. . . . . Hi, can you see this? How are you doing, Rish? This is Mohammed. I can see it. Okay, good, good. Hi, welcome everybody. Hi, Nilesh. Anand here. I can see it. Hi, nice. Nice to see that. And so that is good that we are connected properly and that we are ready to start. We are about to start in just a few minutes. In exactly three minutes, we'll start discussing. In the meanwhile, if you have any questions, please chime in. Speak up if you have a question concerned. I will begin momentarily. I'm just setting up a couple of things and then we will talk about the things that I wanted to discuss the other day, which we like stormed halfway through and now I'm back and all that good stuff. We'll discuss mentioned briefly. I think most of you know I was in the hospital. Now we are back. Everything is under control and we should be able to proceed. So I was seeing if I can delete some of the existing virtual private clouds that I have. And I want to focus primarily today in understanding the core concepts and then eventually building out our own handmade VPC, our own data center in the cloud. That is what we'll be doing. It is going to be an intense process. Some of these aspects may be new to you and take notes. Take copious notes and I will make sure that we are recording it. So the session that we are doing, I think we will be recording it. I think we are. Let's confirm that. Yes, we are recording it. So this session is being recorded, which means you will have a video recording with you at the end of the session. I will post that in the same way like I do before. I will post it in this folder and you will receive it automatically. You will see these videos pop up right here. That's where you will see the video from today's session coming down. And our focus today will be to create a data center for our own usage in the cloud, in our own accounts. And when I say a data center, primarily what that means is that we have a company. And in that company, we have employees that need machines, access to virtual computers, access to compute resource, and a storage resource, networking resource. Those capabilities, these people need them. So we want to be able to give them those services from a data center perspective. That is what essentially we intend to do. Now in a regular traditional data center, we will have buildings, large computers, large machines that will have some operating system. And these machines will running some operating system, will have some kind of a virtualization software. And then on top of this virtualization, we can then create virtual machines. That's a typical scenario of a classic data center that you probably already know. However, each one of us will have our own data center right in our own cloud. We just take all these things and just move it away to the cloud. That is our idea. So you may have seen it before. The idea of creating a virtual private cloud is as simple as going here and clicking this wizard. You have the start VPC wizard. You just click and boom, you get a VPC. And it does all the things that you would otherwise expect, like all the things that I mentioned. You get a big building, you get a lot of machines, real hardware, install operating systems, enable virtualization, and create virtual machines. These machines are what the people in your company will use. That is what we intend to build, except we don't really want to build any real cloud. It is purely virtual, as in no real private cloud, I should say. So no real building, no real data center, no nothing of that type. But everything is going to be virtual. That is the idea that I want to build towards. And we will do these things step by step. So we are about to start. I just wanted to check everybody. If everybody is here, we have one, two, three, four. Where is everybody else? Interesting. Okay, I'm just quickly counting. One, two, three, four, five, six, seven. We have seven people on Slack chat. Tartik Sri Rao is not connected online. So let me just ping these guys. They seem to be available. They seem to be available on the Slack chat, but they are not online yet. Oh, there comes Lee. And we have Mohammed Salaam. Salaam is missing. Anand is available. Sama is not there yet. Sama is on Slack chat. So he's going to come online soon. So we should start the discussion. So let's begin. The core idea that I want to first of all begin introducing to you, which you probably know already is this idea of a network address translation, NAT. That's one of the first ideas that I want to talk about. The second idea that you probably already know is the idea of a firewall. You probably know this also. Because these two things, among other things, plus, plus, plus couple of things, they constitute what is known as, popularly known as a router that you buy from, let's say for example, you will buy a router. And when you buy this thing, like one of those guys, what do you get when you buy this thing is these things. You get a NAT, you get a firewall and a couple of other services. And a router is essentially a combination of these things. It has this, this, this and all that. A router comes with essentially a black box. The black box has a port facing the internet. And a bunch of ports facing internal. That's what a router essentially is. These wires may be sometimes wireless. We call it Wi-Fi. These are the wireless capabilities of giving you internal connection. Some of them are wired, the others are wireless. And that essentially what you see in a router, right? That is a router. Under the covers, a couple of things go on. And that is what I wanted to make sure that you were clear about, is what I'm going to focus on. And if you run into any conceptual disagreement, ask me to pause, ask me to say that, you know what, please explain. And I think I will do that. So what I want to be able to do is, first of all, clarify that the public internet address space is typically represented by these boxes that you may have heard of, seen in a number, dot number, dot number, dot number. And these numbers range from 0 through 255, 0 through 255, like that. So what does that mean in decimal notation? That's what you typically run into. If you write the same thing in hexadecimal notation, hexadecimal, then you will find the numbers range from 0, 0 through f, f, dot, f, f, dot, f, f. That's the hexadecimal representation. That's the same address space. And this is the entire internet address space in which there are about 4 billion addresses, roughly. This 4 billion address space is the entirety of the internet, like completely the whole internet you can cover, and that is limited to only 4 billion endpoints. Your home or your office is probably one of them. Like in your typical home, you have a company such as Comcast or also known as Xfinity. Many of you probably have this ISP. They will