I think I need to adjust my screen size. Let me do that. And this should take care of it, yeah, now it's good. The display size I adjusted. Hello. Hi, Linesh. Hi, Mukesh. How are you doing? Not very good. What happened? What happened, man? I hurt my back, actually, so it's hard to sit. Oh, man. Oh, man. That's okay. I guess, you know, yeah, take some rest, go see the chiropractor or doctor or something like that. Yeah, something like that. Yeah. That'll help. Yeah, but back problems are bad. I used to have them, not anymore, thank goodness, but they can be really tricky, really, really tricky. So be careful that that thing is crazy. It hurts so bad sometimes when things go wrong. So how are you finding this, what we have done four sessions by now? For me, it's a new world. So it's exploration for me. I have been a little slow because of office and personal stuff, but I'm collecting all those videos and I have to do a recap because I'm also behind on the homework and I need to catch up there. I understand. No worries there, but you know, you will have access to this. I think the program that we have, we will leave the access open for you. I think 100 days from the start of the program is when it resets. So if you need more time, just ping me on Slack chat, I will extend it for you if you need more time. Okay. Fantastic, fantastic. But anyway, this is syncing so I can always copy the video, but I will definitely miss the time. Yeah. What happens is that videos, yeah, of course you will have it, but I will eventually move these videos to a YouTube site and point them out, line them up in a fashion that are easy to access. For example, I'm going to show you my screen so you understand what I'm talking about. What I do is let's see, I'm opening up the browser and sharing my screen right now. So you should be able to see it right there. And in here, you see, look at my screen and I'm going to show, probably log in here apparently. Yeah. There should be a way to go access that content. And by the way, this video site is different from what we have been doing for the last initial few sessions. This video is a little bit different. I look at you from the side. Is that, is that interesting, boring, different, good, bad? For me, this is perfect so far. Yeah. So do you care whether I look here this way or that way? Do you care? No, no, I don't. I don't. Okay. Yeah. It's just a curious question that I had is, yeah. So about recording, like the last time we had this session in summer, what I did is all these recordings are now available here. You can actually review the summer recordings of month of May, June, July. They are here. These recordings are all in that location. Similarly, the ones we did in winter, January, 2016, they are in this location. So the recordings are available. Okay. So this is where you can access. This is exactly where the new recordings will pop up. And I will add them right in that location. So I call them recordings from fall 2016. That's what I will label that. And these recordings will eventually be available in that location for all of you to easily access. So even if you use the same folder or you misplace a file or something, it becomes a part of the program itself. It's there in a central location. That's what I typically do the other day. I think it was this morning when I heard that some of you are having trouble in accessing the videos. No. So yeah. The sync had not happened. It was right now. It was syncing when I logged in here. Yeah. For me, after I came to home, it got synced. Now it has synced. So I have... I think Marjorie is trying to log in, I'm just making sure that she gets the proper link. So give me a second. I'm going to get a link for her, invite her by IM and copy the URL and paste it over to her. And so that she can join, Ram joined, Mukesh joined, Marjorie is joining up, Dennis is here. And we have David coming in, D-A-V-P, that's Diego coming in. Mark is not going to come today. And that's pretty much it. So just making sure that everybody's online. And this is... Okay. And that's how we are able to get everybody on the same page. I think Marjorie is just joining in. Let's confirm that she's here. Let's go check. Dennis, Mukesh, David, I think she's not yet online, but she will be coming online pretty soon. And I'll just give her a few minutes and she will join. So while in the interim, as some of you had this difficulty of getting the sync software to work, the scenario that I actually found out is what's going on is that they have upgraded their version number, which is a change of architecture for them. So this download, this version, it's a completely new name for it called Resilio Sync. Previously it was version 238, now it is version 2.4. So if you look at my Resilio Sync, oops, I think I canceled. I think I, by accident, did I log you out, kick you out or something? No, you're still online with me, right? Good. Yep. Okay. I accidentally pressed restart as opposed to Resilio Sync. Might have restarted. So this application version is slightly newer. And this 2.4.0 version that I have is not somehow syncing with the 2.3.8 version. That's what I find the case on. So they're working on fixing that. In the meanwhile, if you update, the synchronization will continue. So your version number, 2.3.8, is the older version you might have. And it doesn't seem to sync with 2.4.0. That's the problem I saw when I confirmed that a couple of people have got the videos, but others did not. So we have these four videos lined up right there for the last four days. And these four, when some of you got it, some of you did not. The issue, the root turns out to be the version mismatch. They're working on that issue to fix that. But in the meanwhile, please update this software called Get Sync, which is, you know already where it comes from. It's this site. That's where it comes from, download the latest one. That should resolve the synchronization problems. Anyway, I have these links available to you in YouTube. So those recording links are right here in this segment. You will have them accessed easily. You can just click on it and get to that point. And that is the video from the last time that we did. So you have that already now. Okay. Let us do a couple of other interesting things, such as a quick recap of what we did. So for example, let's go to the Cloud Bootcamp. And in here, I am going to quickly recap what have we done up until now and what are we really trying to accomplish? What are we building towards and understand the bigger picture and make sure that we are covering basis from a what's going on perspective. Why are we doing things perspective and making sure that we are addressing any questions along the way as you may have or may not have. Having said that, I will like to do a quick recap since we are starting day number five. And that is what we just beginning now. So from a cloud technologies perspective, cloud tech perspective, what we are really looking at looking to accomplish is this three layered system of understanding these types of service offerings from a software as a service, a platform as a service, and infrastructure as a service. The most complex ones are actually these ones. It's very, very complex to deal with every single possibility to make sure that this runs correctly on top of this platform. The software that you will deploy runs correctly on an underlying platform. So this is the most difficult of all. But this needs the underlying infrastructure. And that is what we are currently doing, making sure that we understand those core capabilities from an infrastructure perspective. There are broadly three things, the CPU characteristics, the storage related things like we have covered in the last two days, and the networking related components are also very, very critically important. So those three things, compute, horsepower, storage, and networking, those three ingredients essentially make this infrastructure as a service useful. And that becomes available as a function for platform developers to create platform as a service, which is a very complex subject by itself. So we will jump into that pretty soon. However, I want to make sure that we are addressing these aspects correctly, meaning we want to understand storage capabilities in the cloud. We understood the compute capabilities in the form of virtualization, in form of virtual machines, in form of instances, in form of droplets, in many other names that you call, whatever names you use. But these are basically compute units, computational units that we kind of used and put that to some kind of a work. So we have attempted to study that part. We also did some deeper understanding of usage of storage related services. And now our focus will slightly shift towards the networking capabilities as provided by the infrastructure layer. So we will go spend some time in the IaaS layer, round up all these aspects, and then finish off towards jumping in understanding this segment, which is the platform as a service delivery and deployment and usage scenarios. And this part is actually very trivial. It's about using Word. I mean, come on, we don't need training for that. You already know it. We use a ton of software as a service already. And I don't think we need to do much work in that direction, because I think it is trivial. And having said, what I would like to now do is ask you for questions. Are you with me when I'm describing this kind of an overview as to what exactly we are driving towards? What are we trying to accomplish? What are we trying to understand from a big picture perspective? My question is to ask you this question, are you with me, or is there anything that is missing or do you think that we should cover or address or maybe go deeper in any particular area before we move forward and conclude this IaaS part? And I will like to caution you that this networking element involves a lot more understanding than what we have done in the S3 part or maybe CloudFront part that we discussed before. So I just want to caution you that. So you have to be paying careful attention in terms of understanding the concept of networking technologies that take shape in form of primarily an isolated virtual private cloud. That's what we will really build towards, you know, independent isolated virtual private cloud, VPC. That's what we like to put things together from a network perspective, which is completely isolated from the world outside, at the same time is able to service our customers. So that's the discussion I would like to begin. But before I jump in, I would like to ask you this, whether you have any specific questions in that context. So that's the real ask that I have. So please open your microphones and speak your mind. What questions you may have or any thoughts that you may have, please do that. Hi, Neelish, David here. Hi. So from a storage side, really seen mostly on static websites, are we going to have any overviews on database usage and transactional type of activity? Yeah. Good question. So the question that David had is about storage and the scenarios that we have been dealing with is mostly static. And that's by definition, storage cannot really be dynamic by itself unless there is a component that has some kind of a compute horsepower associated with it. So storage alone is what we have been playing that limits us to this scenario, and it doesn't become dynamic. It doesn't become transaction oriented or any of that nature unless you put compute in between. And when compute horsepowers join storage, then it becomes dynamic. When things will change on the fly, then there is a database involved, then there are transactions involved, and there are other types of scenarios of users interacting and playing. Those scenarios will come into play immediately as soon as we go away from looking at just at the storage towards a comprehensive picture of the entire solution set. But playing the storage only scenarios limits us to only static. And that's the limitation. Storage cannot compute by itself. You need to have some computational scenarios added on, and that's what we will do at appropriate time. That's what we will do. So we are basically building towards a discussion of using infrastructure as a service from compute, from storage, as well as from network perspective. And this is what we will put things together to actually build a foundation for us to be able to run our own platform as a service. That's our goal. But before we jump into our own platform as a service, before that we will take a step and actually use an existing platform as a service, use existing platform as a service solution that other people provide before we jump into running our own platform as a service on top of this kind of an infrastructure. So we will get there. This, by the way, is fairly involved, and there is an exercise for that right here in here. Where is that exercise? Here. Deploy your own platform as a service in Docker containers. So that is there, and there is a fairly intensive exercise. It involves all the aspects of using the complete capabilities that we discussed here. And we will do that part also. But I must caution, this is fairly intense exercise. So we will get to that. But I want to make sure that we cover the fundamentals first before we jump there. And before we jump, we will use an existing platform which involve using and creating dynamic sites. The fact that we will have components like CPU, network, and storage all together, lets us to run any application, whether it is static, dynamic, or in any of that nature includes a database, does not include a database. All these scenarios are possible, provided we are not limiting ourselves to just storage. That's the discussion we have had up until in the storage discussion, we are limiting to storage. So that's why static, not dynamic, but we will jump soon. Any questions further on this topic that we are talking about? So Nilesh Mukesh here, you were saying the network has a lot more than what we thought, obviously it does, how it travels, how you are accessing your storage and going through the switches and all that nine yards. We did talk a little bit about those addresses and IP addresses and things like that, the breakup of those. But if you can talk a little more like, I don't know, behind the scene thing, basically what is at the high level covered in the network? I will do that. So I think that leads us to a good point where we will start discussing about the network networking concepts. So a couple of things we have to do before we jump in to understand this concept of networking and virtual private cloud, there are a couple of things that I would like to make sure that we are clear about. One of them is DNS services. So we should like 10 to 15 minutes of discussion on understanding A records, understanding CNAME records, understanding other types of records. And there are some variety of different types of record types. These are various record types and understanding this concept of a DNS server that GoDaddy might give you or other companies might give you such as Amazon Web Services gives you this thing called Route 53 is a service that they offer. And so that is a good DNS server solution. Other people give you, whenever you buy a name from GoDaddy, GoDaddy would like to give you a free DNS server. And free means, you know, whatever it means, it may mean that, you know, it is free, but it doesn't mean it's highly available. So you might want to spend a little bit of money like 40 cents per month and get a proper, well-designed, full-fledged, robust and high quality DNS service from companies like this or from companies like Google DNS. These guys provide good quality for a very low price per month, about 40 cents is the last time I checked the pricing. So that's the scenario that I want to make sure that we cover the DNS aspects that relates to that's a fundamental ingredient. The second thing I would like to actually talk about in context of networking is this address space, which is your internet IP address space, IPv4, IPv6 and the concept of a public network, concept of a private network. What does that mean and how does a router play a role in between, how does traffic traverse from the public areas to the private areas and how do people or machines inside a private area access things outside. So this is maybe a person or maybe a machine inside a private area. They may want to access things outside on the public internet, like you visit cnn.com from within your home. The home is your private network. So that's an example of a person visiting CNN. Another example of a machine inside a machine in a VPC area, which is like a home, like I said, is a private area and the machine may want to visit some update servers from Microsoft update, Microsoft update or say Ubuntu update or some other machines may want to access some update servers. These machines need to be able to go to the public internet like these sites and grab whatever they need and update themselves inside a VPC. So that's another scenario I would like to discuss, which gives us the concept of understanding IP address space in general and the distinction between public and private and how do they play together with each other and how does the router play a role? What's the role of the router? I think that's, is that what you have in mind Mukesh? Yeah, I was trying to unmute, yes. So we'll do that. So let's get any other questions you may have in the context of what we are discussing. And let us begin our journey and stay focused on like we discussing and address your questions. And once