Hey everybody, we are recording this session. And today we'll be discussing virtual private clouds. What they are, what do they mean, how does it, why do we care, things of that nature. And then go into detail about what exactly this is and create our own virtual private cloud. Now let's revisit our definition briefly, we have not too much time, just quickly. In our definition, we discussed public cloud, private cloud, community cloud, hybrid cloud. We discussed software as a service, infrastructure as a service, and platform as a service. We haven't even touched platform yet. We are studying infrastructure, we briefly discussed software as a service. We are doing this right now and we'll get to this also, not there yet. Now in here, there are three components like compute, storage, and network components. We discussed these three, we used some of these. Now we are going to here into greater depth. That's the overall picture that we are actually going through. Now when it comes to networking, which is this idea, we need to understand basics, you know, black and white, nuts and boards, cable connections, and you know, all these properties that you will see when you connect to here, for example, so that thing, you'll see, I have a bunch of things here. Let's see what we have, let's see if I can look at each of these things. These are network cards, by the way. You see that? Some network card called Thunderbolt, Ethernet slot, something like that. We have a Wi-Fi connected, I can disable it, enable it, I have Bluetooth connection, like that. So this is the list of, and I have more Thunderbolt cards, and Ethernet cards, and a bunch of things. So that's the adapter that allows you to connect an Ethernet cable, and Ethernet cable looks like a picture. I'm pretty sure you know this, but I'm just bringing up the idea so that we are very clear about what we are talking about, a network connection. So here is what you may have in your home, something like that. This thing is called, and my audio is far away from me, so let me grab my microphone, I forgot about that. Let me grab my microphone and put it right next to me, so that my audio quality improves. It should have improved by now already, so if that is not the case, tell me, and I'll fix it. But I think my audio should be definitely better. Having said, this is a router, a classic home use scenario. You have it in your homes most likely, very, very likely you have something like that. And if you look carefully here, there are some details to observe. One of them, so yeah, this is power and on off switch and USB, we are not talking about these things. The operative ones. This is where the internet comes in to, say this is like internet coming in, it gets inside. That's when you go put the wire from your cable company. So the cable company will give, or DSL company, or some other optical company, whatever company you have, some internet service provider. They will give you internet connection. That's where you hook it up here. The cable you use is called a Cat5 cable, Cat6 cable. Basically call it ethernet cable. That's where internet comes in. That is a public location, meaning it has a public IP address because it is provided to you by an internet service provider. That point is on the public internet, meaning hackers can come in here all the way up to here. Good people can come in here and you may want to permit them inside. Inside your home, these are the things that you connect to. Maybe you connect your laptop, maybe you connect your desktop or your TV or God knows what you have. And here is your phone connected and here is your Xbox connected to the Wi-Fi antenna and like that. These Wi-Fi connectors can actually accommodate multiple devices because they are wireless. They don't need a port like that, but they are equivalent. So this wireless connection, also known as Wi-Fi connection, is conceptually similar to this connection here, internal to your home. That is where you and your family connect. You are inside, which is private, which is opposite of this public. And so that's what I'm talking about. This is private. The blue colored items here, private. The yellow item, public. So that's the key distinction I want to make. This is where internet comes in from outside service provider perspective, but traffic can go both ways. Come in, go out, things like that. So we'll understand traffic, what flows. We understand what this idea is, public IP, what this idea is, private IP, and things of that nature. And then we go deeper into taking all this away from our home and actually go to a cloud and see the same thing. By the way, what you're looking in your home is conceptually the same idea, very, very similarly in a virtual private cloud. It is just away from you in the cloud. It is also secure, just like your home is. And there are a lot more things in the cloud example. It's a corporate professional deployment. And so we'll see those things as we go along. But I'll begin with very simple understanding of basics like this. If this discussion is too trivially simple for you, please ask me to speed up because I will speed up if you ask me. Otherwise, I'll keep on giving you the information that may be useful to you because it actually builds up in greater depth as we go along. This was trivially simple to understand because you already have it. So I'll not spend too much time on this, but let's go understand the next idea. And this is all, again, pertaining to networking ideas in the context of compute storage and network as we build infrastructure solutions to create what is known as