AWS VPC Networking Simulator
Learn AWS networking fundamentals with an interactive VPC simulator. Visualize how traffic flows through public and private subnets, understand NAT Gateways, Internet Gateways, and route tables.
Category: Cloud
Topics covered: aws, vpc, networking, cloud, educational, interactive, infrastructure
// simulator
AWS VPC Networking Simulator
Learn AWS networking fundamentals with an interactive VPC simulator. Visualize how traffic flows through public and private subnets, understand NAT Gateways, Internet Gateways, and route tables.
Build your VPC by adding components. The simulator will tell you if something is misconfigured.
Add components to build your VPC architecture.
Select a scenario or press 4-6 to start:
Key Concepts
- Public Subnet: Has route to Internet Gateway - resources can have public IPs
- Private Subnet: No direct internet route - resources are protected
- NAT Gateway: Lets private resources reach internet without being exposed
- Internet Gateway: The door between your VPC and the internet
Understanding AWS VPC Networking
A Virtual Private Cloud (VPC) is your own isolated section of the AWS cloud where you can launch resources in a virtual network that you define. Think of it as your own private data center in the cloud, with complete control over your networking environment.
Core Components
- VPC (Virtual Private Cloud): Your isolated section of AWS cloud where you launch resources in a virtual network you define. Each VPC has its own IP address range (CIDR block), typically something like 10.0.0.0/16.
- Public Subnet: A subnet with a route to the Internet Gateway. Resources here can have public IPs and be directly accessible from the internet. Web servers and load balancers typically live here.
- Private Subnet: A subnet with no direct internet access. Resources are protected from public exposure. Databases, application servers, and sensitive workloads typically live here.
- Internet Gateway: Allows communication between your VPC and the internet. It's horizontally scaled, redundant, and highly available. You attach one IGW per VPC.
Traffic Flow Concepts
- NAT Gateway: Enables private subnet instances to access the internet (for updates, API calls) while remaining unreachable from outside. NAT Gateways must be placed in a public subnet and cost ~$0.045/hour plus data charges.
- Route Table: Contains rules (routes) that determine where network traffic is directed. Public subnets route 0.0.0.0/0 to the IGW; private subnets route 0.0.0.0/0 to the NAT Gateway.
- CIDR Block: IP address range for your VPC and subnets. The VPC might use 10.0.0.0/16 (65,536 IPs), with subnets like 10.0.1.0/24 (256 IPs) for public and 10.0.2.0/24 for private.
- Availability Zone: Isolated locations within a region for high availability. Best practice is to deploy subnets across multiple AZs (e.g., us-east-1a, us-east-1b) for fault tolerance.
Common architecture patterns
- Public Web Server: IGW + Public Subnet + EC2 with public IP. Simple setup for static sites or APIs.
- Three-Tier App: Public subnet (ALB) then Private subnet (App servers) then Private subnet (Database).
- Private with NAT: Private EC2 instances that need outbound internet (updates, APIs) via NAT Gateway.
Key concepts
- Public vs Private: Public subnets route 0.0.0.0/0 to IGW; private subnets route to NAT.
- NAT Gateway Cost: NAT Gateways cost ~$32/month plus data transfer. Consider NAT instances for dev environments.
- Security Layers: Security Groups (stateful) plus NACLs (stateless) protect resources.
- High Availability: Deploy across multiple AZs with subnets in each.
- VPC Peering: Connect VPCs together for private communication across accounts or regions.
- Elastic IP: Static public IP that can be associated with resources in public subnets.
Security best practices
- Least Privilege: Only open necessary ports in Security Groups.
- Defense in Depth: Use both Security Groups and NACLs.
- Private by Default: Put resources in private subnets unless they need public access.
- VPC Flow Logs: Enable flow logs to monitor and troubleshoot traffic.
- Endpoints: Use VPC endpoints for AWS services to avoid internet traffic.
Overview
An AWS VPC is a private network you assemble from parts, and traffic only flows when each part is in place and the route tables point the right way. In this simulator you build that network yourself: add public and private subnets, an internet gateway, a NAT gateway, route tables and EC2 instances, and a validator tells you when a piece is missing, for example an internet gateway without a public subnet or a NAT gateway without a private subnet to serve. Then you test three traffic flows step by step. A request from the internet reaches a public instance through the internet gateway and the public route table. A private instance reaches the internet through the NAT gateway, which translates its address, while nothing on the internet can start a connection to it. And a public web server talks to a private instance through the local route inside the VPC. Seeing each hop makes the public versus private subnet distinction concrete: a subnet is public only because its route table sends 0.0.0.0/0 to an internet gateway.
Try this
- Add an internet gateway before a public subnet and read the validation message that explains what is missing.
- Build the full network and test traffic from the private instance to the internet to watch the NAT gateway translate the address on the way out.
- Test traffic from the public instance to the private one and follow the request through the internal VPC routing.
Frequently asked questions
- What makes a subnet public in AWS?
- Its route table has a route for 0.0.0.0/0 (and ::/0 for IPv6) to an internet gateway. Instances in it also need a public IP address to be reachable from the internet.
- What is the difference between an internet gateway and a NAT gateway?
- An internet gateway allows two-way traffic between the internet and resources with public IPs. A NAT gateway, placed in a public subnet, lets instances in private subnets start outbound connections without accepting inbound ones.
- Can instances in a private subnet reach the internet?
- Only outbound: through a NAT gateway or NAT instance for IPv4, or an egress-only internet gateway for IPv6. Inbound connections from the internet cannot reach them directly. VPC endpoints are separate and give private access to supported AWS services.
Try next
// simulator
Preview Environment Simulator
See how a pull request becomes a temporary copy of your app, complete with a private URL, safe test data, review checks, and automatic cleanup.
// game
Heroku-Style Name Generator
Generate names the way Heroku, Docker, Kubernetes, and petname do, see how the word lists combine, and learn when the birthday problem makes random names collide.
// simulator
Log Aggregation Pipeline Simulator
Follow production logs from applications through collection, parsing, filtering, buffering, sharded indexing, and search. Trigger traffic spikes, parser failures, and slow indexing to see where backpressure builds and logs can be lost.