we continue this part, we will then switch over the discussion of construction of our own virtual private cloud by understanding basically piece by piece components. Each component by component understand what is needed to build out component by component or list out things needed to construct our own VPC. And then we will like to have our apps deployed inside the VPC, not on a public digital ocean type, you know, all the machines sit right here on the public internet. That's not what you want. You want them inside a private location, your app should be secure. So people from outside should not be able to allow in, but you or customer should happily be able to access just the public part of the application, even though it may be inside a VPC. So we will study these scenarios and go along understanding them, go along practicing these things by doing it hands on live. So there are, there is no, there is no PowerPoint, as you know, in the program at all. We typically don't have a PowerPoint. We just understand these concepts and do it live on sites like this or sorry, sites like this or, you know, other Azure sites, Google sites, wherever we go, we will basically try to address and find a real live functional example of what we would like to accomplish in terms of a solution and build it live as opposed to make it boring and, you know, PowerPointy, which is not what I do. So is that good enough for us to, to begin our discussion? So in that case, let's begin this quick one. And I will begin right here on this topic of DNS. So it is, I think I may have mentioned at least two things already before, but I'm quickly taking a quick summary on what is DNS. DNS is basically the post office of the internet. Post office. So post office, what does it do? It does name to address mapping. This map, it's a, it's a lookup table, basically there is a name, there is an address. So here is an address. Here is a name, BA Cloud Genius, and there's an IP address corresponding to that. It is a public IP typically because your customers will want to visit this. It's a public IP, a public IP address space is, is spanning these many bytes. So there are one, two, three, four, you know, four bytes where you put an IP address structure with a dot in between. That's how IPv4 address is keyed out. FF means 256, actually it actually means 255. It begins with a 00 through FF. So it's zero through 255. That's the number of addresses you can have in just one byte. You can have 256 addresses. And if you multiply that four times, you will have times 256 times like that. It comes to about 4 billion addresses. That's the number of addresses you will have in the IPv4 address space. Now in a name to number mapping, that's exactly what you're looking at. For every IP address name that you know, for example, here is terminal and I'm going to make it big so you can see from a distance and maybe make it go full speed today here. And so this is the IP address corresponding to that name. That's the name to number mapping is maintained by a DNS server. DNS itself is stored across I think maybe more than millions of DNS servers. So every router in the world has a little DNS server, their own local copy. All these routers that you have and I have and companies have, they will have a copy of the DNS that they are frequently accessing kept locally. In addition to that, most major corporations will run their own DNS servers. Well known DNS servers are this thing called Google DNS, AT&T DNS, here is public DNS by Google. And the DNS names are these names, these numbers, 8888 and 8844, these are DNS servers publicly made available for free by Google. That's one. Other ones are AT&T DNS. Large companies from AT&T DNS servers, they will also provide, every major internet company will give you a public free internet server. Comcast will also have their own DNS server. So if you're using a Comcast DNS, there is the Comcast DNS server. So you have primary 75757575 and 75757676, these are the IP addresses given to us by Comcast for the DNS for Comcast users. Other people can also use it. It's public accessible. Now if you want to use your own DNS, like for example, if you get outage and you want to get to a point where, where you have a scenario where you may want to prevent yourself from DNS outages, in that case, I think I have a post here somewhere, I'll try to look for it quickly if I can, but if I don't get to it quickly, I will probably skip. But the idea is, let's see if I can find it quickly. The idea is to be able to get to a point where if your DNS fails, for example, let's see the second page, what happens if DNS fails? So here we go. I think I found it. So if your DNS fails, what happens is you use alternate DNS such as OpenDNS, for example. OpenDNS is another DNS solution available openly from this company called OpenDNS. And they gave you, it got acquired by Cisco, interesting. So OpenDNS is now a part of Cisco. That's interesting. Having understood that part, it still is actually a useful service where you can make use of OpenDNS as opposed to the Comcast DNS or telco provided DNS or AT&T DNS, but instead use something else. By doing that, even if the DNS server fails, like for example, in this example, I'm showing you that you change the DNS entry for your name server from pointing to whatever it was and switch to either OpenDNS servers, meaning these names, these numbers, or Google public DNS, which are 8888 or 8844. These numbers, if you just change that in that scenario, you don't have to worry about outage of DNS records from your company, that internet company that gives you internet and your internet might continue to work if there is no other outage other than DNS. So the core idea here is that your name to number resolution, name to address resolution happens through a lookup table, and that table is essentially what DNS is. If your router knows it, your router knows that domain has this IP address, it will automatically resolve that. What does that mean? That for example, if you want to visit a site, say you open a browser and you say, I want to go to cnn.com, now the first thing cnn.com, this browser will do, it doesn't know where to go. So if you go ask DNS server, hey, where should I go? Which address should I go? And DNS will say, your local router DNS server will say, you know what, I don't know. Let's find out. It may not know where you want to go for CNN. So router says, I don't know where you want to go for CNN. I don't know. Let me go ask my higher level DNS server. And that the higher level DNS server is what I'm talking about here in this example that I say that, you know what? What is your DNS server provided to you by your ISP, Internet Service Provider? So I'm suggesting that we change it to public DNS services such as Open DNS or Google DNS, which are a lot more reliable than your ISP provided DNS servers. So if you change that entry in your router, your router will then go ask Google, hey, what is your number corresponding to this name? My browser wants to visit this site, where should he go? And so the query would something be similar to like this cnn.com and the answers will be these two numbers. Go anywhere you like, one of these two addresses and that will render you the CNN experience. So on the browser, the browser will automatically go to those two IP addresses I said, IP, IP one and two, and those two will then be locally cached, locally cached in the router, in your router DNS. And so the next time another person says cnn.com, please, I want to go to that site, your router will say, yeah, I know, I know you want to go here because I have a local cache copy. And that's, it will automatically ask you to go to that IP addresses because the router knows that. And this locally cached copy has a time to live. And so that TTL value will decide how long this cached value will be valid. And after that time expires, that value will be deleted. And then it has to go look up the big boss again, hey, what does CNN mean? What IP addresses should I go or should I send my browser to because the TTL has expired. So my old values are not valid anymore, tell me the new values, and these values might change. Like for example, the CNN company might decide that, you know what, this is not where I want CNN to be. I would like that CNN to be in some other location. You can go and update that entry in their own DNS server, which will globally propagate that detail worldwide. And so everybody on the internet will then know CNN is not on these addresses at that time, but the new address that CNN management decides. And you can also do this for your own domain. If you have a domain, you can practically do exactly what I said. So if you have say abc.com, not just say alwakonda.com, that's the name, you have it. And so alwakonda.com is the name you have, and you decide that my name should resolve. So www.this name should resolve to some IP address, let's call it 1.2.3.4. And you make an entry in your DNS server in GoDaddy, and the world will know that whenever you want to visit this address, that the people should be sent to this IP address. That's good. However, tomorrow, Ram decides, you know what, not this, I will change it to something like 6789. And that is my new entry. So Ram will go and update that entry in the GoDaddy DNS server, and then GoDaddy will tell everybody that, you know, I'm the authority for this name. The name is purchased through me, and Ram, the owner, says that the address should be this. And so it will broadcast to everybody on the internet, and the world will know that Ram has decided that alwakonda.com should then go to this address. And that is exactly how the authority or authoritative names get transmitted on the internet with an expiration TTL value that you get to set. So Ram has to set this TTL value. And I will now demonstrate how to do this on your own. So we will take a quick question. So like how I create a, I decided to change the address of my website and GoDaddy was in, it gets updated in GoDaddy's DNS server. And so is there another registry on top of GoDaddy where actually GoDaddy propagates it to? So GoDaddy, say for example, this name was purchased by you and GoDaddy, right? So gddns is the authority, okay, because it is the place that sold that name to you, right? That is the original authority for this name. And this, you specify this, I'll tell you how you specify this. So here we go. You will go digalwakonda.com and check your name servers. And these name servers tell you, ns, by the way, there's ns at the top. It means give me my name servers of record. My authoritative answers for the name servers are ns11, ns12.domaincontrol.com. That is GoDaddy, by the way. So these are names owned by GoDaddy and GoDaddy says for alwakonda.com, the names of authoritative name servers are these two boxes. Good. What does that mean? When you go to GoDaddy DNS, you're basically updating a zone file in that box. That's what you are updating this original authoritative record of names for these domain, for this domain. So not ram. but anything.alwakonda.com, not just ram, everything. For that zone, you decide that I am going to update my name records in the authoritative DNS server, which is defined by this. And we can see this thing for every domain. For example, here, dig. And tell me the name server for Cloud Genius. What do you get? You get two answers, Aaron and Gabe, nameserver.com. That is where my current DNS servers are hosted. So if I want to change something in my zone, in my name in the Cloud Genius domain, I need to go to Cloudflare and ask Cloudflare to update these two name servers. These are the authoritative origin records for this domain. And that is where it will get propagated worldwide. So once ram goes in alwakonda.com, and let's call it alwakonda.com, and you update your GoDaddy DNS server sub-record, and that propagates worldwide, worldwide, everywhere, every country, every nameserver will just listen for that information that GoDaddy nameserver for alwakonda.com, which are precisely these ones, these two, those are the authoritative nameservers. So these NS11, NS12, they will be listened. So NS11, NS12, they will be listened as the authoritative answer file, the zone file for that domain, alwakonda.com. And everybody will just accept that value because it is the official place where that particular domain was sold to ram. Ram bought it. So ram owns it now, at least for one year, until that he decides to continue to pay, he will continue to own it and all that good stuff, but at this moment, he owns it. So he decides the nameserver entries, the zone file entries, and that nameserver 11 and 12 are the authoritative records, and everybody will just copy, read only mode, copy. Nobody else can change. They are ignored because of this entry in the zone file, which is the NS entry, which is for that zone, the nameservers of record are these two. Now, tomorrow, Ram may say that, you know what, I don't like GoDaddy and I want to use something else. In that case, Ram needs to go modify the nameserver entries for these two and replace them with something else like I did, or I chose these services, or maybe you can do something else like you can modify to choose Cloudflare or Amazon Route 53, which is this service here. So Route 53 is a domain service available in here. So you can see that Route 53 is, where is that, here. So this Route 53, I'm currently not using, but essentially, you get started and you agree to pay them $0.40, and you create a zone, and you create a hosted zone, and you give it a name, say alwakonda.com, and a comment, and say, create, as soon as you hit create button, you will get some entry to put right there. They will give you. I don't want to go there, but that's exactly what happens. So I'll show you a similar example, cloudflare.com, where I have it, and I'm going to log in, and you will see right there, coming up, as soon as I log in successfully, the DNS server entries are given to me by my nameservers are, let's go scroll down, nameserver, and actually, I should show you differently. This is not how I should show you. I should show you where I bought the domain from, and I think that is more logical. So the way I would like to describe this is that me buys this domain called cloudgenius.us from some place, some vendor. And that vendor is not GoDaddy, by the way, and so that vendor says, you know what? You bought this, but then where do you want your nameservers to be? And so I tell them, I want it to be cloudflare, cloudflare, good. So you have to somehow tell that your name vendor that I will like to use this as my nameserver. This is a vendor, and I will now go to that vendor and show you how I tell me about this domain that I want to use not your vendor nameservers, but this professionally managed cloudflare based nameservers for this domain. So I will choose that. I will first of all tell you which my vendor is. So my name vendor is namecheap.com, and that's where I will go by, go to the dashboard and sign in. And once I sign in, I get a text message. I will open that text message and paste it in as a backup method for authentication. And there we have a text coming in. There it is. And I will grab that text message to copy it and put that in here. And the number was 537712. So I'm logging in, in my domain, but I bought my name from here. And so I have these names registered, a bunch of names. So I'll focus on the one that I'm interested in, which is this one, and I'll go manage that domain, the cloud genius domain. And the entries you will see is that my domain is actually managed by a custom DNS, not namecheap nameservers. Namecheap also provides free DNS servers, but I'm not using that because I want to use something else. And so what I'm doing is here, this custom DNS that I have, I'm going to use these two nameservers, Aaron and Gabe. That's what you find. And these entries show up in my query, right there. This is Dave, cloudgenie.us, nameservers that I want to use are from this company, not from Namecheap. You can choose Namecheap, like this, or like this, or like this, but I choose none of them, but instead choose custom. And I'll say, you know what? I will manage it outside myself, not with your help, but outside. And here I go managing it right in that location through cloud player, which I find is a very beautiful service and it's good for what I really need right now, so I'm using that. Having said, there is nothing wrong in using these services unless you want to go professional with proper business running, you may not want to use a free service. That's what I'm saying. As long as you don't have a live business running, it is okay to use the basic services that these are provided, like GoDaddy and Namecheap and all that. That's no big deal. No issues there. But you understood the point. The point is you get to choose, you get to tell your name vendor, you know what? I don't want to use your name server, not you, but this. You can do that. Totally. I've done it. You can also do that. You don't have to do that, but you can. And now alwakonda.com, he buys the domain from GoDaddy. This is the vendor, right? So vendors typically give you a free name server because they want to lock you down. They want to keep them with you. They don't want you to go away. If you go away, you get the flexibility of changing your vendor when you renew without disturbing your setup. That's the beauty. That's the real beauty of changing this name server is that you keep them separate somewhere else like CloudFlare or AWS Route 53 or Google DNS or a bunch of other services provide you with these