- Now let's talk about routing
within Amazon VPC.
Routing is concerned with the flow of traffic,
whether or not any and all traffic is allowed
to move between two different ranges of IP addresses.
Routing is not at all concerned with protocols and ports.
Routing is not concerned with TCP versus UVP,
port 22 versus port 443.
It's only concerned about whether or not
any and all traffic can move, right?
And so, once we have routing in place,
then we can start to filter the traffic
based on protocol and port and so on.
And so looking at this diagram,
we can understand routing by talking
about how do we get traffic from one place to another?
And within AWS, every VPC has an implicit router.
It already exists and it's already fully-managed by AWS.
We don't need to create or manage the router,
but we can configure routing by creating route tables.
So you'll notice here that we have
a couple of different route tables, right?
So here's a route table, and here's a route table.
And we configure the router
by adding routes to those route tables.
You'll see that both route tables have the default route.
So this local route says that for traffic
that is destined for,
you'll notice this range here, 10.2.0.0.16,
for traffic that is destined for that range,
it remains inside the VPC.
So you'll notice that this default range here, 10.2.0.0.16,
matches the range here of the VPC itself.
So all route tables that we create
will ensure that traffic destined for the VPC remains local.
And what that means is that every subnet in that VPC
is inherently allowed to route traffic to other subnets.
Right, so all of these subnets are inherently allowed
to communicate with one another based on that local route.
And without any other routes in place,
that's the only communication that would be allowed.
And so if we wanted to communicate with the internet,
then first we would need an internet gateway.
Again, a gateway is a device that allows two networks
to communicate with one another.
And so by creating and attaching this internet gateway,
and then by creating a route, you'll notice here
that we have a route, we're saying,
with all zeroes, we are essentially saying,
for every other range of IPs, aside from 10.2.0.0.16,
we want to route those packets to the internet gateway.
And so if we then associate this route table
with this subnet, that would then allow devices
in that subnet to communicate to the internet
by going through the internet gateway.
And then the same thing applies to a VPN connection.
Over here, if we wanted to create a VPN
between our VPC and on-premises,
then we would need a VPN gateway.
And we would also need a route.
You'll notice here, what we're saying is that
for any network traffic that is destined for 192.168.0.0/16,
essentially our corporate range,
then we want to route that traffic
from our, say, databases or what have you,
through the VPN gateway and back to on-premises.
And so again, routing is concerned with
whether or not traffic can flow.
And I always liken routing to
the plumbing at your kitchen sink, right?
It's the plumbing at your sink that allows water
to be delivered to your sink.
And it's only once that plumbing is there
that you can then filter the water.
And the same thing applies here.
It's once routing is in place and traffic can flow,
then we start worrying about filtering that traffic
based on ports and protocols.
So routing is the first place that we start,
and then we can start applying firewalls
and different security mechanisms
that we will talk about later.