give you what is known as one public IP. And you know the fastest way to find out what is your public IP? Do you know? The question to ask is, what is my IP? And there it is. This is my IP. So that's how you can find out what is your public IP address. And you can tell that this site seems to give me more information, Comcast Cable Connection in Bellevue, Washington, and that IP address. That's what I am able to find. You can find your own IP address just like that. This is your public facing IP address. The IP address is also the address for the router. So the router you have in your home gets a public IP from the company outside like Comcast. They will assign a public IP. Now your computers inside your home that may be connected to a router or sometimes your iPad or other wireless devices such as the iPhone, they may not be connected through a wire, but they may be connected through Wi-Fi. And these devices, all of these together, get an internal IP address. So these internal IP addresses are essentially very, very similar to this, except it has limitations. The limitations are defined in here in this RFC, which is the address allocation for private internet addresses. This is the IETF, which decides all the standards for internet. And this is their network working group request for comments, RFC number 1918, that describes the current best practice for allocation of private internet addresses. And in there, in this documentation, as you will see and read, they have called out that these addresses have a range, so 10.0.0.0 or 172.16 or 192.168, those addresses are considered private. They cannot be on the public internet. That's what it means. So it is a subset of this 4 billion, out of which 10.x.x.x, whatever you have here, whatever number you feel like except that the first entry has to be 10 or otherwise 172.16. So 172.16.x.x, if this is the address space or otherwise 192.168.x.x, if that is the address space, then any number you can put here, then this thing is considered an internal IP address. That's the concept. And if you do not know this, then I think now you know. But I suspect most of you know this already. And if that is not the case, talk to me on Slack chat, ask me questions if you don't understand or read this material on cloud technologies, module number, I think one of those modules we have. So go read that. You may have seen it before. I'm going to point it out just quickly. And that section is this data center in the cloud. So that set of small little videos, about 16 of them, they're about one minute, two minute long, 16 videos, one after the other. Please go in the sequence. Module 11, that will give you a quick, short, focused summary of the elaborate intensity that I'm going to enter into. I will go very, very deep in helping you understand every single nitty-gritty about virtual private cloud. But in this module, 11, all the way from unit number 1 through unit number 16, I have covered core concepts that I will be talking about already. They're there for you to read if you want. And in the session that we are doing today, we are building concepts so that we can then fully, completely, and comprehensively understand capabilities of a virtual private cloud. And we will do that momentarily. So if this difference between a public and a private IP address space is not clear, please read this or just remember these numbers. That's the best way to think about. Now, having understood that part, if you go to your router in your home, you will find, I'm betting that most of you probably have an address space of either this or this, or I should not say zero. That is what you will find, something like this here. Those numbers, you can fill up random numbers between the range of zero to 255. So fill whatever you feel like here, or here, or here, or here, or here. And that is very likely to be your internal set of IP addresses. What does that mean? You have your router, and the router is going to connect to iPad, and the iPad is going to get assigned an IP address. So if I open my iPad and show you, I think I need to just let me type a password. So I can possibly show you the IP address of this iPad, which is what I'm projecting to see if I can show you that detail. And here we go. Now I'm going to look at the iPad as an example, quickly focusing on, and coming up here. Where is the iPad display? Come on, there we go. Do you see anything yet? No, I don't see it yet. But do you know how to identify the internal addresses of a computer that you might have? That is what I'm going to illustrate. So I'm going to the Wi-Fi section, finding out the IP address of the box internally. And this happens to be the IP address, as you can see, 10.0.1.7 is the IP address for my iPad. Whereas the IP address for the public Internet, whether I check it from my iPad, or if I check it from my Macintosh, the question is, what is my IP? If that is the question I ask, whether I do it on the iPad or do it on the Mac, the address is going to be this exact address, because that is what is the address assigned to the router from Comcast. And so the IP address or the public IP address is common to all these devices, the iPhone, the Mac, the Samsung TV, whatever you have, all these units that are connected to the router. Therefore, they might have a different private IP address. So this has 10.0.1.7, and this has 10.0, whatever, I don't even know. But these are all private address ranges, as you can see the number 10, 10, 10 common to everybody, and these numbers change because that's what RFC says, 10.0.0.0. And so this router is then associating and allocating internal addresses to these devices that are inside the private area. This area is private. This area is public. And that is how the distinction is between the router and the world outside and the world inside. So what is router doing here? It is doing the network address translation. It is translating, say, for example, if I am here and I visit cnn.com and I see some website opening up like this one, for example. So when this iPad says, OK, show me this news about Romney. And cnn.com knows to send the traffic back to the iPad because this guy, the router, is doing NAT. So CNN and the iPad, and in between there is this router. So iPad says, I want to go to CNN, please. So OK, they go to the CNN server. CNN says, who are you? It says, my address is not this, not this, but the public IP address, which is whatever that I have, so 68 dot something. That address that I have is my public IP address. So CNN thinks that this 68 is talking to CNN, not 10.0.1.7. The CNN doesn't know the existence of this fact that there is another dude, another iPad, which has a different IP address that seems to be talking to him or her or this machine, cnn.com machine. And this router essentially is doing one thing, which is known as masquerading. It