solutions. Independent name servers, they may not be free. They are probably priced, but these are name servers that are independent of the name vendor. And that breaks a lock, essentially. This lock is broken when you go away. Then you can literally change this GoDaddy vendor to Namecheat vendor, to some other vendor. I don't even care which vendor. And all it takes is a transfer form and your name control goes away from GoDaddy to another company without disturbing your business. Your business keeps on running in a separate name server, which is not tied to the vendor. So you have to break that tie right there. That's one of the fundamental reasons you should break away to some other vendor that is in your control that doesn't depend on the purchase. So that's one thing. Now whatever your zone file is, the zone file is basically sitting on one of these servers that you manage and own. This vendor can give you a free one that also gives you a zone file. These companies will also give you a zone file to manage. And here is the zone file they're looking at. There are 100 entries in there. There are 101 records here. 101 records. Bunch of different entries for CNAME, A records, and a variety of different types of records on multiple pages. I think three pages of entries I have there for that domain. There's TXT records, you see them, SRV records, name server records, mail exchange records, and more. So there are tons of records like that are created and saved by me for my business. Like here is another key. So you have keys stored, basically the key and value pairs stored in that zone file. Zone file is a very, very simple implementation of a text file, basically practically like a text file. It's how it looks like. And the file format is very simple, it looks like this, where you are basically keeping track of the SOA, the start of authority record, the name server records one, name server record number two, some mail records, some A records, some for IPv4, IPv6 records, some other name server records, another CNAME example, some more A record examples, and you write them down line by line in a file, in a text file, and call it your zone file. This is the zone file that name servers manage. And 99.9% of name servers are running this software, that software is called BIND, 99%. Everybody is running this software, almost everybody except Microsoft, maybe. I don't know if Microsoft wants this or not, but this is the, this is the solution for name server, and it runs on all of your routers, all of these companies run this particular application. This is an open source, some of you is causing noise, if you mute yourself. If you can mute yourself, if you're causing noise, that'd be awesome. So this BIND software is probably the most widely used as the name says, it is an open source product. It is a part of Unix, part of Mac, it's available on routers all across the board. And this is the piece of software that manages this zone file scenario that I'm describing here. And that basically is a text file with line by line entries for things you care for, like example.com, alwakonda.com, in name server, NS, and ns.example.com, or somewhere.com. So you can basically construct like this, this is an example file, here is a real example in this page, where you can go back to the front page, the first page you will find more examples like this, where I am basically added an A record points to this IP address, another A record point to this IP address, and that's a large zone file. You run by this software called BIND, open source, used across the board on the internet, 99.9% of sites I know are running that software, except Microsoft, I think Microsoft they have their own, but everybody else I think uses this BIND software. Now, with that understood, by the way, this site, Route 53 service, like I said, Route 53 has a service available from Amazon, like here, this service is BIND service. You say Google Cloud DNS is also BIND service, so you say Google Cloud DNS server, and you log into the console and say console and give me DNS. On a Google project, you will find that they also have BIND solution, so somewhere in there in networking side, you will have BIND, I mean, they call it DNS, but it's BIND server. So cloud networking will have cloud DNS, and in there, you create a zone file, and there you go. You type in alwakonda.com, and time it out, let's begin with a, oh, you call it a name, so yeah, so there's this name, and the DNS, and description, and you create, the moment you create, you get a zone file, and you edit the zone file, and you get a bill, 40 cents per month. These are commercial services, and similar to what you see here in Route 53, and there are many more companies like that, some of them free, some of them not so free, but mostly cheap, and so that's what we are discussing in the context of DNS name servers. These servers are, and should be, ideally, unlogged free from the name vendor. Don't use those services, ideally, you should not, but it's okay to use them for learning, but in all practical purposes, you want to keep yourself free, unlocked, not free as in, so by the way, one interesting thing, when I say free, I really don't mean zero dollars. I actually mean freedom, so just remember that whenever I say free, I mean freedom. I think I should clarify that, I mean libre, I mean liberty. That's what I really mean by free, not zero dollars, no. So remember that freedom is what you get by getting your vendor to unlock you and let you free, out, open, to manage your own zone file independently of the vendor. Once you are there, you can basically edit your zone file. The zone file is a record. You can have a record type and put a name and an IP address. You can have a CNAME record type and put a name like Bob to the longer name called Robert and put more names like nameservers. I can use cloudplayer.com or domaincontrol.com or whatever other name controls. You can have SRV records, you can have SRV records, and there are tons and tons of record types. You should read more about that in one of these lessons we'll have there. So this module number seven will give you a decent overview on what that DNS thing is. And I would suggest that you read that. And there are some examples given, a variety of different types of records that you can see and read and play with your own domain and ask questions in Slack chat after the fact if you run into an issue. I think you should do that on your own. I have a question. Yes, please. Go ahead. I have a question. So on the zone file, do you only manually create it or is there a tool that will help you generate it? There is always a tool. There is always a tool, right? Okay, great. Yes. The zone file can be managed automatically. The zone file can be automatically managed through automation. So for example, once we get to that point, you will have Chef to manage DNS. So you can have Chef manage Rackspace DNS or managing here is an example of automating DNS records using Rock53 and OpsWork. So there are tons and tons of examples. Every company will have their own automation tool and we will use some generic ones that will apply to all the services that we may want to deal with. So for every company like Rock53, there is a library for managing that particular toolset. Google DNS will have their own library and there are ways to use tooling that you're using to manage these DNS zone files through automation. Yes, to begin with, we will edit them by hand. But editing by hand is not scalable, so we will jump to this whenever we are ready for that. So yes, good question. Yes, we will automate and we have to, because it cannot be manually, physically impossible if you're doing a large scale operation, you cannot do it by hand, you will make mistakes. And so you want to avoid that, but in a program like this, you have to do it by hand to understand it. So yes, you will start using automation once you get larger in an exercise or in some other physical project that you may be working on. But first, understanding is the first step, just to get to really understand the detail. Does that answer your question? Yes, it does, thank you very much. That was my day, I guess, right? Yeah, I guess you're the only lady, so that must be it. Am I the only girl? I know you are. It reminds me of my computer science class. Exactly. It's the story of my life, I only work with guys. Yeah, but we have had at least one or two ladies every time we run the program and they come from, of course, computer science background and it's low in number, but yeah, it's growing, I guess it's growing over time. These days, a lot more people are attracted towards that profession. And so people are coming and adopting it, which is nice. Cool. So that was about a brief discussion on DNS, let's revisit. So we want to discuss DNS, which I think I did. If I did not go deeper in this, you ping me, tell me right now, later on, wherever, and I will do another discussion on this. It's focused on answering your questions, but please read that module that I showed you on the site. That will give you a little bit more understanding. Now let us understand this concept of a router, which is very commonly understood. You already know it, but I'm just going to revisit. The scenario is you have a private area, like your home, for example, and in your home you have a PC and a Mac and a TV and some kind of an iPhone or something like that. And you have a router that is kind of a thing that has a foot in the home and a foot outside your home. So this is a foot. This foot is called your internal ports. And there is another foot called the van port or the outside port, call it out. And then you have another animal. It is called the modem. This modem can be your Comcastic modem or it can be your DSL modem. It can be your fiber connector or any of those things that basically gives you, at this point, this point is the point where you receive a public IP. This public IP address is given to you by your service provider, whatever that service provider is, DSL line or Comcast line, cable line, fiber line, this line, that line. These companies will give you a public IP address, typically one public IP address. And that is available to your van port on the router. This location has that public IP. And this router is doing a bunch of interesting things. It has a couple of roles. So routers typically have a variety of roles. One such role is called masquerading. Another role is DHCP server. It is not necessarily true in all the cases, but most of the time it is true that you have a DHCP server. Another thing that it does, which is a part of masquerading, is network address translation. And then there can be other things, but let's focus on these two things. And in fact, more importantly, this thing, the masquerading part, that's what I want to really, really talk about. There are other roles assigned to the router, such as maybe giving you Wi-Fi signal and all that. But that's just a method of connection. So typically you have a modem, then you have a wire connecting to your router, and this is a public IP address. And then internally inside, you have multiple outputs called internal outputs. These are your RJ45 cables, or some kind of wireless connector you might have. These are called Wi-Fi endpoints. And each of these things are connected to some kind of a device, either through Wi-Fi, like an iPad, or a wire to a Mac, or another wire to a PC, things of that nature. So that's a typical connection layout. Now this device is the magical device that we want to talk about. The key interesting characteristic that we know, most of us understand this very intuitively, is that inside the home or private area, the address space is typically something like this. You've probably seen these addresses. And outside is the public IP. This IP address, you can find out yourself, if you're on your PC or Mac, you will find that if you go to a site, whatismyip.com, like this, what is my IP? And it will tell you what is the IP address right there. This is the IP address, that is my public IP address of this location, given to me by the company that gives me internet access. And this is only one. I can have many such internal private IP addresses in typically this range. And this is internal area. It is protected by a firewall, that's another thing, firewall is another role. And so the router has that role also, which is what I did not mention, so we'll talk about this also. Now, in that router scenario, you can find your internal IP address, as well as your public IP address by going to this site, say what is my IP, or go to this site called whatismyip.com, and will give you the IP address for your public facing site. So the Comcast cable communications has given us the city of Redmond, Washington, and that is the address. Now, if you look at my machine and look at the network characteristics and open network preferences, you will find that I have a bunch of connectors here. So this is the connector that I'm currently using. I'm going to click on that, hope it lets me click there, for some reason it is not. So I'll ignore it. I'll go to the terminal. And in here, let's go, ifconfig. In our PC, you will type ipconfig. And you will find that it has given me a bunch of addresses. My address of interest is the internal machine address that's given to me. And that address is right there, 10.01.40. This is the Ethernet IP address assigned to me by the modem, by the router, 10.01.40. So what you're looking at is this Macintosh that I have has been assigned an internal address of 10.01.40. That means I'm not on this particular subnet, but my router seems to prefer a different range of 10.01.whatever, as opposed to some other routers will prefer this range, whatever.whatever. So this is my choice, whatever I choose here and here is my choice. In fact, in a 10.0 address, I have this choice also. So these are my whatever choices that I want to pick, whatever, whatever. I can pick whatever I want here. And that's the entire address space that I can decide for my private area. This is also a private area, as long as these two, 0 through 255, 0 through 255. So I have an address space of about 64,000 in this subnet. In this subnet, it is a larger subnet that I can get. These address spaces are called out specifically by a consortium, RFC 1918. And so this RFC 1918 allocates private IP addresses and it is an IETF working group address allocation for private internets. And through that RFC 1918 is generally agreed upon globally that this is the current best practice that we will allocate these addresses defined in that paper as private addresses. Everybody will follow that same method and in that method, the generally agreed upon principles are that everybody will use this address range, this address range, and this address range as private, meaning they will not be routable from things outside, not routable. Meaning traffic cannot go to these addresses. If you are on the public internet, your traffic will not reach these addresses, 192.172.10. Those are the three ranges that you saw here, 172.192.192.168 and 172.16. There's more clarity and that's the space of address that it is not routable by design. So this is how the internet is designed, that this is protected by design. Traffic cannot reach here at all, I mean, at all. That's the level of, that's the generally agreed upon private network definition in the internet as defined by this RFC, like I mentioned this one, 1918. And you can read more about it on Slack chat. I'm going to paste a link for you right there. And having done that, what I'm going to do is continue our discussion in the topic, which is, if it is not routable, then how does the traffic actually reach and how do these guys go out? How does that happen? Who's going to bridge? And that is where router comes into play. So this router, which has multiple internals and typically one, maybe more outside, WAN, Wide Area Network, or out, I should say, out. So typically one, maybe more outside facing internet address and multiple internal addresses in the ranges that I mentioned, 192.172.10. And so that address range is internal. You can choose whichever subnet you want to prefer and the router will then decide to allocate addresses to machines internally, like the machine I am using right now has an address assigned to me. And that address is this, meaning I have chosen in my router to select this subnet. And I am using the DHCP server, Dynamic Host Control Protocol server, inside the router to allocate an IP address to the Mac. And that IP address happens to be this. So there is a DHCP server which issues an address, internal address, to machines inside the private area. Here you will be known as 10.01.40. And other you, you guys will be known as something else. So for example, let me see if I can show you live example of another one. So here is share my screen and share my iPhone, iPad, if I can see, no, it's occupied apparently. So I will click and then mirror. So you will see that my iPad will pop up right there and it will be a different address. It is probably clear to you, but I'm just clarifying. If it is too trivial to you, please tell me that I am being too trivial and I will stop being trivial. But if it is not trivial, let it go. So you're looking at me, projecting my machine over to this screen, which is going to pop up any moment soon. And does it come? No, it did not pop up. That's crazy. That is crazy. You're playing mirroring here. Now it comes. So now you see that my machine has an IP address given to me as 10.0.1.4. This is an iPad, by the way. So it is different from what I had on