cloud computing. That's what we are really talking about. So we are now going to a little bit of understanding between and differences between what is known as a public area and a private area on the internet address. So now if you look at a typical internet address and I'll pull up some address for me. So here what I'll do is open a terminal. This is not strictly not necessary, but I just like terminals, so I use it. And in the terminal, I will make it big. And what I will do is actually see if I can run a command to get the IP address of my home, not for this machine, my home. And let's see if it gives us and yeah, I got that. So that's the IP address. So you can see that that is the IP address assigned to my home. So that's something that I was able to grab from an API call to a service that I just did. There's another way to find this information for your current location. What you're looking at is to find out what is your public IP. That's what you want to find out. You can do that without using the browser or without using the command line by going to questioning Google. What is my IP? They just tell you what your IP is right there. So if you just ask Google, what's your IP, that's the answer. You can also go to whatismyip.com to get the same answer. And there you find that my IP address is right there. So it's basically the same answer that you are able to obtain from a variety of sources. Go to the website, ask Google, ask command line, API call, whatever you like. Multiple ways of getting the same answer. What I obtained was that number. So we'll carefully look at that number itself. Let's grab it, put it in a editor. And here I will paste it and dissect it. And so what I'm looking at here is that there are these dots that you're familiar with already. And here, there are three dots that partition this address into four parts. Now you may have seen addresses like this, and you probably very likely have seen address like this, which I think I mentioned. This is your router address. And so the problem that you might think of is if this is the outer address for your home, what about the router address for your friend's home and my home and everybody else's home? How come everybody has the same address? Do you know the answer to this question? Why routers have this address? Many routers actually have the same address. So how come your friend and me and you and everybody has the same address? How is that possible? What's going on here? How do you know the answer? Anybody? Nobody? Submitted. I did not hear you. I think you said something, but I did not hear. So if you know the answer. Submitting. This idea is specifically called private IP address. It has an RFC, I may be wrong with the number, I'll correct the number, but the RFC stands for private IP address. And this is private, meaning it is only within your home, only within your private area. It doesn't have to be home. It can be within your company, within your laboratory, within your cloud, within your virtual environment, within your virtual box setup, you can have all these things in a private location. Now, what is private? You get to define it. This area is private. That area is not. And that is some RFC that we will have to look. An RFC is a request for comment. It's a specification. So now let's go see the spec. So I'm going to look at that RFC, 1914, I think, 1918, I think, one of these. There is your RFC. And so you can read the spec, but it's very boring to read. So I will not ask you to read simply because it's actually boring. It's long and it's not easy to read. And so it is public document. It is the current best practice. This is network working group, request for comments, number 1918, known as RFC 1918. This is published by IETF, which is a standard body on the internet. So you can get it from here, and this is, of course, boring. So what I'll suggest is not look at it. I mean, you can go and read. I'm not preventing you, but I'm suggesting that you just listen to what I'm going to say, which is a simpler version of the same idea. So I'll go to Wikipedia, and there is also a slightly better version of the same document written down here for us to actually discuss right now. So I go to Wikipedia and find out what is a private network. A private network is essentially a network that network means, network means machines connected. That's what basically a network means. So you have machines here and here and here, and you connect them. And here, machine number three, here is machine number 47. And so you have these machines and you decide that, you know, I need to carve out this area as my private. Well, that's your private network. Now, you don't connect any of the cable from your connectors, like any of these wires, no Wi-Fi connection, no Thunderbolt connection to the world outside, automatically this area becomes private. That's the way you think about a private network. But then we need to have addresses assigned to each of these guys. I need to have an address for this, an address for this. So there has to be some address range, range of addresses. I can assign maybe, you know, this range from this number to that number. Yeah, you can have that number allocated to these machines in a private area. And that range of address is what is here. That is private network from a simplest definition perspective. So we define a range of addresses and say, hey, everybody on the planet in the world, in the world we live in, you know, you want to create a private internet, private area, go ahead, use these addresses. Everybody, you, me, all of us can have private networks