is pretending to be 68, whereas the actual origin of the request is coming from here, 10 dot. And so it is masquerading, pretending to be 68 dot, whereas the request is coming from 10 dot. And when the response comes back, so this is the response from CNN, the response does not stop here, does not go to the iPhone, does not go to the Mac or does not go to the Samsung television or wherever you have. But it knows that the packet originated from here. So the packet that returns in response from CNN should go to the iPad. And that job of routing is the reason why these boxes are called routers. And that is the function of a NAT. It also does another function. That function is acting as a firewall. So we talked about the NAT function, which is basically doing a network address translation between 68 dot address and 10 dot address. So the translation happens in the router. It also is able to request response and understand and appropriately divert the packets coming from various locations to the right locations. That's NAT. In addition to that, this router also has another function. The function is called firewall. In that firewall, the goal is to actually not literally create fire, but essentially prevent any traffic coming from the outside into the inside unless authorized, unless authorized. Only authorized traffic. OK. Unauthorized traffic. Unauthorized traffic. Not OK. Unauthorized traffic. Not OK. It drops the packet. If you have an outsider, send an unauthorized packet. It will be dropped by the firewall. And that is why people on the Internet, which can be good or which can be bad, there are bad things on the Internet, you know. So those guys, the bad guys on the Internet may not access your laptop, your Mac or whatever machines you have internal. They're all inside. They're protected by the firewall because the firewall actively drops packets sent by anybody on the Internet. No matter who they are, no matter who they are, they will just drop the packet unless they are authorized to come in. Who authorized them? You. You authorized. You decide what can come in. You decide what is allowed and then if that is allowed, it will be allowed in. And then the traffic can flow to your laptop if you like. And that routing part is done by the NAT device. But the firewall role is essentially about dropping or accepting, accepting and rejecting packets. Packets are essential building blocks of Internet traffic. They're like cars on the highway. Think about that way. So with these two concepts understood, I want to ask you, did you understand what the concept of a NAT is and what the concept of a firewall is? If there are any questions, please do that right now because we will now do an exercise in which we will simulate a fictitious home. And in that home, we will place a router, we'll assign a public IP and we will internally in the building inside that home have a laptop. And in that laptop, we will associate an internal IP or we call it the private IP. And we will be outside here. And this building is our farmhouse. So we are calling it farmhouse. We have to have a router in the farmhouse. We'll get a public IP address from Comcast or somebody else. And in that farmhouse, we will have a laptop which will receive a private IP from the router device. And we are here in our home or office, wherever we are. So from our home or office, we want to connect to our farmhouse laptop sitting right here. That's what I want to do. And so I want to understand how will I authorize traffic to go into the house, the farmhouse. The scenario is very simple. We have a farmhouse. We have a router in here. We have a laptop in here. This is a private IP. The router has a public IP. And we are here. We are in our office or home. But this is our farmhouse. And we know that the bad guy, let's call this guy the bad guy, the bad guys try to go in, no, reject. We know this already happens. But we want to allow ourselves in. How do we do that? That's the question I have for you. We are in office. We are in home. We are visiting New York City. We are traveling to India. God knows who. China. The idea is wherever we are, as long as we have the authority and the permission, we should be able to go into our farmhouse like this and connect to the laptop. And maybe create a file, delete a file, do whatever we want. But yeah, I want to be there. I want to be logically inside my farmhouse. I want to be logically inside my farmhouse, whereas I may be in New York City. That is what I want to accomplish. So I want to understand by default, I am considered a bad guy. So my access attempt will be rejected, but I want to authorize myself. So how do we do that? That is the example that I will be now playing and constructing these things. So we have our workstation with us here. Workstation is this workstation we have already. All of us have access to this cloud genius workstation that I will be starting. And we will begin creating our farmhouse. And that is what I am going to do now. So we are going to go to the browser, go to select Amazon. There is already a VPC, this one, which I am going to be saying that I want to use the default VPC and this is the one that is the default VPC. It is given to all of us by default. But then I don't want to use it. So I am saying do not use. So I want to create something from scratch. And there are two ways. One of them is to just go to the wizard and have the wizard create one like this. And then here it will pop up a wizard and I will say start a wizard and boom. It goes and creates it for me. And there are four different types. One, two, three, four. And so we will understand these four types. But then we will not use this wizard to create because that will be boring. It doesn't tell us what exactly is going on under the covers. We want to really, really know the things, nuts and bolts. And then we will take a step back and maybe we will use the wizard or maybe we will do it our own way or some other way. But we need to know. The goal is to understand. And so before we begin our own exercise, I want to take a moment here and ask you if you have any questions about what we just discussed. And then I will start describing these four different scenarios of wizard-based VPCs but not use them. Instead, we will do our own stuff. We will create our own farmhouse, which is basically a VPC in which we are in our home and office in New York or wherever we are. The VPC may be in some cloud. It is like the farmhouse far, far away. And we still want to go inside in the private area where our laptop sits or maybe our server sits or maybe our thousand machines sit. Whatever we have in that cloud, it is a virtual private cloud. And so we want to be able to do that in a large collection of infrastructure that we will be renting from some cloud provider. And we want to be able to access