the other machine, which was 10.0.1.40. So I'm going to stop this, go back to the other one, like here, and look at the internal machine that we had, this particular desktop that we have, and the network preferences should show you that this machine is 10.0.1.40, as opposed to the iPad was 10.0.1.4. So you're looking at a scenario where I have a machine and an iPad, 10.0.1.40, and another iPad with 10.0.1.4. And like this, I have a lot more machines inside in this location, and they are all given an address in that address space, but I can change these numbers. But this 10 is frozen. This 10 is frozen. And that's what makes it a private area. And this router is assigning these addresses to these machines that they come online and try to get connected, the router will say, you know, I assign you this address, so take it. And then they take it and they start working with it. That's the role of a DHCP server, it is available inside your router already. That's one function. The second function, which is probably one of the most important functions, is that called NAT. Network address translation. It works like this. I'm on the iPad, and I have this address, 10.0.1.4, and I open CNN website, so it will look at the router and say, you know what, I want to go to CNN, please. And so the router says, first time ever. I don't know what you're talking about. What's CNN? Let me go ask my boss. And so the boss happens to be the Uber DNS server at the Comcast level, or maybe some other server from outside, like Google DNS, or OpenDNS, or PublicDNS, or AT&T DNS, tons of services available. Any of those services will ask, hey, what does CNN mean? And so those servers will run basically this query, CNN.com. Oh, it means these servers, fine. I'll make a local copy of this entry database, these two lines, I'll make a local copy in the router right here. And that is my local DNS server, local, on the router itself. So next time, this Mac says, I want to visit CNN, please. So the router says, yeah, I know what you mean, CNN, yeah, I know. So just go there. And so that traffic will be handed off to that exact location, which happens to be this location somewhere on the public internet, which is called CNN.com, and that traffic will flow. However, these guys don't connect directly. It is a function called masquerading, or in simple English, called a mask. That's what this router will do. It will pretend to CNN that I am the iPad who wants to visit CNN.com. So please show me the news, and once I receive the news, the news will reach the router, which is a public endpoint. But it cannot, CNN cannot, absolutely not go to the iPad itself. So router has to do the masquerading on behalf of the iPad to let CNN know that, you know what, CNN, I am the iPad. And router is blatantly lying at that moment, masquerading, pretending to be the iPad, and saying, CNN, give me the site, please. And CNN says, oh, you look like the iPad, I will give it to you in the iPad format, which is a little bit different than your regular browser format, as you may know. So this is the CNN website, looks like this. And if I change it to be a little bit different, like this, for example, you see that the layout changes a little bit. I think it is better. Yeah, it just changed. So the layout just changed of CNN website completely because my browser changed, the structure of the browser changed, I'll show it better in Safari. So here, safariCNN.com, open the develop agent, I will change the agent to iPhone 7, and let us see how it looks like. So CNN.com, and it looks a little different. You see the layout changes completely. It becomes like a phone layout. So it knows based on what that thing is telling. This router is basically lying to the machine, CNN, that I am the iPad, or I am whatever, and it is getting the appropriate response based on what it is pretending to be. Now, when the traffic goes, the traffic is destined to the iPad, so the router will then hand off that traffic to this guy who asked for it, and not to this PC who is doing nothing. This PC or this other TV may be sitting idle, not asking for CNN. So this router is smart enough to know that you asked for CNN. So I will give you the response from CNN to you. So you show it on your Safari browser. And that's great. At that moment, this Macintosh says, I don't want to go to CNN, I want to go to Times of London or Times of India, or something like that, another website. So that Macintosh will go to this router, ask for Times of India, and router will say, you know what, let me go Times of India and pretend to be a Macintosh running whatever browser and get the response back, and I will hand it off to you. And that action is called masquerading. It is basically pretending to be somebody else. And you will learn more on this topic specifically in the sections here, in one of these sections you will have. If you should follow along and on your own time, just take a pass through reading through there are not too much content, but it is relevant to the discussion that we are having. So there is a lot of material available for you to read and refer. There are short, one minute long, two minute long videos focused on specific topics that you should read. It will not bore you. I hope not. If you find it boring, please tell me. But I keep the videos really short. So that's masquerading function. The third function that router also does for you is this concept called firewall, which is basically a collection of rules. Firewalls are typically constructed out of an open source software called IP tables. And this is the software, open source, part of Ubuntu, part of Linux, part of Unix, everywhere it's used. And that is exactly how firewall is constructed at the foundation. Microsoft has a different tool set. They have their own. I think you already know if you use Windows, there's a built in firewall and in the server side there's a separate tooling for that, but it is not IP tables. But it's also a firewall, the same thing applies, the same concept applies. The concept essentially is it's a collection of rules, rules of what? Rules of from, so a couple of things, from where? It's about traffic, rules of traffic, the traffic rules basically. So where is the traffic coming from and which protocol, which port number and should the traffic be allowed or disallowed? And that pretty much is the rule structure. So it's a collection of traffic rules, collection, lots of them. Where is it coming from, which protocol, which port number and should it be allowed or not? Except reject or drop. So there's a drop function also, you just ignore the packet. So any packet that comes in, so here is a packet, packets how traffic travels on the internet, packet origins from some source location. So this is the origin where it comes from. So this is the source, source location. The packet travels on the internet and they hit a firewall. In the firewall, there are rules. The rules are basically, hey, where are you coming from and which protocol do you want to execute? Which port do you want to go to? And are you allowed, are you disallowed or should you be dropped? And when you disallow, you basically reject. And you drop means you silently drop. Don't let anybody even worry about, just ignore and drop the packet and move on, do your thing. And so you either actively reject or you allow the traffic to pass through that port number using that protocol for a given origin source. Where is it coming from, which protocol, what port number allow, reject or drop silently? That's the rule set, the rule structure. And this collection of rules is also written down in a router. And that is, you know, how a router helps secure your private area, which happens to be most common cases, a home or an office or a VPC, same things, basically the same thing. It is a VPC, I think of a VPC as a home away from your home or office away from your office. It's an island somewhere far, far away, you cannot go there, but you can virtually logically go there and be there and live there logically, not physically, logically. And that's the scenario we will get to pretty soon. And that home away from home, office away from office is a virtual tourism, if you think of it that way. You know, you logically traveling there, you live there, you go stay and enjoy vacation. Sometimes you live there perpetually, logically, not physically going there, but logically. And these routers help you properly enter. And this is you, you can properly enter, other people can properly access appropriate services and bad people can be disallowed from access. So that's how you basically structure your design when you can properly go in, other people, your customers can appropriately access the services that you want them to access and bad guys are stayed left out. That's the design that we want to really build through a systematic layout. And we want to do this in our home away from home, office away from office in a virtual private cloud. It is going to be ours, private, private meaning it will have those address spaces of 192.168 or 172.16 or 10 dot whatever. And so this I think is the most commonly used address space that you will see. This one is kind of small because it has only 64k numbers, these two are larger. So it's actually even more larger. So you commonly see these two are used in larger networks, larger virtual private cloud networks, not this much so much. You probably don't see this. This is mostly in home usage. So we focus on these guys and understand how to construct a network and island area demarcated for our own use, for our own applications to run securely far, far away from us. And we will have those scenarios of users, these personas that I would like to call. The persona is one that is you or your employee or your employee, your colleagues, employees of your company. Those are you, those are the people that own and manage and are responsible for services. That's one persona. The second persona is your customer. You really want to really provide services to your customers. So this is the most important persona of all these things. And the third persona are the bad guys, the bad people I should say, bad people and you want to keep them out. Kapu, you know Kapu, David would know what Kapu is. He is almost from Maui. So Kapu is keep out in Hawaiian language. So we want to keep them out and the bad people, you want to basically be very careful about keeping bad people out, keeping very careful, making sure that customers can come in. And of course you need to manage the whole thing. So those are the three broad personas. And now in order for us to construct these components, let's do a quick analogy of what elements do we need in a small network. Say for example, in our home, we need a subnet. In that subnet, we will have something like 192.168.whatever.whatever called out. And in that subnet, we will have 64,000 addresses and we will have machines that PCs and Macs laid out. And this is protected through a router. We will connect everything inside directly to the router in the internal ports and the external port is connected to the modem and none of these guys directly hook up to the modem because we don't want to do that. Not at all. Unless some company wants us to test something in that case, it's a test case in which case you get rid of the router, you have a modem and your PC is directly connected, which is how older days, 10s of 15 years ago, we used to connect like this. Not anymore. We have a router in place in between and that is how we typically connect. This is primarily for security of our internal resources. This modem gives you public IP and by doing that, you're exposing your machines to the world outside if you ignore the router. If you directly connect, I remember having suffered through this scenario long, long over like 20 years ago when I take a new computer, purchase in the US, go to India, connect it to a modem on the phone line and immediately get infected with a virus. Immediately. And I cannot fix it. I used to struggle as to what's going on, but essentially in those days, Windows did not have this concept of a firewall. It did not exist and it was a Windows PC, I remember. So the moment you connect this PC to the modem and dial in the phone line, you immediately get infected. And that was crazy for me to understand what's going on. And then eventually I figured that it's the firewall that is missing. And as soon as I put a router in between, like here, the problem disappeared. And that's just an example I'm saying. So taking similar examples in the context of cloud, what does it mean? It means we need to have a private segment, a segment which has a subnet, which is kind of set of like 10.0.1 dot something, whatever. Here you can put whatever you like, and that's a small subnet. It contains 256 entries and you can create the subnet and have machines up to 256 machines in that subnet. And that subnet is isolated by its definition, isolated because it is a private address space. So you define it like that. We can also construct a separate subnet, which becomes a public subnet. And in that public subnet, you are basically allowing these machines to be on the subnet, but at the same time get connected to the world outside. And that's the concept that I will now show you with a quick example, and we will begin hands on. So here we go. We'll go to Amazon example and select this region very carefully. You want to make sure that you understand where you belong. And so I'm going to choose Northern Virginia as my example or Oregon as my example, but it doesn't really matter to me. So I'm just going to stick to one of those. Let me just quickly check which is clean for right now so that there is no confusing examples in there. So I'm cleaning up a little bit. There is one VPC. Okay. I think I'll stick to this Oregon. This looks clean to me. So there's nothing much to confuse anybody. So I am going to select my region Oregon in there. It is almost like what you would see on your side and we will first understand this segment, the networking segment here, which is VPC. So we'll go to that area. And by the way, starting a VPC and constructing the whole thing automatically is very easy. Just use the wizard and click and you're done, practically done. But by doing it this way, you don't really understand what happened under the hood. And so there are four examples they're giving you here. So go back. This is one example where you have a single virtual private cloud with a single public subnet. This is more like your digital ocean scenario where everything is on a public subnet and it is inside a virtual private cloud. So it is protected through some kind of a security group firewall scenario. But then all these machines that you see in the dark gray and black colors, they are all on the public subnet. They all connect to the world outside on the internet and S3 and this and that. That's one scenario, which is like the starter basic dummy scenario where everything that you have on the subnet is able to connect to the world outside, go to CNN, go to whatever you like. And that is not ideally a good use case. So it's there. It is not secure enough to my taste. So subnet is available and this one subnet you can carry as many machines it can and they are all able to access the world outside like CNN as an example, other sites or another other example. So basically public internet accessible, you can get machines here. And this is a AWS VPC protected by their firewall known as security group that you already know. And this is the firewall concept. That's one design that you just click and get it. But that is like one of the simplistic designs. You don't want to go that direction if you're really doing production. The other example is more interesting. This example, you have a public and a private subnet and I think this is a more interesting example because of the layout itself and I'll talk about this layout. In this you have a VPC outside. Inside that VPC you have two separate subnets, a public subnet and a private subnet. You want to put certain machines on the public subnet such as your router. And yes, you will have a router inside your VPC. You will buy a router and put that in the VPC, in your VPC, in the public subnet, in your public subnet inside the VPC just like this NAT, this NAT box is a router. And yes, routers are available on Amazon and every cloud or you can create your own router through a script I will give you. So that's available. You can basically convert any machine into a router. Just any Unix machine, Linux machine, run a line of code and it becomes a router. And that's this box, you will place it on the public subnet and all other boxes you will typically place it on the private subnet. And all of these inside a virtual private cloud. And you see that this private entities are not directly connected to the world outside. They are not, they are going through the network address translation NAT device and then go outside. And that's the design point, which is a more interesting design. So the second layout we have is a public subnet and a private subnet. And whatever machines you will create, you will put them here on the private side. Occasionally, you will have some machines like a jump box sitting on the public subnet or we did some exercise with jump box already, right? I remember. Did we? I think we did. Yeah, we did. Yeah, we did. We will put a NAT box right here, meaning this becomes your router, your jump box sits on the public subnet and then all of these things belong in a VPC. So these guys are on the public subnet. By virtue of that, they can