that will automatically get defined if we collectively agree that we will be using these addresses. And that's the agreed upon standard. So anybody who wants to set up a private network has the freedom to choose these addresses. Simply speaking, that's the range available to us. Now let's go look at the ranges very clearly. Here is the IP address range. Now if you look at just the portions in this segment, just this portion, just to help us solidify our understanding, what's the understanding here. If you know this range here and here, if you carefully observe that, you will find that these numbers, 192 is common, they did not change. Same number, 168 is also the same. What is actually changing are between these two dots and so these spaces. So here, this box and this box. That has a changing value, variable value. You can have any number between 0, 255, 0, 255, and that means any number between, and so if you count how many such values can fit in, it is 256 times 256, and that leads to this number. So there are 64K by the way, this is also known as 64K and K is 1024. This 65535, 65536 is the number of addresses available in this block, this range of addresses. That's how you read that detail. I'm going to clear my ink and talk to you about the same idea again in a different range of addresses. So here, in this range, we're talking about this now. In here you will see the number 10 did not change, it is the same in the entire range. What changed are these numbers, 1, 2, 3, 1, 2, 3. So what does that mean? It means it's a very large range. It means it can accommodate 256 times 256 times 256 addresses, which is about 16 million addresses, which is this number. And same idea again here. You can see that this did not change, but this changed like halfway through and this changed and this changed, these two changed, they changed. So it's about 1 million addresses, so somewhere in between the two here and here. So these three ranges are specifically allocated as private addresses by IETF. That's the specification that we just saw. It is also known as RFC 1918, the request for comment 1918, that's the RFC number. I don't want you to remember these numbers because it's kind of irrelevant. So 1918, so no point remembering anything, there is absolutely zero point in remembering anything whatsoever because we have Google, we have Wikipedia, we have everything that we need right there. So there is zero need to remember anything and I try to not remember anything, I try to outsource my memory to Google and to other places. I don't want to remember things, I don't. So having said, don't bother remembering anything, think of understanding the concept, that's how I approach. I would like you to take that similar approach. And so I'm going to clear my drawing and now look at an example in my own home where I'm sitting right now. And so you'll see that I'm going to now look at my home network. And this is very similar to your home network, nothing different. You might find something different, but that's not the point. The point is concept is the same. So you will see that in my home, or rather I should say in this computer, this one, I seem to have an address. What is my address on this machine? On this card, I have this address, which belongs to this range, which means I seem to have taken my choice. This is my choice of a range of addresses available to me in my home. I just decided to choose that. By default, most routers will give you this choice because they assume that this 64K65536 is a big enough number for most homes. And I think it is big enough, but so it's not necessary. But just saying that you can choose whatever you want. This is a choice available to you by the IETF standard. So I have chosen this range, and this machine was allocated this specific IP address, specifically 10.0.1.178, that was allocated to this card, this adapter, which is a Thunderbolt Ethernet slot. So I have some things here, which is just another Ethernet slot. Now let us erase this and look at the other adapter. So here, this adapter, which is this one, let's go see what that is. And so we will go look at the IP address. It is 10.0.1.179, whereas the other one was, this one was 178. So very, very similar in numbering, because it is actually coming from the same router. A router is assigning addresses to these guys. And this machine, this machine, meaning this computer, has two IP addresses, this one and that one. One connected Wi-Fi, one connected with a wire, which means I can actually disconnect my Wi-Fi and things will still work because it still has a way to connect. I'm not disconnecting Wi-Fi, but I could, clearing my ink now. I will show you the device that is actually sending these IP address allocations, which means this number, where you see that number, where is it coming from? It is coming from the router. So I'll now open my router. So here is my router. So router is opening up and I will see if I can actually edit my router. So edit my router and I see there are lots of devices in my home. I think I have probably 30 or 40 devices, a bunch of machines running. So let's go look at what we have. So let's go understand the concept here. So if I may grab my pen and look at what I have in the router. So there is a network here called Cloud Genius. It has the IP address, which you probably remember from my first discussion was a public IP assigned to my home. So this is where it came in. This is where Comcast company brings in internet to my home. Then I have the blue colored boxes and blue colored slots here. These are the LAN addresses. You can see that