our own rented machine infrastructure without visiting the farmhouse. We will be staying wherever we are and just logically go inside, logically. Be there. Not physically. Just logically go there. Be there. So we want to be able to do these things. And I am again pausing for any questions if you have before I describe these four scenarios to you. Hey, Nilesh. This is Salam. Yes, hi. Hi. Could you explain NAT one more time? NAT has to do something with the router, right? NAT is a part of the router. NAT is a function of the router. This is to translate public IP address like you saw into a private IP address like this. That is the primary function. So public IP address is here. This is my public IP. In 183.157.68, that address is my public IP. And these addresses are the internal public IP addresses in every, every, every location whatsoever. Your home, my office, my home, my farmhouse, my VPC, your VPC, your data center. All of these guys will have the same set of private addresses. Okay. That is common. If your address belongs in this range, like from 10, 0, 0, 0, 0, 0, all the way through 10, 255, 255, 255. If that is the range of addresses that you belong to, we will assume that you are a private IP address. If your address space belongs in this range, you will again assume that your computer is in a private area. If your address is in this range, we will assume that your internet is in the private area. So these are assumptions made in the design of the internet. These three ranges of addresses are considered private globally. How about slash 8, slash 12, slash 16. So this section is a very, very subtle, very important section. This thing is called CIDR notation. What is CIDR notation? It stands for classless internet domain routing. The notation goes like this. So you have, let us see. These are really complex to read. So I will simplify. Don't have to read all this to understand it. Let me simplify it. So here we go. I have a box here and a box here. In this range, in this box, I am telling you that I am going to write numbers 0 through 9. And in this box, I'm going to write numbers 0 through 9. How many numbers can you write? 10 number. Oh, 100. Okay. 0, 0, 0, 1, all the way through 99. Okay. I can write 100 numbers, right? Uh huh. Okay, good. Now, let us do a trick. The trick is called masking. Now I will say that I am going to put a mask, like a mask as in hide. So I'm going to hide from your view. Hide something from your view. So how do I hide? That is what I'm going to write now. I'm going to create a mask and hide your vision. So hide your vision. So put a black patch on your eye. Black patch on your eye. That is what I want you to do, okay? And I would like you to put a black patch right here. Black patch. Now, if I tell you that the address is 1. What do you think the number is? How many numbers are possible? You have a black patch here. You cannot see. How many numbers are possible? Hide your vision. This portion is hidden. 10, right? Exactly, 10. Correct. So you can have 1, 1. Sorry, 1, 0. 1, 1, 1, 2, 1, 9. All these numbers, there are 10 numbers. So the range of addresses that you can have in a one black patch is in the example that I just gave you is 10. And so this black patch is written in this notation. That's the notation. That's how they write it. I know it is very cryptic to understand, so I'll make sure to help you understand the writing in the structure, the style behind this black patch thing that I talked about. So now let us go back to here and read. And so here is an example. Let us see the simplest example. Forget all this 0 through 9. That is not how it is on the internet. No, not this. On the internet, we have 0 through 255. Let you know. That's not how it is. Through 255. That's how it works. So we will now understand the detail behind an example. So you may have heard of me telling you, 0, 0, 0, 0, that's 0. And this represents the entire internet. Yeah. You've heard me say, right? I heard I said that many, many times. Entire internet is this. So this portion is the black patch, this portion. And when it says 0, it means there is 0 patch, meaning you can fully see every single thing here. Meaning, I think I may have confused you. Hold on. Let me simplify this one more time. I'll take this representation. It's a little bit different. That's not how I should describe it. The description should be like this. So that the fact that we have these numbers, that we can write whatever we feel like. The 0 actually stands for you will mask nothing. You mean you will mask 0. Meaning every single number that you see is what you see, and that is the number. So all of the internet can actually fit in. If you are looking at this number comparing with this and make it slash 32 instead, you are basically masking. Hold on. There is a simpler explanation that I have created here for CIDR here, and that should give us a quick answer. So CIDR and VPC. So here is a better example on the site itself. So you have the IP address in its binary form. So this address 192.168.5.130. I have tried to write that number in its binary form. So if you understand binary versus hex, that will be simpler. If you do not, I need to take one more level of depth and help you understand these things in binary and hex. If you don't, tell me. I will clarify that. Do you already know binary and hex? If not, I need to go deeper. So I will go there. I'm assuming you do, but correct me. Or if you want us to discuss this binary and hex at a later time, we can do that. But the point is... You can probably briefly... I mean, we use the conversions, the x2, x2, binary. I understand. So I'll maybe take one more level deeper and help you understand addressing. So you may have heard of this thing called digital. Anything digital is like zero or one. That's what it means. So when we start counting, we count 0, 1, and then we run out of numbers. So we can count only up to 2. So what do we do? Then we add more space here. And then we start counting 0, 0, 0, 1, 1, 0, 1, 1. And we can count up to 4. Then we add one more space. And then we can count 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1. And then again, keep going, 0, 1, 0, 0, 1, 1, 0, sorry, 1, 0, 0, 1, 0, 1, 1, 1, 1. Did I miss something? I think I messed up. It should be... I did not count properly. Do it again. Let's do it again. So going slowly. The idea is to repeat this sequence here just like that. 0, 0, 0, 1, 1, 0, 1, 1 is once placed here. So now you have 8 address space of 8. So you had address space of 8. Before that, you had a space of 4. Before that, you had an address space of 2. So you can see that the address space progresses in 2 to the power of 2, or 4, or like that, 2, 4, 5, 6, 7. That's how the address space grows. So if you have 1, 2, 3, 4, 5, 6, 7, 8, and fill this with 0s and 1s, you will see