connect to the world outside like CNN, for example. I don't think a jump box would like to visit CNN. Why would it be? But just saying. Similarly, NAT can visit the internet, internet www, wherever you want to go, totally open. And that is the nature of public subnet. It allows you to go outside because there is a thing here called the gateway and it lets you go outside. A gateway is conceptually similar to a cable modem or a DSL modem, which lets you go outside in the public IP space. That is available to you by the cloud provider will give you that gateway. And that's how these public units will access the things outside. These guys, sorry, you cannot go outside. They're locked up because they're on the private network. If these guys want to go to the world outside, the only way that you should allow them to go outside is to go through the router. And let this router or the NAT device masquerade the traffic for you. So this is machine number one, machine number two, machine number three, like that. These guys should go out to the internet only, exclusively through the router. That's the design. That's how you should construct. And that's this example. You can quickly create a select and boom, it goes, it will do it for you, but that's not what we want to do. We want to understand the underlying components really before we start using these quick shortcuts and things like that nature. So the another one is here. Third example. In this example, you have a VPC like this outside and very similar to what you had before, except there is no NAT device. Every NAT device is not shown here, but there may be one, they're not showing it. What they're interestingly showing here is that there is a VPN, virtual private network, which is a foot in the door in your virtual private cloud. It is like your logical presence in the cloud. This VPN gives you a method of connecting to the world outside, inside your VPC, without going there. So your corporate data center at the bottom has a VPN connection to the private subnet in the VPC. So you can access any machine inside, whether it is on the public subnet or on the private subnet, it doesn't matter. You can have machines here, machines here, this is your jump box, this is your NAT device and other devices you might have, wherever they have. All of these things are VPN connected, VPN. This thing is a VPC, virtual private cloud. This is a virtual private network and that network lets you connect to your corporate data center. So wherever your office is, you can have a VPN connection established and thereby what happens is all these boxes that you have appear to be inside your company. They appear to be local to you, but they are not. They are on your local LAN and that's how it appears on a logical representation on the local network. They become locally accessible on the machine. So there is no need for you to have a separate router or separate jump box or things of that nature. As long as you just want to go in, you can just walk into it through the VPN tunnel. It is like the tunnel system that we established through a jump box the other day, except through a VPN connection, which is another exercise at some point. But this is a scenario that they're trying to illustrate here. You have a VPN connection, you select this and you go. And a fourth one, this scenario is completely isolated from the world outside. It is dedicated for your corporate usage and that is your extension of office, your office extended into the cloud. You're not going to the internet outside from here. All of these subnets belong to you. They are VPN connected to your data center, to your company. It happens to be in the cloud. That's the only difference. And this is virtually your private cloud. I mean, it's virtually yours. It is yours. And you can go in there, you can do whatever you want, come back in through the VPN tunnel that established and that's it. Those machines in that area don't connect to anything outside at all. All you can do is just go in there and come back and have those machines serve you. That's the scenario. In the fourth scenario, they have given you quick configuration options, you can just click select and start, but that's not what I want to do. What I want to really do is to click VPC and don't use the wizard. Do not use the wizard. What does that mean? I am not clicking on that blue button. Instead, I will select my VPC is your VPC, click here. And here I have this VPC available to me. It is a default VPC. And I told you last time, do not delete that one. Do not delete the default VPC. Do not. Please do not. Okay. After having said that, I'm going to tell you that I'm going to not use that default VPC because I'm going to create another one. And here I go. Click the button. This is not a wizard, it's just a step-by-step process to help us understand the design. So in this design, I'm going to create a VPC and I'm going to give it a name. And I'm going to give it a CIDR block, the range of IP addresses where I will populate it. So here is the space that I want to use. 10, 0, 0, 0, 16, that's not cnn.com, but 10, 0, 0, 0, 16. That's a different notation for some of you, it may be new. So I will talk about it in just a minute. So this is the notation that I want to create a VPC with. The name will be CloudGenius. The range of IP addresses is going to be in this space. And I will then create. When I do that, it gives me a large space for me to work with. And that space is basically defined by the number 16. This 16 is actually the mask that you want to hide. So for example, if I say slash 8, it becomes even bigger, even bigger range of addresses. If I say 16, sorry, slash 16, it's a little bit less than the number 8. If I say 24, and I will give you examples. I'm just giving you some intuitive understanding of what this means. And so there is another video about this topic somewhere here. You will find it in, where is that? CIDR notation there. So there's a little video on this topic right there in unit number 3, module 11, where I described this is a very short video, but they get straight to the point as to what it means. I think the video is about three minutes. So it's not too long. Just watch it. It is in dense focused video. So it will tell you exactly what CIDR is and how it means and what it means in real life. But I'm giving you quick intuitive understanding of these things. So what I'm really playing with these numbers, 8 and 16 and 24 and 32 is what I'm really playing around with. And what I'm really doing is giving you a sense of what it means. And so when I have an IP address and I'm giving it a divider, divide by, or maybe slash says 8, slash 16, slash 24, and slash 32. I'm basically narrowing the range of addresses available to me. When I have a bigger number here, the range is really, really narrow down to 1. When I have a slash 24, I'm narrowing it down to something dot something dot something and whatever. This is the whatever portion. When I have a slash 16, I'm narrowing it down to something and something with two whatevers, whatever and whatever. When I'm doing a slash 8, I'm narrowing it down to three whatevers. Something whatever, whatever. So this 8 is the mask. It is basically masking this portion, 8 bits. This portion is 16 bits. This portion is 24 bits and the whole thing is 32 bits. If I mask the whole thing, it is going to give me exactly that one IP address. If I mask these three things with a slash 24, it is going to give me an address space of about 256 addresses. If I mask these two things and leave these whatever, whatever I want, then I am getting 256 times 256 address space. If I mask only the 8 bits and freeze this to say 10 dot, for example, in that case, I am getting an address space, a very large address space of 256 times 256 times 256. And that's the address space I'm getting if I'm using a slash 8. I'm getting this much room for me to create new computers and put that on the subnet if I use this. I'm getting only 256 addresses if I use this slash 24. And now back to this example. It is telling you that you cannot create a VPC larger than a slash 16. It means you cannot do this. It means you cannot do this, or this, or this, or this, or all the way to this and this. You can do this though. It'll let you. 15, it'll say no. 8, it'll say no. 1, it'll absolutely say no. And 32, it will say no. It is too small. And so you have to be a reasonable size. This is a very small subnet, 28 divided by 28, but it is acceptable. Bigger is better. Smaller may be better for different use case, but that's the range of addresses that is available to you. So slash 16 gives you a space of about 64,000 addresses that you can put in that particular sub VPC. So this VPC that you have, hold on, let me get that right. Yeah. So in this VPC, you cannot create a VPC larger than slash 16. That's the limitation by design in this cloud that we have to understand that, which means we cannot put more than 64,000 machines, practically speaking, as you saw me describe the concept here. This is the simplest way to understand these things. It can be very cryptic if you go into binary logic to really do the math and get to the point, but those set of videos help you do that in here. They help you describe that concept if you want to go deeper in understanding what that thing is. So this video will help you in understanding that little bit deeper than what I just described. In short summary, remember 8, 16, 24 and 32, it will get you the point across very, very easily in terms of understanding what you can put as a wild card, whatever, whatever, whatever in the discussion that we are having, which is you're basically making room for you to put any address as long as it fits that schema. So you can put whatever you like here, like that. And by virtue of this, only one block gives you this much addresses to work with. So only 256, like that. So with that understood, let us understand also that this cloud, where did that go? This cloud gives you a maximum of slash 16, cannot be larger than that. By larger, you go 15 makes it larger, 17 makes it smaller. So it's okay. Now with that, with that understood, let's go to the 16 example. So I will create this VPC and say slash 16 and yes, create, so it is done creating. I'm basically done. I have a VPC going with nothing inside. So now you can see that my list of VPCs, you will have two VPCs. One is the one that I don't want to use, so let's label it something different. We call it default or don't care or something like that. You just don't care about that. Just use focus on this one. So cloud genius VPC. So you have a VPC ID, it is available, it has a CIDR notation. As you saw, I chose, it has DHCP option sets defined, route table defined, network attackers defined, default, and it is chosen. And it is not my default VPC, remember, no, not default, that's okay. So this is the VPC I want to use. And by the way, let's go look at the other side here. Do I have any subnets given to me to begin with in my VPC? So let's go focus on cloud genius VPC. So filter that, and you will see that as I filter by VPC, I don't, not the don't care one, but the newly created VPC, I don't have any subnets, which means now is a good time to create those subnets inside my new VPC. And creating a subnet is basically drawing those lines that I draw, like this line and that line. So you have a VPC there. This address space is 10, 0, 0, 0, slash 16, meaning you have the flexibility to choose this and this, but this is frozen and this is also frozen. So you get the flexibility to choose this segment and this segment because of the virtue that you have a limitation of slash 16 in this entirety of VPC, which you just created. So now we have to create subnets. And we will create two subnets, one is a public subnet, the other one is a private subnet. That's the naming convention. By the way, these are just names. The fact that you connect this to a gateway makes it a public subnet. The name public has no meaning. You can call it literally, you know, a dog subnet and a cat subnet, and it, it'll work. The only way to really understand whether a subnet is a public subnet or not is to see whether it can connect to a gateway or not. That's the way to think about public and private subnets. The naming does not convey its capability. You can name them whatever you like. Now, having understood that part, let us go create some subnets, creating subnets, click and okay, hold on. So I'm going to go back to that location again, VPC and the one in Oregon, I think I was. So Oregon and in there I have this two VPCs there. So click two and the cloud genius one I want to filter on. So I'll say the cloud genius and the subnets, I do not have any, so I'll create one. And in there, I will have this subnet and in there, I will just name it dog or cat or whatever, or rather public. And here, I will make sure that I'm using the cloud genius VPC, not dollar VPC. And in there, I will put a cider block notation and I will pick this example. And I will paste that example right there. Not this, but this. So slash 24 example, what does that mean? It means that this subnet will carry machines with addresses ranging in the space 10, 0, 0, 0, slash 24. That translates to a machine that can have any address as long as it fits this mold. Anything you want to put here is okay. And that belongs in this subnet. I'm going to call it a public subnet and that X basically says that you can have any number between 0 through to 55 as long as these things do not change. So they need to be frozen, frozen, frozen. This can change because of the 24 mask that masks these things masked. You can change this if you like. That's what we are deciding in this scenario. We are saying the public subnet will have 10, 0, 0, 0, slash 24 and create in the cloud genius VPC. We have a new subnet created. So we got this created. I will create this subnet and label it slightly differently. We'll call it private and the mask and the side of notation will be something like 10, 0, 10, 0, slash 24. So this is my choice. This is my convention, like totally my personal convention. There's nothing, no scientific logic behind it, but it's just my preference to use the number 10 as different from this number 0 for public subnets. I prefer to use the number 10 for private subnets. This is just my convention, my own personal choice. Now with that understood, our public subnet is ready. We'll create one more subnet. We'll call it the private subnet and I will make sure that it is not in the do not care but in the cloud genius VPC. And in the cider block, I will like to put 10, 0, 10, 0, slash 24. This translates to anything I want as long as I don't change this pattern and then select whatever address I like here, totally. So I'll again get about 256 places in this subnet. I'll get to install 256 different machines in that private subnet and I will create that by saying, go create. So it will do that for me and it's done. So it's very, very quick and it doesn't take much time. So now that we have created a subnet, what does this do for us? So let's draw the picture again. So we now have two subnets. One is labored public. The other one is labored private, but it doesn't do anything by itself. It has this address space of 10, 0, 0, 0, slash 24 and 10, 0, 10, 0, slash 24. So it's slightly different here from here. So that's the only difference. This bit, I mean, this is not this nibble, but rather this byte is different from here. And that's the only convention that I like to follow just to keep distinction and create two separate subnets inside a VPC that I have created for myself. And that range is 10, 0, 0, 0, slash 16. That basically translates to these two addresses that I have. I can do whatever I like, put whatever number I like. As long as it is in between 0 through to 55, I can create this entire address space is available to me inside this private region, private area called the VPC. And so we have two subnets ready for us. They are the private and the public. Let's see the next things. The next thing I would like to now look at is the gateway. This gateway, we don't have any. In our Cloud Genius VPC, we do not have a gateway. So we would like to get internet connection, basically subscribe to Comcast or subscribe to DSL from CenturyLink or something like that. So here, click to create a gateway, call it a name. I'll call it GW gateway and create. And that's it. And I have a gateway now. It doesn't show me. So I need to refresh and it should show me the new gateway because it is there. And I have two gateways showing. One is the green color, which is not for the VPC I'm interested in. So I like to narrow down on the Cloud Genius VPC and that is this one. And in there, you see that it is still not showing my gateway and that's a bug in Amazon. It doesn't show, but it exists. So what I would like to make sure that I actually check in the gateway section one more time by removing the filters and making sure that I click on this and ensure that I attach it to the VPC, maybe the attachment that should show. So it has to make sure that this VPC has to be attached. This gateway has to be attached to the Cloud Genius VPC and then it will show in the dropdown. It should actually... Yeah, this is logical. There's no bug. This is logical. This is no bug. You have to have the gateway associated with a VPC for it to show correctly in the filter and that's the reason why it doesn't show, which is reasonable and logical. No bug. With that, what I'm doing is taking my gateway and associating with Cloud Genius VPC and I say attach. So it is basically hooking it up. Now that I