LAN address space has been chosen by me as this beginning point. There is some serial number and version number and all the bunch of wireless devices. These are wireless devices and then there are wired connected devices also. So I forget that. So one of these guys, by the way, one of these wireless devices is going to be this machine. Let's go see where it is. So we will go see where is that. There it is. So this machine has been allocated a 10.0.1.179 address at that point on the Wi-Fi point to this iMac. That's what you're looking at. And so that is your conceptual understanding of where this machine got the IP address. It is obtaining from this router I have. So that's the understanding. Okay. Let's go on. I will now use a white sheet instead of this. So I'll switch before I go there. So if you remember, I was talking about private area. So any number in this range, any number in this range is a private network. Anything outside? Not private. It's a public network. So what the overall concept is, any internet address basically can fit in anywhere between this and this. So line number 14 is the entire span of addresses available on the internet according to the version four of IP addressing scheme, also known as IP version four. That's the entire range of addresses. The number of email addresses, the number of IP addresses available here are 256 times 256 times 256 times 256, which is about four billion addresses, roughly speaking. That's the limit on number of addresses you can have on the internet. That's a very small number for the internet. And that is another reason why we have created private IP addresses so that anybody and everybody can have their own 16 million addresses in their private area. And then there's no limit to how many private networks can you create. And so therefore this private IP address range you have 16 million or maybe 1 million or maybe 65,000, those numbers, you can create your own private areas without having to worry about the physical four billion public address limit. That's how private network, the whole specification about private IP addresses was basically created to address this limitation of the version four protocol because it was running out of space. Now the understanding on line number 12 is a 16 million address space. And we have others like 192.168.0.0 all the way through 192.168.255.255. It has 64, 64 K addresses. Now this notation of writing addresses like this is very cumbersome and actually clumsy to write and even speak. So there is a shorthand notation to write these address ranges. How do you write the range of addresses in a shorthand? That's what I will now talk about briefly. You will also notice that the line number two, which is the public IP address assigned to my home is that. And that address belongs to not the number four, not number five. It fits in only in the range number seven, the public internet range. This is public and the other two are private. And that you can see already by just looking at the numbering scheme. Item number two, line number two fits in only in the range number seven, not four, not five. Now let's look at the shorthand notation about how do you describe this range of addresses in a short and succinct way. So I will now use this to discuss that. And so if you have a range of addresses like 10.0. Whatever dot whatever, that's one way to write, but then this whatever has to have a meaning and the generally understood meaning is that it can range between zero through 255. Now what is this 255 actually is? It is actually hexadecimal FF. If you know what hex is, please tell me that you do. I'm assuming that you understand what this means. So please tell me that you do. Yeah. Awesome. So that's hex. And there's a chat. So the idea is these are hex values. And so what we want to now do is specify a way to shorthand write these variables. So I'm changing this and changing that, but I am freezing this freezing locking. This is not going to change. So I'm going to lock some digits, some bits, some nibbles. I said nibble. Nibble is one of the two Fs. So if this is a nibble, this is another nibble. And then together they become a byte. And then multiple bytes become words and things of that nature. So you understand this idea. That's a nibble. So we're looking at nibbles and then we'll look at bits also if we need to. But I'm not going in the bit discussion. We can if you want me to, but I'm not in the mood of going in the bit level, the math right now, because it can hurt. It can just confuse people for no reason. And there is no point of discussing bit level math right now. So I'm skipping that unless you want me to, I will go in there. Bit level math basically means binary math. We'll do that if you ask me to, otherwise I'm skipping that. So the point be here is how do you represent this idea in a shorthand notation? So let's go look at the simplest example, like the home example, 192.168.whatever.whatever. In shorthand, this is represented as 192.168.0.0 slash 16, I'll tell you why. The 16 basically stands for 16 bits or one full, there are two bytes. So there are, you know, eight and eight, two bytes, eight plus eight. It stands for mask that is going to be masking it from this direction. And I'll explain that in just a little moment. If you want to specify a range of addresses, something like 192.168, and you want to lock it to three and keep this value changeable, variable, and you want to say that this range is from, you already know that, that range, and there are 256 addresses in this range. So how do you specify this in a short notation? You write it