that this number is equivalent to number 0, and this number is equivalent to number 255. And that comes from the fact that 2 to the power 8 is 256. And this is the number 8, 1, 2, 3, 4, 5, 6, 7, 8. So the number 8 comes from here. 2 to the power whatever is going to give us the address space that you have in 256. So when we say this address, dot this address, dot this address, dot this address, these addresses can range from 0 to 255. We are essentially allocating 8 bits. So 8 bits, 8 bits, 8 bits, 8 bits. So totality of how many bits? 32. That means the total addresses that we can have out of these 32 bits are 2 to the power 32, which is about 4 billion. Now, representation of 0, 0, 0, 1, 0, 1, sorry, 1, 0, 1, 1. This representation, if you keep adding, and 0, 0, 0, 1, 1, 0, 1, 1, add 0, 0, 0, 0, 0, sorry, 1, 1, 1, 1. If you keep writing like this and maybe add one more bit here, those bits, so then you get to a point where we can find that it is getting increasingly difficult to understand who is talking what. That's where we have come up with a notation known as the hexadecimal notation. The idea behind hexadecimal notation is that we will write like this. And so by writing these numbers, sorry, by writing these numbers, the idea is that we are essentially writing 10, 11, 12, 13, 14, and 15. That's what we essentially write in decimal form. However, if you write F, that actually very clearly stands for, sorry, this number, 1, 1, 1, 1. That's what an F stands for. So if you write F, F, that stands for 1, 1, 1, 1, 1, 1, 1, 1, 8 bits. And so that is the space in the internet in IP version 4 address space that we have a space to write addresses like this. And when we mask all of these, all, so mask all, all 32 of them, then we cannot really tell which address is which. And so when we mask nothing, we can basically map out the entire internet. Whereas if we are focusing on one particular address, we have 32 mask. So that's the idea behind the reference to this scenario, which you probably see here when you go back to create a machine, get EC2, and say go to a security group and try to modify a security group for inbound permissions and say edit and say my IP. You see this reference. EC2 comes from the fact that I am narrowing down my exact IP address, which is this address space that I have. I am making sure that I am referring to that exact entry in the table of the entire internet, which represents out of these 4 billion addresses, I am referring to the address, this one, the office location for me. And that is a notation for CIDR. And I think this is further elaborated on this page that you have here with the little video, this one that I think you should watch. And we will cover these things again on another session or a one-on-one session if you like. The point is that these notations, like you see in the video example here, slash 8, slash 12, slash 16 are also in the private RFC. So slash 8 means they are hiding only these 8 bits and making sure that you don't change these things. So the slash 8 indicates you are only making sure that these are intact. These can take shape of whatever number you feel like, like here and here, but the first 8 bits are masked. They are frozen, you don't change it. It is 10 here, it is 10 here. They are locked, you don't change them. Everything else you can. And that's the representation by this slash 8. Same thing here with a slightly wider mask. We are masking a little bit more here and a 31 here. So slightly different as you will notice. Only between 16 and 31, those ranges are only considered private. Anything outside that is not private. 00, 255, 255, that whole range is private. But in the second order here, only it is narrowed from 16 to 31. Anything in between is okay. Outside, not private. This 16 notation indicates that we are masking the first 16 bits, meaning you need to freeze them. You don't change them like this. They are frozen. They will be changed only in the remainder section, like here and here. And that is what we are going to examine as you will work with these cases more and more. You will understand what these things mean as you will use them. And that is the discussion that I want to have. We will revisit this if you want the CIDR notation understood. I would suggest that you review this video. It's a very short, two-minute video. And read this page if you want further details on CIDR, which is what I'm going to do is paste a link to you in the Slack chat right there. Now, let's keep going forward, which is where we were in this sheet. So what we are essentially discussing is that we want to be able to create our own farmhouse and then connect to it. But for that, we need a VPC. So the VPC can be obtained by, can be created by either going to a wizard like this and then click the blue button to start a VPC wizard. And that way you can have a new VPC of four different types. The four types are VPC with a single public subnet. As you can see in the example in the picture, the idea is to have only one subnet of internet addresses where you can have machines configured. So let us compare what they have in the image here in this picture, this one. So you have internet, you have DynamoDB, SNS, SPS, anything on the internet on the outside. And you are protected by this perimeter of Amazon Virtual Private Cloud. And there is only one public subnet. In that public subnet, you have these boxes. So one box, number two, number three, any number of boxes within that public subnet. That's the idea they're describing here in the first example. You have some kind of a perimeter and you have one subnet. In that you can connect one machine, another machine, another machine, and like that. And there is access available to you from the public internet. But this box itself is self-contained. It is like your farmhouse. And these boxes are internal to the house. That's the scenario being described. It's a very simple, very, very trivially simple scenario. So we are not super interested in that one. Most companies actually use this scenario, which is the scenario as shown in the picture. You have a public subnet and a private subnet. The idea is that you create two different areas in your farmhouse. So you have the virtual private cloud as a safe perimeter. You have two subnets. Let's call it the public subnet or another one as the private subnet. In my examples, I tend to use a slightly different name for these. And so I prefer the name border check. So there is a private subnet and a border check subnet. So two subnets that I tend to like this name better are the example that I will illustrate. So you have one subnet and another subnet. You can have computers connected like this and like this. You can create any number that you can accommodate on this subnet and on that subnet. And all of these things will belong inside a