have a GW gateway ready for me, I can now filter to Cloud Genius and it should show and it does and it shows in the attached VPC as a gateway that I chose that name. So now my gateway is available. I need to now look at routing tables. That's how traffic shows. So in the routing table section, it is a little bit complex to understand. So pay careful attention and I will keep it simple. A routing table is basically a table that shows who can go from where to where. What traffic can go from where to where and so we will clarify that by... The first thing I will like to do is to ignore whatever they have created for us. So whatever they have given to us as a routing table, this one, I will like to say that I will ignore you, ignore this so that I don't get confused. So I'll just label it and ignore this. So we'll just leave it alone, not using it. I will begin creating our own route tables. Route tables, as you will see, as I will draw and create, are basically a way for us to communicate that public subnet is different from the private subnet in a specific way and that way is how it connects to the world outside. That method of connection, how the traffic is routed, is written down in a route table. So first thing, I ignored the one that gave you, the default entry that they gave us, ignore that. Next, create a route table. In here, what I'm going to do is I will give it a name, call it my public route table, and I will make sure that I am selecting the Cloud Genius VPC and create a route table. As simple as that, nothing complex about it. And then I have a public route table ready. Next, I will create another route table and I will call it my private route table and associate that with the Cloud Genius VPC. And remember that I'm creating another route table, just labeling it private and public at this moment. Create. So I created two route tables and ignored the first one. Now I have two route tables, public and private. As you can see the detail in here, explicitly associated with nothing. Is it the main routing table? No. And that's good. That's exactly how I want. I just want to do my own thing in the way I would like the traffic to be routed and I will conveniently ignore this one. So let us focus on the public route table first. So in this public route table, I will see the detail behind it. So I will go and adjust my screen a little bit and bring this detail up so you can see clearly as to what is going on and also reset the browser limit a little bit so you can see it better. Cloud route table. Come on, show it to me, please. Refresh the screen. And so I reset my browser size and I'm going to go look at the Cloud Genius VPC and look at the route tables, please, please come on. Show me. Refresh. Hello. It doesn't want to show me. So I will, it is showing me something, I guess. It is showing me something. Yeah, there it is. So yeah. So now I see them and I'm going to filter that again by Cloud Genius VPC and I see them all the three. I will keep ignoring that one and focus first on the public route table. And now is the complex part to understand. The understanding that I want you to have is that I would like to associate the public route table with the public subnet. So here we go. Subnet associations for the public route table, public route table, which is here. This route table I want to associate with the subnet that we have two of them, public and private. I want to make sure that I'm associating these subnets, the correct one with the correct routing tables, public route table. I want to associate with the public subnet. I will do that by clicking the subnet associations, edit, and then select the public right there. Click and then save. That's it. That's all it takes to associate. Now this association between public route table and public subnet has happened successfully. Let us do the other association also, which is this private subnet associate with the private route table. I would like to have that private route table associate with the subnet right there. I think this may be bothering more than it's not that useful apparently. So editing it again, and then this time for the private route table, I'm going to select the private subnet and save. That completes my one-to-one association between a route table and a subnet. So now I have a private route table associated with the private subnet and public route table associated with the public subnet. You see that there. Great. Next thing. On the public subnet, what we have done is that we have said for this public subnet, I have a public routing table, and for you, private subnet, this is a subnet. I have a private routing table for you, private routing table, and I made that association. Now I will go and define route. How does the traffic flow? That route definition also happens on the same screen, slightly different location. It is the route section here. Click. And this is probably the most complex part in this whole VPC exercise, is to understand routing. And so what I'm going to do now is to first read what we have there. If you look carefully in the routes section, you will see that it has a route already defined, and it says the routes, active routes, are to go anywhere you like as long as you are local, meaning you go anywhere you like as long as you are inside the VPC, inside the 10, 0, 0, 0, slash 16. As long as you're in the region, as long as you're in the VPC locally, you can go anywhere, any machine, connect to any machine like that. That's the scenario. The traffic will be routed. That's the route table saying, local routing to anywhere 10, 0, 0, 0, 16, local routing, active. Good. Machines on the public subnet can connect to the machines anywhere inside, including the private subnet. Great. The traffic will be routed. Firewalls is a separate topic. Whether the traffic will actually flow or not is a separate question and separate topic of discussion, but routing is clear. Traffic will actually route from public to private and private to public because of the route defined right there, which says, routes, local, active, 10, 0, 0, 0, 16, anybody in that area, you can go to any address as long as it is in that space, in that address space. That's the public route. Now, I want to expand the public subnet and the public route table a little bit and allow these poor guys to go to the public internet because by definition, I want this to become a public subnet. So I want to expand the routing and I will edit that and I will say, you know what? Add another route and you go anywhere on the internet you like using. So anywhere on the internet you like using, by the way, you have to put aside a block. You cannot type right in English and use the gateway. This is the gateway that we created, GW, GW is the name. So using that gateway, you go anywhere on the internet. That's what I would like to really say in plain English language. Now, the cider block notation for anywhere on the internet goes like this. It means anywhere on the internet. It means you can have a block like this. It means it gives you flexibility to go wherever you like, any whatever you like here, here, here, here. So it is whatever, whatever, whatever, whatever, whatever, whatever. That's the public internet that we know. Wherever you like, any address on the internet, that's the definition of public internet. And so anywhere you like can be defined with a very simple structure, like you remember the structure of slash 8, slash 16, slash 24, slash 32. And these are increasingly narrow. So this direction it is narrow. You saw me describe this here, no, here, somewhere here. Yeah. So it is increasingly narrow as you go from 8 to 16 to 24 to 32, it narrows down to 1. So on the other hand, if you go other direction, it actually becomes wider. So let's go here on this sheet of paper. So when you are going narrow, you have 32, the slash 32 will get you an address space of 1, the slash 24 will give you an address space of 256 addresses. The slash 16 will give you an address space of about 64k. The slash 8 will give you an address space of 256 times 64k and like that. If you go this direction, it becomes narrow and the address space gets limited. If you go the other direction and you keep reducing to say slash 7, slash 6 like that, the address space widens. So if you keep going like this from 32 and you can go all the way 31 like that, but I'm just for simplicity using these examples. So 16, 24 are interesting examples because they're easy to visualize. Other examples in the between are also possible, but they're difficult to visualize for those of us who are not super familiar with binary or octal representation of numbers. It is not intuitive. So we're just dealing with decimals. So these numbers help us into that and if you go this direction, as I say, it widens. So if you go 7, 6, 5, 4, 3, 2, it becomes really wide and the widest is 0, slash 0 and the widest is your entire address space, IPv4 address space. So anything slash 0 is the public internet. It means anywhere on the internet. So anywhere on the internet has a unique representation. That representation happens to be 0, 0, 0, 0, slash 0. And that basically means you can go anywhere on the internet you like as long as you use the gateway that we have chosen, this one. And then you say that makes your public route from the public subnet through the gateway that you have chosen, this one that you created here. This GW gateway was selected and associated with this public routing table and allow traffic to anywhere on the internet using this gateway. On the contrary, this private guys can go anywhere within the VPC, but you don't want them to go wander on the internet. So we are not expanding this route quite yet. We don't want to. We don't want to go do like this, add another route, 0, 0, 0, slash 0 and say GW. That defeats the purpose. That doesn't make it a private route in a private subnet. We don't want to do that at all. So we will cancel it. We'll say, no, you cannot go to the internet like that. That defeats the whole purpose. The whole purpose is to keep these guys, private guys, private subnet machines secure from the bad people outside and only allow the public machines to go through the gateway that we have defined and go to CNN or God knows wherever you want to go on the internet. But that's the idea is to allow only machines in the public subnet to go outside. Not these guys. These guys are stuck in the VPC, not allowed to go out unless you get a router. A router is a machine that sits on the public subnet, is connected to the gateway directly and these poor guys will connect through the router or other. That design is OK. That's what we want to build. But how do you get a router? You cannot go to Costco and buy a router or Amazon and buy a router. So you have to actually create a router for yourself. You can basically get one of these guys and put that in the cloud there, but you cannot do that like this. These are routers. So how do you do it? Anybody? Do you know anybody? Does anybody know how to actually do this? What I'm describing, put a router in there. What does it take? Do you know? Anybody? I'll set up your network address translator. Yes. Set up a box and convert it into a NAT. Exactly. You can do that. There is a simpler way, by the way. And the simpler way is to go to Amazon Marketplace, EC2. And in the marketplace, somewhere here, launch an instance and say AWS Marketplace and just search for a ready-made NAT. How about that? Amazon. I'll just say NAT 2016. Let's see what comes up. OK. No, no. I don't want these guys. I want AWS NAT. No. So how about Amazon? No. I'm not getting the NAT I want. So I'm going to quickly search. So yes, these machines, Amazon provides you NAT instances. And they are, where are the NAT instances? NAT AMI. Let me get the quick place to find that, Amazon Linux AMI, there it is. So this should give me the answer. OK. So this is a ready-made NAT. I think we have to get the correct ID number for it. But this one is a good search string. So let's go search for it in the listing. And we are not getting the right one popped up for some reason. So let's go narrow it down to Amazon Linux and now search for NAT. Yeah. That will do it. No product found. Clear again. And clear filter. I want to get Amazon Linux, AWS Marketplace, they stopped selling or what? They used to sell an Amazon NAT. My AMI is a Community Marketplace AMI, Amazon NAT. Give me a second, I'll go quickly, a different way to search for it. There is a ready-made AMI that should be available to use it. They're hiding these things. The reason they're hiding is that they want to sell you a different service these days. They have come up with a new thing, which is a NAT gateway service. That's what they want to sell. So they're hiding the ready-made solutions they used to have before. It's actually in the side menu under NAT gateways under. Yeah, exactly. This is a paid service. This is a ready-made service they want to sell you. And so the other solution is cheaper, so they're hiding it. Yeah. I know this gateway is a paid option available. We will use this also, but it is a simpler way to accomplish that idea. And that idea is to basically construct. Let me see if I have my notes ready for that to hold on. So we'll go to the notes section and see if I have my internal notes for me, where I may have it ready for you here. So this blog post will help us create a NAT for ourselves, how to add NAT instances to a... So these lines of code will do it for us. So let's just go through that, that should do it. So we will follow this instruction set. I'm going to paste it for you. I have tested it before. So here is a link, and we'll follow that. And the idea here essentially is to get a plain vanilla Ubuntu machine. So launch an instance, launch Ubuntu machine, and just a T2 micro free or a cheap one is good. Configure the details. And in here, just be careful to select the correct VPC, Cloud Genius VPC. And here to be careful and select the public subnet. And also remember to carefully select to enable a public IP address. This is going to be our NAT machine, our router. So we'll create a machine and make it a router using the link I gave you. And that number of instances we want is one. We would like to create it in the Cloud Genius VPC as you see here. We would like to make sure that it is on the public subnet 10.0.0.0 slash 24. We would like to get a public IP address. By default, it will not give you public IP. By default, it is going to disable. And that's a good thing. But for this NAT device, you want to get one, so you get enable public IP. And then rest of the things are fairly simple. You can just tag this instance as your NAT device and proceed to define a security group. Now, the security group discussion is important for us to understand. And that security group basically allows me to transport my traffic. So I will call it my NAT security group and leave it as is right now with a 22 port number open for TCP traffic for SSS to go on. We'll modify this security group later. But right now, just make sure that you have the security group in place. And we'll review and launch. When I review and launch, you will see that this machine needs a key, a key pair that I have or that I do not have. Maybe I have this key pair I can use. So I acknowledge I have that key pair already loaded. I'll just use that one, the Nilesh key pair. If you have a key pair not loaded, you should go on a separate browser tab and load up your key pair there. Your public key should be given to Amazon. And then you should drop it down to select your public key like ID RSA. You should do that on a separate tab like this. Go to Amazon in the region. Every region needs a key given to them separately. So if you're dealing with Oregon, you should give the key pair in EC2 section in Oregon like this on a side browser and a side browser. And import your key pair like this, ID and RSA, and paste your public key here. And that's how you proceed. In this, once you save it, it becomes available in this window and the drop down should show you. I have my key already there called Nilesh, so I will use that key instead. And I will select the Nilesh key instead of this key. And then I launch the instance. Once I launch the instance, I will get a machine on my public subnet, which is going to be like this. So here, what I just did is I launched a machine. And in my VPC, I have two subnets, private, public, and this connects to a gateway. So I have my machine running right here. This is an Ubuntu box, and I'm going to magically convert that into a NAT box and then use it for my other boxes and route the traffic through that box. I will show you how to do that, but first, make a NAT out of it. So we'll do that using this link. How to add NAT to an existing box. So you have a box there. And so the first thing you want to do is make sure that you connect to it. So here is a box, and that box is in, it's called your NAT device. It happens to be a public IP address. It is in US West 2B in Oregon region. It is also in your VPC, which is the Cloud Genius VPC that you know. And so now I should be able to connect to this machine directly by running it in the terminal and say SSH, allow me to connect to that machine, please. And it should go. It should say, yes, you're in. So I get in, and it should let me in. It is still booting up. Probably. Yeah, I'm in now. So I got connected, and this is the NAT machine right now. So if you see this machine, it's a pin vanilla Ubuntu box. I have my IF configuration showing with this IP address is the 10.0.0.0.1.10.0.0.159. You map this address space, 