like this, 192.168.3.0 slash, and can you guess, eight, that's the, so no, no, no, eight, no, it's not eight. It is eight, eight, and eight, 24. You have to count from this direction. Similarly, if you want to expand a slightly bigger area, like 10.whatever.whatever.whatever, and you want to write this in an elaborate fashion, it ranges from this 0 through 255, this ranges from 0 through 255, this ranges from 0 through 255. And if you want to write this whole idea in a succinct fashion so that people will understand and communicate concisely, you will write something like this, 10.0.0.0 slash, eight. If you're using this eight bits of mask from this direction and you stop it right here, so these are open unmasked, you can change whatever you want here, but not here. This is frozen. So you write it like this, 10.0.0.0 slash, eight. That's the representation for this, and these representations are known as CIDR, classless internet domain routing. You can read more about it on Wikipedia or even on our website, you will find some references. Having said, now let us look at the extreme cases, extreme case of range. The smallest range of addresses that you can specify, like the smallest, what would that be? Range of addresses, the smallest, what would that be? You have to have some value and it should specify some range. So how many addresses will there be? One. So that's what the extreme value will be, extreme, extreme value of one address. The entire range of addresses including just that one, that's the idea. Think about extreme values, on one extreme is just one address, on the other extreme is the entire internet with 4 billion addresses, and that will be any number you want. So it will be represented like this, any number, dot any number, dot any number, dot any number, as long as any number ranges from this to this, like that. So this will constitute the extreme on the other side, the other side. On this side, the extreme will be just one address. So how do you notate that one address in a shorthand notation, in a CIDR notation like this? So let's take a look at an example address. I have my address, I don't remember my address, but that's not important. That just makes them address. Like here is 32.33.1.37, that address. Now that's the range of addresses I'm talking about in this extreme situation. If I want to write it like this CIDR notation, how will I write that? I will say 32.33.1.37 slash, what would I put in here for the mask? Sorry for the single address, that'd be 32. And for here, zero, yeah. So that's the extremities. So this is one extreme, it specifies one address, this specifies the entire internet. I think this helps us in now actually making use of these values in a VPC. That's why I wanted to discuss these things. Not for academic reasons, but actual practical reasons. So you got this point, I'll move forward now. Now let us see the idea of what is network address translation for which I need to open Virtual Machine. And inside Virtual Machine, I will show you this scenario where we actually have a router inside the machine, inside this software. Let's go see its properties here and properties and settings and inspect the network section. And what do we see? We have a NAT, NAT is basically a router. So we have a network adapter in this machine, which is connected to a router. Where is the router? The answer is, where is the machine? It's not there, it's a virtual machine. So this router is a virtual router. There is no physical device. There is a physical device that is outside, it's in the garage. That's the actual router, but that's the physical router that controls my home. This virtual router controls this environment, the virtual environment. And inside there, we are getting a connection to this adapter, connected to the NAT, which is this router, which is a soft virtual router, and we'll now see it. These other adapters we have, we have not even used them, they're disconnected. So I will now see them and they're disconnected. So clearing the drawing. And here, looking at adapter number two, not connected, not attached, not enabled, adapter three, not enabled, adapter four, not enabled. So we have four adapter cards, only one of them is actually enabled and is connected to the NAT inside this software. That means there is a software router. So now let's go understand what this thing is. And I'm going to start this VM. And it's starting up. Now you will see that the actual layout of the network inside this virtual environment is slightly different from what I have in my physical home environment. You will see it now. I'll draw this while the machine starts. So on the real home setup, I have something like Comcast comes in, they give you more public IP. Then I have a router. And then that router gives me internal IP addresses. And I have chosen that this router gives me address space of 10.0. I think my choice is one dot, excuse me, erase that, dot whatever. That's my choice, which means I should write that in a shorthand notation. And that means this router can control 64,000 or 65,000 addresses because, no, sorry, sorry, I misspoke. This ranges from zero through 255. It controls 256 addresses. That's what it means. It's not 24, but it is 24, yeah, it is 24. It ranges from zero through 255. So that's the range we have. And that's the address. So now we'll go see what this router does. So I'll go inspect. We'll start our IF config to check its network properties. And you will see that this machine has a ethernet adapter, which has this address. That's different from the range I have. The range I have is one, whereas