segregated area that we are calling your farmhouse. You can call it your country. You can call it whatever the domain, the size of the location that you want. You can call it your home. You can call it your office. You can call it your VPC. That naming is not important. The important fact is that the border checkpoints subnet is conceptually similar to what you will have when a person with a passport and visa visits your country. So the first thing you will do is on the border, you will check whether they are allowed to go in. And with that permission established, you can either let them in or reject them to go out. And that permission validation is what needs to happen. And that is the commonly deployed scenario in most private clouds. Most virtual private clouds, that's the commonly deployed scenario. Question? Yes. Sorry, I have a question. So the border check is the VPC or the, like in this picture, the border check, is that the VPC boundary? So this entire thing is the VPC. Okay. So VPC will not allow outside addresses into the domain, right? So VPC is like a perimeter. Border check is a subnet. This is just a name, by the way. You can call it Srinivas subnet or Nilesh subnet. That doesn't really matter. And I will tell you what matters when you actually, how you connect the wires, wire, how you connect them, the cable connection, which connection goes to the public internet, which connection does not go to the public internet. That is what constitutes whether a subnet is outside or not. So if you have this wire connect to a public gateway, then this entire subnet becomes public subnet or border subnet or whatever you want to call it, subnet. It basically boils down to how you connect the cable. If you do not connect any cable whatsoever between these machines and the public internet, nobody can go there. Absolutely. And that is exactly how we want our computers that we want to keep secure. We do not want them to connect to the public internet at all, like at all whatsoever. However, there are certain machines that we want to be able to connect to the public internet so that we can go to CNN or go do something else on the internet and have our visitors who are logically visiting us, our voices, our customers, we want them to be able to come. But we don't want them to be able to go to here, which is a private area. We don't want to go there. We want to keep them separate on a private subnet. And therefore, how we connect the cable is what distinguishes the subnet from another subnet. And there is a cable to connect and I will show you the cable. It's a conceptual cable. It is not an actual wire you will touch, but you will actually effectively do the same thing that you will do. Otherwise, if you have a router yourself, you will take an ethernet cable and hook it up to the Comcast modem. That's what I'm talking about. Niles, can you ask everyone to go on mute? I just muted. Was it you, sir? Sorry. No, I just muted the person who was noisy. I cannot mute myself. If I mute myself, that would be silly. I identified the noise and muted, but no worries. So the idea is that we are literally not actually physically, but conceptually we are connecting a cable from one of the subnets to the Comcast cable modem outside. And that is how it becomes a public subnet. If you have another computer in the home, in your area, in your private area that is not connected at all, will it become publicly accessible? Absolutely not. There is no connection. So how can anybody hack it? That's the concept. That's how you should think. So the distinction between a private subnet and public subnet that you show here in the picture here essentially boils down to whether you connect it to the public ethernet or not. That's the concept. Now, this is the example, which is the second example in the wizard, which is what we will be building step by step. The third example they have here is where they are selecting IPsec-based VPN connection between your real data center at the bottom and VPN connection to your private area. The second edition of a VPN is what is configured in this third choice. It is very similar to the second choice, except there is no virtual private network in the second choice. In the third choice, they are adding a VPN, a virtual private network. This is like a big company employee connecting back to the corporation using virtual private network from Cisco, Juniper, things like that. That's what they're talking about in the third example. And in the fourth example, they're saying, you know what? Don't need any connection to the internet whatsoever. Just get me the machines and, by the way, connect them to my company. That's it. No internet connection needed. We don't want any. All we want is horsepower, storage, compute, networking, core capabilities. We want them and we will pay you money. But you know what? Don't want any internet. Just give us the access and connect them straight to our company through a virtual private network, VPN. That's the fourth type. That's also a valid scenario. And there are more scenarios. You can construct basically whatever you feel like. These are the four wizard choices that they gave as we understand. Now, let us start building the second choice here, but not through the wizard. Instead, go back and click the VPC button. Understand that you have a VPC, only one VPC right now, which is this one and click on it. Make sure to rename it. Do not use so you don't get confused. We are not using it. So mark it. Do not use so that there is no confusion. By the way, do not delete this one. Do not delete. If you delete, Amazon will cause trouble. Remember this one more time. It is possible for you to delete the default VPC like this. Do not delete. You will find that Amazon machine and chef exercises and some other exercises that we will do in the future will not work properly or sometimes not even work at all if you manage to delete your default VPC. So please don't delete. Just don't touch it. Don't mess with it. Leave it alone. Having understood that very clearly, let us now begin creating a VPC. So here we go. We are going to click the VPC button calling create VPC. And here we are beginning to build step by step from scratch. And so pay very careful attention. It is very, very complex to understand the very first time. But then after two or three times, it is simple. Not a big deal. In this example, we are creating a VPC. We are essentially giving it a name. I am going to call it cloud genius. And here I am going to use a CIDR block. What I am basically saying is that I want to create a range of IP addresses of 10, 0, 0, 0, slash 16. What does that mean? It means the 16 actually is the way I hide from this end. So I will hide 8 and I will hide 8. So I can do whatever I feel like in these two boxes. I can put any number I feel like here. So I am