- Now let's talk about, what we refer to as
public, private, and hybrid subnets within AWS VPC.
Now, there's nothing necessarily within AWS
that you will find that inherently labels a subnet
as being either public, hybrid, or private.
These are terms that we're adding just to denote
the types of routing that are possible.
What we might call a public subnet,
is a subnet that has a route table
that gives us access to the internet.
So, like we've seen before, we have a route table,
and this route table would be attached
to this particular subnet.
And that route table, by way of this open range
and routing to an internet gateway
would give us bi-directional access
to and from the internet.
So that would be a public subnet, because it has
access to the public internet.
As we've also seen before, we might keep
some of our networks private,
meaning that there are no additional
entries in this route table.
The only thing we have is local traffic.
Now, what might create a hybrid network,
is where we might have our application servers here,
that need to reach out to the internet,
in order to do things like posting to a monitoring service,
posting to some kind of, something like
PagerDuty or Loggly where we're sending logs.
We're sending alarm notifications,
so we need to get out to the internet.
Maybe we wanna do patch updates and software updates,
we want to connect to GitHub.
Whatever it is, our application servers need to
communicate with the internet, but at the same time,
we don't want people coming in from the internet
directly to our application server.
That's just bad security.
So, in this particular example, what we're going to do,
is we would have a NAT server,
or a network address translation service.
This is also a resource that we can create
within AWS, here in the public subnet.
And so, the network address translation server
has access directly to and from the internet,
and can send and receive traffic
directly to and from the internet.
And then our application server would essentially route
all of its internet destined traffic
through the NAT server.
And we can do that by way of this kind of routing.
Notice that we have another route table
that would be attached to this particular subnet.
And so that we would say, aside from local traffic,
all other traffic gets routed to the NAT gateway.
So, not only can we route to devices
like an internet gateway, we can also
route to other ec2 instances.
So in this particular case, our NAT server
could be the Amazon service.
It could also be something like a virtual F5.
It could be a virtual vyatta server.
It could be just software running on an ec2 instance,
if we wanted to do it that way.
And we would route this traffic to the NAT gateway,
and that way our application servers
can reach out to the internet, but are still
protected from malicious users coming in directly.
So again, public subnets would be considered public,
because they have access to the internet.
Private subnets are considered private,
because they don't have access to and from the internet.
And hybrid subnets are simply private subnets
that have outgoing access to the internet,
by way of a network address translation server.