Subnetwork

As explained in Amazon Web Services in Action, Third Edition: An in-depth guide to AWS

A subnet is a logical subdivision of an IP network with its own address range and routing boundary.

A subnetwork, or subnet, is a subdivision of a network with its own IP address range. In AWS, subnets divide a Virtual Private Cloud (VPC) so resources with different access needs can be placed separately. Route tables and network access control lists (NACLs) help control traffic. section 5.5

For an internet-facing web application, start with two roles:

• Use a public subnet for a component that needs an internet route, such as a proxy or load balancer. section 5.5
• Use a private subnet for backend servers or databases that should not be reached directly from the internet. A private subnet has no internet route. section 5.5

Place a proxy and backend

In a VPC with address space 10.0.0.0/16, assign 10.0.1.0/24 to the public proxy subnet and 10.0.2.0/24 to the private backend subnet. In CloudFormation, an EC2 instance’s SubnetId selects its subnet; the backend configuration uses `SubnetId: !Ref SubnetPrivateBackend`. Clients reach the backend through the proxy, not directly from the internet. section 5.5 section 5.5.4

Figure 5.10 VPC with three subnets to secure a web application

The VPC diagram shows how public and private subnets separate the web application’s entry point from its backend. section 5.5

Plan for two limits. Without internet access, a backend instance cannot install Apache from a public Yum repository; a NAT gateway can provide internet access from a private subnet. Also, each subnet is linked to one Availability Zone. A replacement instance launched in another zone needs another subnet and cannot retain the same private IP address. Use subnets in multiple zones when avoiding dependence on one zone matters. section 5.5.4 section 5.6 section 13.2.4 section 16.0

How Amazon Web Services in Action, Third Edition: An in-depth guide to AWS covers it

How deep it goes

Works through IPv4 address ranges, routing roles, and EC2 placement, while deferring IPv6 configuration.

Examples

Uses a three-subnet VPC with a public proxy, private backend, and public subnet reserved for a NAT gateway.

What it assumes

Assumes CIDR notation introduced earlier, while defining public and private subnets by their internet routes.

What you can do after

Build it from scratch with CloudFormation by assigning address ranges and placing EC2 instances in public or private subnets.

How it connects

Links VPCs and subnets to route tables, NACLs, NAT gateways, EC2 instances, and Availability Zones.

liveBookmanning.com

Read Amazon Web Services in Action, Third Edition: An in-depth guide to AWS on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Google Anthos in ActionAn IP subnet is a contiguous range of IP addresses defined by a network prefix for assigning and routing network addresses.
• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 1 Fundamentals and ProtocolsA subnet is a logical subdivision of an IPv4 network address space with its own network address and prefix length.
• 

  liveBookmanning.com
  Terraform in Depth: Infrastructure as Code with Terraform and OpenTofuA subnet is a logically segmented portion of an IP network with its own address range.
• 

  liveBookmanning.com
  Microsoft Azure in ActionA subnet is a subdivision of a virtual network with its own address range and network configuration.

Compare how 5 books explain subnetwork →

Related concepts

• subnettingproduced by · Subnetting is the division of an IP address space into smaller logical networks by extending the network prefix.
• VPCpart of · A virtual private cloud is a logically isolated virtual network provisioned within a cloud provider's shared infrastructure.
• routing tableconfigured by · A routing table is a data structure containing rules that map destinations, conditions, or peers to paths, next hops, services, or other forwarding targets.
• private subnetincludes · A private subnet is a subnet whose resources lack direct connectivity or reachability to the public internet.
• network security groupconfigured by · A network security group is an Azure access-control resource that filters inbound and outbound network traffic using prioritized security rules.

This explainer was generated by Manning's knowledge graph from the text of Amazon Web Services in Action, Third Edition: An in-depth guide to AWS. The section links point to the parts of the book it draws on.