Chapter 2. Configuring and Securing a Virtual Private Cloud

In this chapter, we will cover recipes for:

• Creating and configuring VPC

• Configuring VPC DHCP options

• Configuring networking connections between two VPCs (VPC peering)

• Connecting your on-premise network to VPC using VPN

Introduction

In this chapter, we will focus on recipes to create and configure AWS VPC (Virtual Private Cloud) against typical network infrastructure requirements. VPCs help you isolate AWS EC2 resources, and this feature is available in all AWS regions. A VPC can span multiple availability zones in a region. AWS VPC also helps you run hybrid applications on AWS by extending your existing datacenter into the public cloud. Disaster recovery is another common use case for using AWS VPC. You can create subnets, routing tables, and internet gateways in VPC. By creating public and private subnets, you can put your web and frontend services in the public subnet, while your application databases and backed services are located in a private subnet. Using VPN, you can extend your on-premise data center. Another option to extend your on-premise datacenter is AWS Direct Connect, which is a private network connection between AWS and your on-premise datacenter. In VPC, EC2 resources get static private...

Creating and configuring VPC

In this section, we present the recipe to create and configure a VPC. You can assign a single Classless Inter-Domain Routing (CIDR) block to the VPC. The allowed block size is between a /28 (16 IP addresses) net mask and /16 (65536 IP addresses) net mask. Public and private subnets are specified to build multitier applications. To access the Internet from a private subnet, we have to use Network Address Translation (NAT) instance in the public subnet. Each subnet must be associated with a routing table. Each route in the routing table contains the destination CIDR network range and a target Internet gateway/virtual private gateway.

To access the Internet the EC2 instance must either have an Elastic IP (EIP) address or a public IP address. You can also use a NAT instance, which will have a public IP address and perform the natting for your instances. Your subnet's route table must contain the route that directs the Internet bound traffic to the Internet gateway...

Configuring VPC DHCP options

DHCP options sets are associated with your AWS account so that they can be used across all your VPCs. You can assign your own domain name to your instances by specifying a set of DHCP options for your VPC. However, only one DHCP option set can be associated with a VPC. Also, you can't modify the DHCP option set after it is created. In case you want to use a different set of DHCP options then you will need to create a new DHCP option set and associate it with your VPC. There is no need to restart or relaunch the instances in the VPC after associating the new DHCP option set as they can automatically pick up the changes.

How to do it…

In this section, we will create a DHCP option set and then associate it with your VPC.

1. Create a DHCP option set with a specific domain name and domain name servers. In our example, we execute commands to create a DHCP options set and associate it with our VPC. We specify domain name testdomain.com and DNS servers (10.2.5.1 and 10.2.5...

Configuring networking connections between two VPCs (VPC peering)

In this recipe, we will configure VPC peering. VPC peering helps you connect instances in two different VPCs using their private IP addresses. VPC peering is limited to within a region. However, you can create a VPC peering connection between VPCs that belong to different AWS accounts. The two VPCs that participate in VPC peering must not have matching or overlapping CIDR addresses. To create a VPC connection, the owner of the local VPC has to send the request to the owner of the peer VPC located in the same account or a different account. Once the owner of peer VPC accepts the request, the VPC peering connection is activated. You will need to update the routes in your route table to send traffic to the peer VPC and vice versa. You will also need to update your instance security groups to allow traffic from-to the peer VPC.

How to do it…

In this section, we present the commands to creating a VPC peering connection, accepting...

Connecting on-premise network to VPC using VPN

By following the recipe in this section, you can extend your on-premise data center into the cloud by connecting on-premise network to VPC using VPN. Internet Protocol Security (IPSec) VPN connections are supported by AWS. You can create both statically routed and dynamically routed VPN connections in a VPC. Virtual private gateway works on the AWS side of the VPN connection and customer gateway (a physical or a software appliance) works on your side of the VPN connection. If you already have an OpenVPN Access Server setup on premises and would like to extend connectivity of your OpenVPN connection to the Amazon Cloud, you can do so easily without purchasing additional hardware. Each VPC connection on the AWS side has two tunnels for redundancy, if one tunnel is taken down for maintenance purposes, your customer gateways can use the second tunnel. Each tunnel has its own unique virtual private gateway public IP address. To handle failures of...