10.0.0.1.59, this is the internal address that I got. You recall this public subnet was constructed out of a rule of slash 24. And this was constructed out of a rule 10.0.10.0 slash 24. And this whole VPC was constructed out of 10.0.0.0 slash 16. And so the 24 basically indicates you can change this. This is what was changed in this box, was assigned 10.0.0.1.59. That's the assignment we got for the NAT box. This is the internal address. It also has a public address. The public address we have is right there, 54.70.196.194. So that 54.70.196.194. That's the public IP address for the box that we intend to use as a NAT. And this is the connection we have on the public side. Internal side, we have this IP address. And now we need to do a couple of things. First thing first is any traffic that is destined to this box will be allowed only to go to this box because of a check, a method of checking that Amazon puts in place across every machine that they run in their cloud. And that method is known as source destination check. Source destination check. And that is by default enforced. And if you can see this screen carefully and scroll down to this section, you will find that source destination check is true. And so source destination check basically does this thing, whether the source of the traffic and the destination of the traffic are matching or not. If it is matching, it will be allowed, if it is not matching, it will be dropped silently. That's the idea behind source destination check, indicates whether the source destination checks are performed or not, whether the instance must be the source or destination of any traffic it sends or receives. Read that carefully again, that line here, where the instance must be the source or the destination of any traffic it sends or receives. What does that mean? It means, if you know a NAT, it basically is masquerading. It pretends to be the iPad, it pretends to be whatever that Mac or PC or whatever machine you have, server you have. And when the server or machine wants to visit cnn.com, it says, yeah, I am the iPad. And so you go. And the traffic is basically masquerading. And so if you read the definition again here, this definition, source destination check, whether the instance must be the source and destination of any traffic it sends or receives. So in this example, the NAT device will send the traffic to CNN. But the destination of the traffic, when it comes back, will be the iPad. So this is what masquerading is. And it is basically violating the source destination check rule. You are not really sending this destined traffic. It did not originate for this destination, but instead is being sent to this destination. So the source and destinations are not really matching. And that scenario, your NAT will not function as a NAT if source destination check is true. So you want to make it false. Only for this box, just for this box, you want to make it false. And we will do that by right clicking and saying networking and say source destination check. Change it, please. And say, yeah, disable, disable the source destination check. Because I know I want to make this a NAT device and I want to disable that. That is a critical step. Now you can see that the source destination check has been disabled for this unit. And that means that I don't have to, basically, that means I can use this box as a NAT to begin with. At least the network layer properties from the infrastructure side are clear for it to be functioning like a NAT. The other thing we need to do is to make sure that we allow traffic from allowing inbound rules, allowing all from this and associate with your NAT. So we have to create a security group that says inbound rules allow all traffic from this subnet and associate with the NAT instance. So we have a NAT instance right there. We have a security group for it called the NAT security group, which is this group. And in there, we have to go and modify the inbound route to edit and say allow add rule all traffic as long as it comes from this CIDR block. As long as it comes from this within the address space, allow it, please. So allow the traffic as long as it is originating from this location and say. So it will basically allow machines inside the VPC which are represented by this 10.0.0.16 and allow that to go connect to the NAT itself. Otherwise NAT machine, these guys will not be able to connect to the NAT itself. And that's a problem we just fixed. By expanding the permission for the source to be these guys, you can connect to the NAT. Yes, please. That's what we just did. 10.0.0.16. Yes, you can connect to the NAT security group. That's what we just opened right there. Next, what we want to be able to do is on that machine itself, on the NAT instance, on that box, we have to create a file by that name with this content. So we will go to that machine right there. In there, we'll create a file by this name and edit that file and put this content, yeah, this content right there. That's what I want to put in that file in this file name, etc network if pre up dot d NAT setup, that's the name and we're going to edit that file like this and insert and paste this content and then save the file. Now we can cap that file. We can see its content, etc network if pre up d NAT setup and you will see that it contains whatever I just saved. So we created that file, basically this file represents a characteristic that you should see. The characteristic is that we are basically echoing one. We are echoing the number one and saving it in a file called IP forward. Basically it allows for IP traffic to be forwarded. One means true or yes, please do allow IP forwarding. That's the purpose of a NAT device to allow traffic to be forwarded. And the second thing we are doing is to allow an IP tables rule for this machine to perform like a NAT with post routing forwarded to this address space 10 000 16 and asking it to masquerade the traffic. That's the rule that we are putting in IP tables on the box itself, the Ubuntu box we just created. We are going to change the permissions of that script to plus execute, meaning it can execute itself. So we are going to do that change sudo chmod plus x and then the file name right there and modify its permissions. And then we want to run it. So we'll run it like this. Basically just paste it and run it. So it ran. It said permission denied because we had to go sudo. So sudo and then run it. So it runs and now we have successfully constructed our NAT by the way. And so here this script will automatically be run when the machine reboots so that the NAT will survive a restart. And at this moment, all your private subnets have a default route. So we'll do that part now. So I'll explain this to you before I just read it off. So now we want to understand that this machine that we have right there, this running instance, we have source destination check disabled. We also went in the box and modified and ran this script that you saw. Basically this script we ran, which allows for IP masquerading to happen and we are allowing traffic to flow and this becomes our NAT by definition. When I reboot this machine, it should survive that script basically. So when I say sudo reboot, you should have that NAT box reboot itself and I got disconnected. But I will connect in just a minute. The machine will come back online, it is rebooting right now and it will survive the NAT function as you know. Now having done this part, we'll go back to our design here. In our design, what we had was this and this two public and private subnets and we had a routing table defined for public routing table. We said you guys can connect to the gateway outside and all that good stuff, but we had no answer for these guys. The private routing table is still kind of limited to 10, 0, 0, 0, slash 16. It doesn't allow traffic on 0, 0, 0, 0, slash 0 yet because we haven't given it a route. This part is still missing. We have to go fill that gap so that machines that we create here will get routed through this Ubuntu box we have that we call our NAT box, the router box that we just put there. So the router should be rebooted by now. I'm going to connect to it and I connected and now this is what I will use for my traffic to the internet to get routed like this for these guys. And I will do that scenario very simply like this, go back to Oregon region and to the top orange box, go to the bottom VPC and select my cloud genius VPC like this. Now I will go to the route tables and this is also the tricky part that you need to understand. I'm looking at the private routing table. I have my association correct with the private subnet. I will now look at the routes. My routes are limited to only within the VPC 10, 0, 0, 0, 16 and that is active. However, I need to expand my route and say add another route and I want it to go to anywhere on the internet but I don't want to select the gateway instead. Now I have a new choice called the NAT choice and I will select that choice NAT as my route to the way on the internet. So this NAT selection, not the gateway but the NAT selection. This is what I want to select and let it be my door to the internet to the world outside. That's the routing table for private. So I'm going to save it and you saw that I just completed a route through my NAT device through this box which basically I said in this layout. What I'm saying is, you internal machines, you can go to the internet now, no problem. You just go through this box because I have defined a private routing table for you and that private routing table says you go through the NAT box, don't go to the gateway directly. You can, if I allow the private routing table allows, you can but you don't want to. So what's the advantage of using your own NAT besides you have full control rather than go through the gateway? Yeah, the idea behind using a NAT device and not directly connecting to the gateway is security. And I'll show you how. If you have a box and it connects to the gateway, it means that people on the internet, especially bad guys, can do an attack on you directly. You don't want the attack. So you are using a NAT box in between and any traffic that comes from the outside is conveniently dropped by the NAT, unless, unless the traffic is originated at the request of a machine inside on the private subnet and this is the public subnet. So unless the traffic is originated on behalf of a machine inside, so this is machine number one and this is machine number two and they're not directly connected to the gateway. So the bad guys cannot even see them, they're hidden, they are behind the NAT and only when M1 says, I want to go to the internet, please allow, please masquerade. So then NAT will say, yeah, you can, I will let you, you know, go to the internet. Basically, I will pretend to be you and then go to CNN and bring down the content and pass it on to you. You don't go there directly, you go through and I'm protecting you because these bad guys who are originating traffic as in the attack will be dropped. The traffic, the packets will be conveniently dropped and you don't even see any impact. The traffic that you want to originate from inside will properly get routed through the NAT outside and back to you because you started it. So you will get the result back. This guy wants to go to say the New York Times, this guy can go to the Nat. So that's the scenario. It's very similar to your home router. That's actually very similar. Does that answer your question, Dennis? Yeah. So basically it's a one way, well, not really one way. It's originated only from the inside to establish a bridge of communication until that transaction is over, right? Yes. So the origin, the beginning of the discussion has to happen from our machines inside. And in that case, the Nat will pretend to be M1, talk to the world outside, get the results back to M1 and all that good stuff because our source destination check has been disabled on this box. So source destination check is false, meaning the traffic that originates from here, actually from here, goes to CNN and comes back is destined to this box is allowed because we have disabled the check for source destination. So Nilesh Mukesh here, one more question. So when the content is coming back, it doesn't stop you from bringing a bad content though, right? Yeah, correct. Correct. It does not. And so if you go to a malicious site and you download some bad thing, you will receive it. No doubt about it. You will. Yes. It just stops from anyone else to get to your machine without you going to get content from anyone else. Yes, indeed. Correct. You're absolutely right. If you want to go and grab bad things, it will allow you to do that because you are trusted. You are inside. By definition, M1 is your machine. You know, you go to the site, you don't know whether it's a bad or not. But you know, like, this is not complete security, there is, there is, you know, there are lots of things that you need to do. This is just one method, one portion of a method to address the problem of bad guys attacking that you will have in every scenario where there is a private network, forms and offices and VPCs. Same thing. This is just a part of the solution. By the way, the machines will typically not go to CNN, they will not go to New York Times. They will probably be doing something that you want to do, the machines to do, like doing some services for your customers. So that's a dominant usage scenarios. The machines are not really browsers. They are, they are code running here that you run the code on your applications will run here and they will access services on the internet based on what the application is doing. There is no dude sitting here to browse on bad sites. There is no person there, right? This is this machine running your application. Whatever you run is whatever your application is, and that should be allowed. By definition, it should be allowed to do whatever it does at the app. Right? There is no person there. And so the machine is running your apps. And those apps may be accessing whatever they want. And that's the responsibility of the app developer to not go to bad sites. Hi, Neelish, David here real quick. Yes. Would you use this topology to manage your session states coming in? Session states as an example, please. So for example, you need to have your internet customer come in and hit the same box on your private network. I see. I see. And persist that connection until this transaction is completed. I see. So that is a different thing needed. That thing is called a load balancer. That's where HLB would come in. Sorry. Sorry, go ahead. That's where what will come in? My mute's not working right. HLB, hardware load balancer. HLB, yes, correct. Hardware load balancing, software load balancing, and there are cloud-based load balancers available. And there are open source products available called, what's it called? NGINX. You can use NGINX as a proxy. You can use F5 networks, F5 networks as a proxy. There is a very well solid load balancer, open source. And that thing is called HAProxy. And this may look like a silly-looking site, but trust me, this is a very high-end product, open source, and beautiful, robust, very high performance, and very low weight, very lightweight. Beautiful performance. And I think this F5 network solution is based on this HAProxy application. And major, major sites use this application to run their load balancing. And it basically sits right here on the public subnet. On the public subnet, it sits like a machine that will balance load amount and also manage session state with cookies and everything, like you said. It will do that, HAProxy. I think it is the best solution out there in the open source that many companies use already in production. This service that Amazon has also provides you a load balancer solution. Somewhere here, you will find it. Where is that? In EC2 section, there is a concept of load balancer, and that is basically a collection of machines that sits on the public subclassic side. You have this load balancer sitting and then diverting traffic to your machines inside. That's the scenario that I want to draw, which is basically on the public side. You have a NAT, you have a jump box, you have a load balancer, and this load balancer is going to manage and distribute traffic among M1, M2, M3, like that you have in your public in your private subnet. And this public subnet is where your NAT is, your jump box is, your load balancer is, and these guys directly connect to the gateway. Whereas these machines, if they want to go outside, they will go through the NAT. The load balancer may connect to them directly for application, and they will respond back to the load balancer with a session state in mind, and you will see that happening in an example we'll be doing shortly. So in this layout that we just have created in EC2, if you go to the Oregon region and identify the VPC that we just have created, which is this one, the Cloud Genius VPC, you have the route tables that you should point out, the private route table. This one is going through the NAT device. Now, a crazy thing that you will find is that if I go here and delete my NAT instance like this, I'll say, you know what, NAT, I want to kill you, which is terminate and go. I deleted my NAT. Oops, what just happened? What just happened is that I killed my NAT, which means this guy is dead. Which means my route, the private route, the routing table route is broken. Now what do I do? And how does it look like? Let's go see. So we'll go see in the VPC and go look at the private route table, private. This is the