getting about 256 times 256 addresses available to me in this VPC. So that is the maximum size of a VPC you can currently create with Amazon. That is what this screen says. 10, 0, 0, 0, slash 16. And so, you know, counting from this end, 8 and 8, you run out of the 16. So that means these addresses are clear for you to do whatever you feel like. And so in those boxes, you can put any number you feel like as long as it is 0 through 255, which means we get an address space of whatever this number is, 2 to the power 16. That is the number of addresses we can put inside this VPC. If you select 10, 0, 0, 0, slash 16, that is the biggest VPC you can get. Biggest as in number of computers you can put inside that VPC is limited to that number, which is 256 times 256. And that is the limitation of this design in Amazon. You cannot get a VPC that is larger than that number, slash 16, which basically boils down to this discussion we just had, this number. You cannot get bigger than that. You can get more VPCs, you can get 100 VPCs, but every VPC is limited to this size. And that is what we know and understand. And with that, we are going to move forward. So I'm going to name it and create this VPC click. And it gets created very, very quickly. What we know at this moment is that it has given us a couple of things. For example, we have the name Cloud Genius. It has allocated a VPC ID for us. It has a VPC CIDR notation of 10, 0, 0, 0, 16, meaning the last two areas, these spaces, 0 and the 0 here. These two zeros, you can put any number you feel like, and you can get an address space of that size. It also has given us some DHCP option sets and a routing table and network access control and default tendency. But that VPC, the Cloud Genius VPC, is not the default VPC. And that is understood. But just remember that it is not your default VPC. Your default VPC is the one that Amazon gives you, whatever. We don't care. So one other question. Sorry, I think I'm asking the same question again. So slash 16 CIDR, 10, 0, slash 16. So this is telling the VPC configuration that this VPC or this private, I mean not private, this island of network, this VPC virtual private cloud network can have any computer or any machines with IP addresses ranging from, so you said like 0, 0 is a mask, right? Like 0, 0, 0 is a mask. The last three zeros are masked. Correct. So the idea is you can have 65, 5, 3, 6 addresses. Addresses. So the 10 thing is fixed. The 10 thing we are not able to, we can mask. This is fixed. The 10? Oh, so 10, 0 is fixed. Yeah. The 16, actually this is 8, 8, 8, 8. So you start fixing from this side. 16. I see. Fixed. Fixed. Open. Okay, got it. Yeah. Open. Right. So it is open. Okay. Here it is open. Not here. Okay. So when you say a CI, DR address, it always has to accompany with the slash value, the 16, whatever value. Correct. Correct. Correct. So let's see. 67.132.65.68 slash 32. What does that mean? So this is 8. So only one IP address. This is 8. This is 8. This is 8. All of it is frozen. Frozen. I see. One IP. One IP. That is uniquely this IP. That's it. No other IP. Only one IP address. That's it. Okay. Okay. Got it. Now let us see this. 0, 0, 0, 0 slash 0. This is 8. This is 8. 8. 8. 8. 8. 8. 8. 8. 8. This is 8. This is 8. 8. 8. And nothing is frozen. 0 is frozen. So you can have anything you feel like. The whole internet. IPv4. Entire internet. 4 billion addresses. 2 to the power 32. Okay. Okay. Got it. Yeah. Okay. So 10, 0, 0, 0 slash 24. What does that mean? 8. 8. 8. This is frozen. Here you can have 0 to 55. Anything you feel like. I see. Okay. So 256. Right. Clear. 256. Yeah. Yeah. Yeah. Yeah. So the slash 24 basically means you can fit in, freeze this. Frozen. This is open. Okay. So you will see most of the time a slash 16, a slash 32, a slash 0, slash 8, slash 16, slash 24, a slash 32. That's what you are very likely to see. Sometimes you will see any other number also. For example, I will say 21 dot 22 dot 23 dot 24 slash 31. What does that mean? How many addresses? So let us count 8, 8, 8. Okay. So we've got 24 taken care of. How many remain? 7. And what is 24? Let us take a simpler example. A simpler example. 8. Yeah. Let us take a simpler example and instead I will say 1. Okay. So in here there are still 8. But then we are still have only 7 to block. We cannot block the 8th one. So if you represent this number in form of, it will go like this. And you can block 1, 2, 3, 4, 5, 6, 7, but you cannot block the last one. Right. So in that place you can put either 0 or 1. And so it basically means your address space is 2. This means this number actually represents 21, 22, 23 dot 0 and 21, 22, 23 dot 1, both. Two addresses because of 31, not 32. If it is 32, it represents only one exact address. You get that? You will not run into this, but I'm just giving you an example. This is a little corner case example. It is technically accurate, but you will most likely not use these things. Most practically you will use these numbers that I'm showing you here, which are easier to read and comprehend slash 0, meaning entire world is open. You feel whatever you, whatever you feel like, you put the number, that's the internet. This means my location, that IP address, that one exact IP address. This 24 means that the last box is not frozen. The three are frozen, frozen, frozen, open. This 16 means the last two boxes are open. You can put whatever you feel like. This eight means the last three boxes are open and the zero means all the boxes are open. You can put whatever you feel like and that is why it is represented as the internet. Now you get the idea? Yeah. Okay. Good. Keep going. So what we now have in this example is that there are two VPCs. One of them is the cloud genius VPC and we'll stay focused on this one, not the other one. Okay. Now let us walk through this scenario on the left side. I understand that I'm going to filter this by VPC. I'm going to filter it so that I don't get confused with the other do not use. So I'm going to filter like this, click and narrow it down. After having filtered, I am focused on this seven, five, nine Charlie VPC. Now we'll walk down on the left side and understand the nuts and bolts and dignity of what we are discussing and talking and then we'll build an example, a live functional example and I encourage you to do this along with me. If you want me to slow down and walk a particular step again, let us do that. But my goal is to walk down through this sequence, not necessarily in exactly the same order, but is a conceptually simpler order for you to comprehend each of these things on the left side so that you get it. So we'll boil down to the next step, which is subnet. So click on the subnet section and you will find there are no subnets. You do not have any subnet. Okay. So what do we do now? Create one, click and say, give me a