this is two. It's a different, they're a completely different private network, private within the boundaries of this software, this workstation software. That's a separate private network, different from this private network that I have in my home. So it's a private inside a private network. And that is also the case with you. So now if I want to make this machine, this ethernet, this adapter, if I want to make this a part of my home network, not the virtual network, which is a separate network. So one of these connects to the iMac, which is this computer. And inside there, there's this virtual machine software. And then there is a router here. This is a router. And this router specifies and stipulates 10.0.2.0 slash 24. In other words, 10.0.2 and whatever. That's the address space this router stipulates. So any virtual machine I have running here gets allocated one such address from this range. And so this machine seems to have obtained that one. This is 10.0.2.15. It is different. This two is a different network. This is the one network where this is a different network. So if I want to now take this virtual machine and say, you know what, I don't want you to be in this router, virtual router, virtual network. I would like you to become a full-fledged part of my home here. Can I do that? Is it possible? Can I give it this address, make it a part of my 10.0.1. whatever address? Can I make it happen? I would assume you can set up a relationship. I don't know if you can use the exact same IP address in the iMac in a relationship to the router. If you've already got the router IP address assigned, I would assume you have to have some sort of an interim between the two. Yeah. I think I understand what you're saying. It is in the direction what I was going to hint at. But what I'm actually asking you to think like is a slightly different way to think. And that is think as if I'm going to physically disconnect. There is no physical connection here. As if I'm going to physically disconnect this connection that I have between my virtual network and my virtual machine, like take this connection and break that connection and say, you know what, you don't go to the NAT device, don't go to the virtual router. Ignore that. Don't care about you. I want you to go directly here. And by the way, I cannot actually physically connect a cable to this machine because it's a virtual machine. So I need you to actually use a proxy. The proxy connections happen like this. What happens is you say, you know, VM, I want you to get a connectivity. I want you to really go actually here in one of the free locations so that you can get an IP address assigned to you from here, from this router. Since I cannot connect to you directly, why don't you hook up with this and use the router network that you have here, the network card you have here. Why don't you just bridge yourself like this? And then, yeah, you become a first-class citizen in the home, first-class citizen in the home, which is what I would like you to become, which I will now show you how to make it happen. How do you actually take this Ethernet card, which is this one, and say, you know what, you go and bridge yourself with the IMAX adapter, which is the Thunderbolt adapter I have somewhere. And so that's what I will now show you how that works out in virtual land. What we are looking at is a virtual scenario. And so this scenario, what I'm going to do is just remember that this address 10.0.2.15, just remember that. I will now close this machine and shut it down. Shutting down is not strictly necessary, but just to illustrate and reduce confusion, I will show you what I'm doing is here. You don't have to shut down machines like that. You can just dynamically while the machine is running, you can switch their cabling without having to shut them down. I will now examine its settings again and look at the network section. Look at the adapter that was connected to the NAT, and I say, you know what, don't connect it at all. That's one choice. There are several other choices available here. One of them, the one I want is actually this bridged adapter. And then I want this bridge to directly hook up to whatever Ethernet I have, which I think it is connected to this one, probably. I'm not sure. I'll check that. So I can choose that you go bridge yourself, just like I showed you in the picture here. You go bridge like this. That's what I'm really doing, bridging an adapter to a actual network, like Wi-Fi, for example. You can bridge it to Wi-Fi or bridge it to a known Ethernet, like this one, or another one like that. So I'll just use Wi-Fi for right now, like this. And so now this is a bridge between the virtual adapter bridged over to the Wi-Fi airport, which is here in the actual machine. And with that setting, I will like to save. I will say, okay. So now the settings have changed and they've persisted. Let's go check the persistence. Yes, it is persisting. Having seen that, I will now start the machine again. And this time, it is bridging itself to the physical Wi-Fi connection there, sorry. I'm going to start the machine. So here we go, start, and what I'm talking about is that this virtual device is bridged to the Wi-Fi adapter. And so this machine is now going to get a private IP address, not from the virtual router, but from the real router, real. This was your virtual router, and that was a virtual network. And so we basically disconnected this virtual machine and said, you bridge to this guy, which is a Wi-Fi point for this machine. And so it has a direct connection already. And we'll also get