private route table associated with the private subnet and the routes show active. The machine is still active, it seems. However, let's go check again. Is the machine dead? I think it should be dead by now. And yes, the machine terminated. So now we'll go look at that route table again, VPC and the Cloud Genius VPC, which is this one and go look at the route table, the private route, subnet is the private one and the route is showing a black hole. You see the black hole there? This black hole indicates that there is no route to the internet. This black hole is what you're looking at right now because the machine I killed, meaning these machines cannot do anything on the internet on themselves. They can continue to perform whatever they're doing, they'll continue to answer the load balancer request. But if you want to go run an app to get update on the machine, go to Ubuntu server update, Windows server update, no. Because the route to the internet is broken, it's a black hole. And that you have to understand. So this is the reason why you typically put multiple NATs on multiple different public subnets, which is the level of complexity we will go to in terms of making sure that we understand higher availability scenarios of things going wrong. Like I just killed a machine, it can be killed manually or it can be automatically die for some reason. Things will go bad. So you have to plan for it and understand how do you create higher availability scenarios in real life. And so that is what we'll be doing next time. Before that, what I would like you to do is to understand and actually review the whole thing here, which is I'm going to point it out to you. The thing I want you to read and review before next time we meet is on Saturday when we meet, I would like you to read this portion, click the technology segment all the way down to where is that, yeah, 11. So module 11. This segment, I would like you to complete and review that thoroughly a couple of times. And so the link is right here. Make sure you review that. And also make sure that you do a homework. So I'm going to assign the homework right now. Homework is very simple. It is basically creating your own VPC like I just did and making sure that you are putting a NAT box in there using this method I just showed you. You have a link to this also. Just make sure that you follow this and I want you to test and I would like you to come up with ideas of how will you actually test whether the NAT works. And so some of the things that I'm leaving it open-ended, I'm going to write that down in terms of homework right here. So you will, sorry, the color is wrong. So homework. Homework is not that difficult, but it's a question of thoroughly doing it. So the homework essentially is on your cloud, you create a new VPC, you create a private subnet, you create a public subnet, very simple. You create a VPC around it. I mean, we begin with the VPC and then you create these private and public subnets. You want to address the appropriate address space there. You want to put in a gateway. You want to create a route table for the public guys and a route table for the private guys. And you want to associate the subnet mapping. You want to also create a route to the internet, 0000 slash 0, through the gateway on this route table. So with these machines that get created here, eventually you will at least have one. So you will have a NAT box sitting right there and that box will belong to the public subnet. It will receive a direct connection through this routing table to the public internet outside and that will receive public traffic. It has a public IP. It also has a private IP, internal IP that you will receive from this subnet. So it will be like 10, 0, 0, 0, slash 24. This will be 10, 0, 10, 0, slash 24. The VPC itself will be 10, 0, 0, 0, slash 16. And this NAT box, I would like you to test. And the key thing to remember to test is to connect to this box. You will create this new box here and make sure that the traffic on this box should be able to go like this, go like this to anywhere on the internet through this route table, the private route table. And you want to test this by running another Ubuntu box here. And you want to run app get update. And when you run that update, app get update, it will go to the internet, try to go to ubuntu.com and download updates for the box. That's how you can test. So I want you to succeed in running a successful app get update by constructing this layout. So you want to also have a jump box so that you can actually reach here, otherwise you will not be able to reach. So this jump box will allow you to connect to this box, and this is going to be your NAT box. This is going to be a jump box, and this is going to be your worker server or application server or whatever you call it. The machines inside, that's where the workhorses are, the workhorses. These guys work. These guys are just jumping. These guys are providing you NAT traffic, so NAT routing. And so that's the layout you should create and test it and tell me that you succeeded in running sudo apt-get update on a box that is internal to the private area. That's the conclusive test. And I will tell you some gotchas, gotchas, the typical gotchas in doing this actually for real are security groups. You want to be very careful in understanding the rules structure. The rules are you want to allow traffic that originates from the private subnet. You want that to go to the NAT security group, you allow that. You want to allow any traffic within the entire VPC, any to any traffic should allow. In this subnet, you want to restrict anything else coming from outside. Absolutely no traffic going to the NAT at all unless it is you who wants to connect through SSH to the NAT or unless it is you and you want to connect through SSH to the jump box. So you will get a public IP here. You will get a public IP here also. And you want to go through this routing and go to this box through a jump file, which is like a contact file I showed you the last time. You want to do these steps and for some of you, you may not have enough time to finish this off by Saturday and that is okay because I will do these things in much more clarity one more time before and it will be second time to be very fast, very quick, very fast. It will probably not take this long, but I want you to really comprehend the entire layout of how you would like to put components and components of networking, components of security, components of network address translation, jump boxes, putting boxes inside on the private areas, route tables, public gateways, routing through NAT and disabling routing for private components and disconnecting them and preventing them from directly connecting to the gateway outside and the security aspects around security groups, how to construct those things, what should be allowed, what should not be allowed. Those things need a ton of clarity and that is my focus in the next time when I will meet with you guys again on Saturday. In the meanwhile, please experiment on your own and Slack chat is welcome anytime. I want you to do these things so that you really understand. I want you to do this so that you can actually put this to use in real life, not for a test, not for an exam because we don't have any. I want you to really understand and do this so that you really comprehend. Once you do that one time with just single one private one public subnet, we will then expand this discussion to the next logical level of having multiple public and multiple private subnets. And not only that, we'll even further expand this to include multiple data subnets or multiple other scenario subnets, not just three, but any number that you like and put all of that in a nicely structured layout, multi-tiered architecture for our own applications including a full-fledged load balancer that allows customers to visit, allows us to operate these NAT devices. We'll also use the other NAT gateway structure that we have from Amazon and other clouds. All these clouds provide you similar concepts, very, very similar concepts. They have similar different names for the same thing. Basically the same thing. At the end of the day, it's all machines and you want to configure your cabling, your networking in a fashion that works for your application. And you are practically running what I described like this in this scenario, I keep talking about these things. You're basically creating a blueprint for your applications to run on these boxes and be protected from the internet, from the public outside using some kind of a load balancer. A good picture for that is missing. I think this sheet is missing. Some elements are missing here, but yeah, put in a load balancer in front and have these people, the customers visit your application and the application will run here. It will connect to the databases at the back. We have external services for storage. We have other types of services constructed. We will talk about building out larger concepts in terms of putting appropriate elements that will help our application to service our customers better in the context of some cloud. And that is what we really want to go to. To enable those scenarios, we want to really, really understand what these things mean. Without that, we don't really get a comprehensive picture of what the heck is going on under the hood. And if you just go like this and click this button and click this wizard and you get a VPC here, we go and click and click and select, it will create a VPC for you without you understanding what the heck just happened. And that is not what I want. I want you to really, really get to the underlying things to get exactly what you want because these guys will give you some predefined recipe and that's what they will make you follow. But that is their way of doing things. I want you to have your way of doing things as to how you want. And then we will automate all these things by the way, there is a lesson subsequently at some point to automate this entire thing in one command, boom, the whole thing constructs depending on code you will use and you will modify it. I will have, you don't have to write the code is written. You will modify it to suit what you want, exactly what you want. That part is somewhere here and in one of the lessons, somewhere there is maybe in here. Let me see where it is and I'll identify where exactly it is. I think yeah, multi-deploy entire architecture. So there are lessons seen here in the subsequent steps that we'll go through that is basically going to do the whole thing through automation that you will see in this deploy entire architecture or blah, blah, blah. So we will go to that at that time, but that level of automation will be possible only if you do the thing by hand, like really, really understand it. Without that automation is going to be another form of a wizard that, you know, this case Amazon gives you and the automation I will give you that defeats the purpose. So we are not using automation blindly, but instead really understanding what's going on and then modifying to suit your individual taste, your individual customer requirement and then run automation, not blindly run automation. That doesn't make sense. So with that understood, let's revisit, we meet again on Saturday at the timing is wrong on my calendar. So forget the calendar part, but yes, Saturday at eight o'clock in the morning, remember it is not in the evening, it is Saturday and that will be 8 a.m. Saturday. And the date is 24. So that's the date that I will see you again on this chat, this video conference at September 24, 8 a.m. Pacific. And any questions for today? I guess it was probably a little bit too much on the VPC parts, especially these routing tables can be a little bit confusing, but clarify that, please, please clarify, make sure that you really, really get it because without that, you know, there is, there is no easy way out here. You have to really get it. And that's what I'm asking. If you have any questions, please bring them on now, later in Slack chat, whatever works for you guys that works for me. Any quick comments before we drop the call? Once we start working on the assignment, we'll definitely have more questions. But yeah, today's session is kind of a little bit overwhelming, a little bit what overwhelming. But I guess when we work on the assignment, we will have, if we do hands on, we'll have better understanding. I am with you, it can be, VPC can be overwhelming. If you don't know all the nuts and bolts and pieces, it is really hard to comprehend. That is why I tried to really simplify, go to the bare minimum thing needed to make it work. And I just gave you a flavor of it. It can become really complex. And that's not what I attempted to do to begin with. I actually bare bones, did only two subnets and put one box. That's pretty much it. I gave you a flavor of what it takes to build out, unless you have that level of understanding, you will never comprehend larger scale of architectural diagrams or implementations. So yes, I am sorry for inflicting this on you. And it is, yes, overwhelming, I agree and admit. But I think there is no simpler way to describe it. It was, I could understand it, but it is maybe because it is for the first time we are getting into such detail. And I totally understand that I am with you. That is why I have this, you know, this video series that I have created just for that purpose, because it throws people out, like throws people off left and right. I mean, let me point it out to you again, one more time sharing the screen. Yeah. I'll give you a link. So I'm not sharing my screen, but I'm going to give you a link where I want you to visit this link on Slack chats, visit that please. And I will share my screen also. The idea is, is this screen that you're looking at, not this screen, this screen that you're looking at is a series of one minute, two minute long videos, 11 of them. I think 10 or 11 of them, really short, it will practically take you 15 minutes to go through the entire VPC discussion we had at the three hour long session today. And if you squeeze down in 15 minutes in this series of videos, so that is module number 11. One, two, three, up to 16, that's what you have, it is condensed for you to consume. And you will, you should follow this, like literally follow along module number 11, step by step should take you half an hour max to go through the whole thing. The videos themselves are very short and intense, like two minute, three minute short, but you can rewind and repeat any time, but that will give you a refresher on what we did today. And that is a necessary, essential condition for future understanding. This is going to get complex pretty soon. I'm just cautioning you, pay attention, make sure you do this module 11 really carefully and you should be okay. I'm comfortable that you should be okay, it's just first time it is scary, that's it, there's nothing more to it. It's not that scary once you get it, once you get it, it's easy. Thanks Nilesh. You're welcome, sir. So a couple of guys who did not get the videos going, synchronizing, I would like you to update the GetSync software, please help you in synchronize the files that we will send to recording, recording videos that will flow to you automatically, please update GetSync, that should resolve the problem. I don't know if you remember in the beginning of the boot camp, you mentioned that the Resilio might be blocked by the Carpet Fiber, probably that's what was, that's what was happened. When I got home, it started to sync and I caught the video. Okay, okay, so yeah, corporate does block, yes, companies block it all the time because they think it is piracy, but it is not, because my video, I'm going to give it to you, so it's not piracy, but BitTorrent protocol is considered piracy for some people. So, but this is my video, I'm giving it to you, what's the problem, we are not taking from other people, we are not stealing, this is my property, I'm just sharing it with you. So this is not theft, this is not illegal, this is totally illegal and I'm doing it for a business and I do it openly. So BitTorrent protocol itself is not illegal, it is stealing, theft, copyright violation, that is illegal, but I'm letting you copy. So what's the problem? I am the owner, I created, so no problem, use it in your home, it should be okay. And I have it recorded, so I'm saying you that I'm giving it to you, so you are also not stealing, what's the point? So go ahead, go take it to your home, take it to your home, it can synchronize just fine, no problem. It is corporates that prevent B2B protocol because they are scared and I don't care, let them do what they want, but you can get the videos. Otherwise, you have this other method that I gave you, YouTube links, which should also work for you. I just posted a bunch of links early on in the Gagan listing. So the four links that are there, I will post a fifth link also and we'll nicely summarize it on the website at some point, but for right now you have access to it. Cool. So if you want to drop off, you're welcome to, if you have a question or if you need help on specific things, please tell me, I'm here now, later, anything is welcome. You're going to release the video today, right? I will, as soon as I stop recording, it will create an MP4 file and gets dropped in the folder, the folder will synchronize to you and you will receive it simultaneously. I will upload it on YouTube in a private area and give you a link in Slack chat. Okay. Thanks. Awesome. Thanks. So I'll stop recording right now.