’ll need to configure your own NAT host if you need those functions.

Clean up

  1. Terminate all EC2 instances
  2. Delete NAT Gateway (and wait and wait …)
  3. Delete VPC, which will also delete all your subnets, security groups, Network ACLs, Internet gateways, and routing tables.

Aws  Networking