- Here we'll talk about routing
within Amazon Virtual Private Cloud.
So, routing is the method
by which we can control the flow of traffic
within our AWS virtual private cloud or our private network.
So, let's take a classic three tier architecture,
where we might have a load balancer out front
accepting public traffic coming in from the internet.
We might have an application server in the background.
We also would have that communicating to a database.
Now, in that situation,
we would want to keep our application servers
and our database servers private.
We don't want people to be able to come in
from the internet and get access to those directly.
We might also want our database to communicate back
to our on-premises network over a VPN, a secure connection,
so that we can do various administrative tasks.
So, the way that we control that flow of traffic
is by way of route tables.
So, what we want here is this sub-net
to have access to the internet
and we can do that with a route table.
So, we have a route table with, you can see here,
a couple of route entries in there.
The one by default, you'll notice your 10.2.0.0/16
matches the address range of the VPC.
So, that means that any IP address
in this range as a destination
will be routed locally throughout that VPC.
The next entry, you can see here we're using all zeros,
it's the widest open range we can possibly use.
That essentially says that all other traffic
will be routed to an internet gateway.
Now, an internet gateway is a separate device
that we create and attach to our VPC,
so that we can get bidirectional internet traffic.
And that's important to know,
that when I say bidirectional,
we mean that resources within this particular subnet
can not only reach out to the internet,
but devices out here on the internet can also reach in.
And that's important to know
because it means that devices here,
in order to communicate to the internet,
will have a public IP address
and they will be reachable from folks on the internet,
good folks and folks that might be nefarious.
And so, that's why we have routing.
We want to control the flow of traffic,
so that those mal-intended users can't get access directly
to our application servers and database servers.
In this example, we would allow our application servers
to use the default route table
that just maintains local traffic.
We would create a new route table for our databases,
so that we have this additional entry.
You can see here again,
we have local traffic routed locally,
and then we have our on-premises network range 192-168/16
routed over our VPN.
And again, we'll talk about how to create VPNs later.
So, here our database administrators can,
from the on-premises network over a VPN,
get in and do what they need to do on the database,
our application servers can communicate
to the database locally,
and our load balancers can communicate
to our application servers locally.
So again, routing is how we control the flow of information
and how we control the flow of traffic
between different subnets,
between our network and the internet,
and between our network and VPN connections.