subnet. I'm going to call this subnet border check, just a name. Make sure that I'm selecting the VPC that I chose, cloud genius. And in here, my cider block, 10, 0, 0, 0 slash 24. Okay. That's the maximum that you can get. A subnet can be the same size as a VPC. No, it is not the maximum. Block sizes of 24 are reasonable, not the maximum. The maximum happens to be slash 16. So that is the limitation of a VPC max. VPC max in Amazon is slash 16. So two boxes open. That's what they're talking about. In our example, we are now creating a subnet, which is a sub portion of a VPC. What does that mean? It means we have a VPC in which we can have addresses ranging from 10, 0, whatever, whatever. And that's the entirety of address space we have in this VPC. Inside that VPC, we are creating a subnet. And on that subnet, we will connect our computers like this, wherever we feel like. That's the idea. And so in this subnet, we are going to call it the border check subnet system name. And the machine IP addresses in this range, I want to label them something like 10, 0, 0, open. And I will create another subnet. And I will put machines on that subnet, and I will call it my private subnet. And I will have an internet address space of 10, 0, 1, whatever, in this private subnet. That's my idea. That is what I intend to do. I'm just calling it BC, calling it private. That's the name I'm choosing. The reference that you see here is this 0, and this 1 is the distinction. This box is open. And I represent that by saying 10, 0, 0, 0, slash 24. And this representation is written as 10, 0, 1, 0, slash 24. That's how I'm writing it, CIDR notation. And so I'm going to build this and this, two subnets. I'm going to create them right now, here. So one of them, border check, BC, in the Cloud Genius VPC. And CIDR block, 10, 0, 0, 0, slash 24. Like I said here, 10, 0, 0, 0, slash 24 means 10, 0, 0, 0, 10, 0, 0 is fixed. Last one is open, feel like whatever you want, 256 machines, 256 machines here. That's the size I'm going with. Having understood that part, the next step is to actually create a VPC. So 10, 0, 0, 0, slash 24. And I'm going to click the create button. And it is as simple as that, create. By the way, there has been a request from some of you that I don't tend to take breaks. But then we are people that we need breaks. So if you feel like you need a break, you can absolutely ask me to stop. We can take a two, three minute, five minute break, whatever you feel like, and resume. There is nothing wrong in asking me to, hey, please stop. Let us take a break. Bio breaks are necessary sometimes. So you're welcome to take that. So whenever you feel like you need a break, just tell us at an appropriate time. It is okay to interrupt me, no problem. Just wanted to call out that if you need a break, just tell me because I tend to forget I have this zero need of a break. I don't know why, but I have heard that I don't take breaks for some reason. So maybe, Nilesh, maybe once we are done with this VP, we can take a break. Fair enough. The problem is I never, ever remember to take a break. So please remind me on Slack chat, hey, we should take a break. And I will do that. Okay. I need that. I need that prompt. And so please give me the prompt and I will take a break. Okay. Next one. One more subnet and we will call it private. And it is going to be in the same cloud genus VPC, except our cider block will be 10, 0, 0, 10, 0, 1, 0, slash 24. So slightly different here and here. As you can see, the address space is slightly different. And this is just my choice. You can choose whatever you feel like. That's what I'm choosing, create. So we now have two different subnets. We just have chosen the name BC and private. Now at this moment, I would like to do one quick thing and then we take a short break and come back and resume. So the idea is, the next idea is I want to now make sure that this BC subnet is actually acting as a subnet that can be used for border checkpoint, which means I need to connect that to the world outside, to the world outside. So there has to be a connection like this somewhere. And this connection establishes through what is called a gateway. And that gateway is what I need to have. So right now, if you look at this gateway option, it tells me I do not have a gateway. So we'll create one and call it the gateway and click create. And that is what we are basically getting a Comcast connection. So this gateway got created. And what we need to do is somehow hook up this BC subnet with the gateway directly and make sure to not connect the private subnet to the gateway at all. We will connect here and not connect, no, not at all. That's the distinction between the two subnets. Other than that, there is not much difference from a logical point of view between the BC subnet and the private subnet. The BC subnet connects to the gateway directly, private does not. That's the distinction. And I want you to clearly, clearly understand that that is the only distinction is how you connect. Okay, so we'll connect them through the route table section after a two minute break. So we have what time it is. So hey Mohammed, salaam, you have a 8.25 that translates to 5.25. I'm suggesting we take a break, just a short one, take a bio break, resume. Right now, the time is 5.16. Let's resume at say 5.20. If I can write properly, so 5.20 Pacific time, or which is going to be 8.20 East Coast time. Let us take a short quick break between now and this time and continue. In the meanwhile, from the past sessions that I have had, people have told me to not discuss anything technology, like absolutely no technology discussions during this four minute break. So we will not talk technology at all. I will talk about weather, politics, and God knows what, but no technology. So please take a break, come back, 8.20, 5.20, depending on your time zone. So adjust that, come back again, and we'll resume. And I promise not to speak technology in the break so that you actually can take a break. Okay, so how are you doing? What if we have a question, because I have a question. Let us, you know, for the sake of technology discussions, what happens is somebody actually goes to a break and we don't want to miss out on the technical aspect. So it is okay for you to ask the question, and it is okay for me to answer the question, but then I have to repeat the answer. Let's just remember that. Well, I think I'm kind of behind though, that's the reason why I have the question. No worries. No worries. If you think you are behind, I would suggest that you please do a one-on-one session. Okay. So go ahead, ask your question. Okay. Well, it's about this. Okay. So I'm trying to follow along with you. And when I got to the screen for Create New Subnet, it's just blank on my AWS dashboard. Aha. Do you see your share my screen button?