another direct connection for this guy through the Wi-Fi bridging. And that's what you will now see in this machine here. And I will now examine its IP configuration. And you see what I expected to see, which is right here. What do you see? You see 10.0.1. whatever, and the value happens to be 181. Assigned to me by this guy, assigned to this machine, or I should say this adapter by this box. Now let us see the LAN. I'll do a LAN scan on the entire home, so I'll clear and see what I have in a scan of the entire LAN address space I'll scan. And we see a bunch of machines here. We have 40 devices currently active. And we'll go and see the one that just came on live, and that was this address. So you can see this machine that I'm looking at. It just came live with the address 181. The name is Cloud Genius. It is connected to the Apple Airport adapter. And the name of the machine is CG. The IP address is this. The MAC address is this. And you can match it here. Match it here. Hold on. Yeah, this is bridging. So the MAC address actually is going to be picked from here, not that one. It's masquerading bridging. I'll show you exactly why that one picks up, not this hardware address, but the address for Wi-Fi. So that's the address I would like to cross-check. So I'm clearing my ink right now to go to the Wi-Fi adapters. Okay, come on, ink, go away. And Wi-Fi adapters, MAC address, where is that? Maybe here. Meh. Where is the Wi-Fi MAC address? So I can maybe go to the terminal and see, because these UIs never help me. I'll just go to the terminal and find out the Wi-Fi address, adapter, MAC address. And there is the answer somewhere here. Come on, Wi-Fi, where are you? Okay. It's too big. Let me shrink it so I can see the whole picture at a single time, and I'll then zoom it back up. Okay, Wi-Fi. I don't see it. I don't see it. I don't know why, but maybe I'm not looking properly. No, I don't see it. But that's not the point. So that's not the point. The point is that you have an IP address here assigned to this virtual machine from a real router because I bridged. And there are various such options of how do you want to connect the virtual cable between a virtual machine to another virtual machine or to a physical machine somewhere. You can do these things in a home. You can do the same thing in your company, in your data center, or you can do the exact same thing in a cloud. Just like I did, just exactly like I did, you can actually configure a minute level of detail about range of addresses, routing tables, carving out private areas, carving out public areas, and assigning a set of functions to a segment in your section in the cloud that you will call private cloud or just private network, like you will do in a laboratory environment in your company, or like I just did in my home, you can do it in your home. But the idea is to segregate a set of machines and call them private, label them private, use private addresses and don't connect any cable that becomes a private network. That's the definition of a private network. Nothing is connected from the outside. No connection, private internet. You assign your address space and you have party, you know, do whatever you want there. You cannot go outside. Nothing can come inside. It is not connected. It is your property. You control it. You do whatever you want with it. And that's the whole idea behind private internet. It is, I should call it private network, not internet, private network. Having discussed these things, now let us go to a cloud. So I'm going to move this machine away from me, or maybe just shut down. Right now we don't need the machine, so shutting down. So the machine should go away and I will now expand my screen, go to a white sheet, go to Amazon's website, where we'll begin our exercises. So we'll go to AWS, login, and come on, login, there we go. And we saw the router, we saw these videos already, and the private network definition. And here is my password, and here's my token. And there I go. So I logged in. And now we'll go look at virtual private cloud. Let's begin with a definition. So very short, not, not, I'm not bored with definitions. I already have bored you already on the first day. It's long, boring, you know, just definition that that's, I'm not doing that. Just giving you a very short succinct sentence to understand what is a VPC or virtual private cloud. And in this example, we are going to use Amazon, but the same concept applies to any cloud of your choice. I'll tell you exactly how they are different. They're not. I'll tell you how they are named different. Yes, they are very, very differently named. People call same things differently in different companies. And that's the whole idea behind different names. But the concept is exactly the same. So what is a private cloud that will understand that a private cloud is just a cloud that you've seen before, which gives you resources, resources include compute storage and network. And a private cloud is going to be private, meaning only you get access to it. Nothing else is connected. Nothing else can come in. No entry, no exit, private IP range. You can have boxes and boxes and boxes and with compute storage and things, whatever you want. It is all private to you. And that's a private cloud. That's the definition of private cloud. Now let's extend this definition to virtual private cloud. A virtual private cloud is something that, you know, not that you cannot take traffic, no traffic allowed and no traffic can come out and no traffic can go in. On top of that, it is virtual, meaning it is all software sitting somewhere in some cloud. You cannot even go there. So you as a person cannot walk and go there. No, not allowed because it's virtual and it is, you know, out of bounds for anybody. Nobody can, you know, like go into a virtual machine. How do you do? You actually go through a real machine and operate. That's exactly the idea. You have to use your laptop, desktop, whatever you have in your machine, in your computer, in your company, in your home to access this private cloud. And it happens to be a virtual setup, therefore VPC. It is basically PC, private cloud with a V added, virtual private cloud. That's the whole idea. So the key premise, you cannot go there. No traffic can go there and no traffic can come out. So why do we even bother having such a thing? I cannot go there. My traffic cannot go there. People cannot come there. I cannot go outside. What's the point? Like, why do I need it? I cannot even use it. So how do I use it then if I cannot go there? I'll answer those questions. So this is VPC, right? Now different companies call the same thing differently. Like Microsoft will call it virtual private network. Just to confuse everybody that there is a thing called VPN, which is a type of connectivity, a virtual private network connectivity. Microsoft likes to call this virtual private networks. That's the name I think. Let's go check. I am very bad with naming and remembering names. So I would just like to check Azure VP network. Let's see what they call it. I think that's the name they use, but yeah, I think that's the name. So where's the name? I don't have a name. No, I need to log in, I think. So go log in. And here is log in. And so let's go see if we can look at a virtual network, VNet. Yeah, there's an expert. So thank you, Vaishali. You should open your mic and say these things, not just chat, because I don't monitor that chat. Occasionally I miss. So virtual networks, virtual private networks, various names, but that's just a name. So here you don't really see it. But yeah, I think this cloud genesis actually is a VNet. This is a VNet, a virtual network, a virtual private network. They call it virtual network. That's the name. So virtual network. Yes, you're absolutely right, Vaishali, a VNet, virtual network. That's the name this company Microsoft likes to use. Let's see what Google calls it, callout.google.com. Let's see what they call it. I think they call it VPC, so you already have these names handy, so I don't need to look at names. You understand. So skipping that. Let's go look at this. VPC. These guys also call it VPC. So we'll go look at the VPC idea here. They have classified in the VPC section, so we'll go inside. And last time I also reminded you to remember to not delete any default VPC associated to your account, which I'm assuming that you understood and that you haven't deleted anything. So just keep it. It's not going to cost you money. The key thing before you begin is to remember where you are going to be operating. That's a critical thing to understand in case of Amazon Cloud. They have this unique thing called region selection. You have to understand what you are going to deal with. So I am currently here, but many of you are here or maybe other places, but you need to know where you are. That's an important thing to keep track of. These are actually independent clouds from my point of view, although Amazon doesn't like to use that terminology, but they are actually separate clouds because you cannot even share a key pair with each of these. We have to create a separate one or maybe use the same one with multiple places. Having said, I'll just stick with one, like for example, and there I will begin understanding VPC. So here I have how many VPCs I have. I have one. This is my default VPC and that's how it shows you default VPC. So you keep it. Don't touch it. Don't use it. In this exercise, we are not going to use it. So just leave it alone. So we're going to create one. So we'll begin like this, creating a VPC. Click that VPC creation button is the layperson way of doing things, which is, you can of course look at that and see what I mean by that. I'm going to click that button and here, and it will walk you through what you need. And hold on, this is not what I was talking about. I was talking about a wizard. So there's a wizard creation step. Oh, they removed the wizards. Is it? I think they may have removed the wizards altogether, which is nice. Okay. Awesome. Amazon used to have these ready-made wizards to create VPCs. And they seem to have gotten rid of that, which is, I think I actually like it. I don't want the wizards on the VPC dashboard. Is it here? Okay. So yeah, don't use the wizard, it's still there. Okay. Come on. So this wizard is how children create VPCs, so don't use that. Let me just see and explain to you what that means. So this wizard, number one, VPC in a single public subnet. So let's go see that. What does that mean here for us? Is that, by the way, don't use these wizards, they're for kids. Here we have a public subnet. What is public subnet going to be? It is something that is public, meaning it is connected to the internet. And if that's the use case, that's what you want. But in many cases, this is actually a bad design. You don't want machines to actually connect directly like this. You don't want a public subnet, only a public subnet. You want a subnet, public, but not just one public subnet. So this, to me, is a bad design for enterprise usage. Don't use it. Next. And I told you why it is bad, because I don't want every machine to be connected to the public internet. Bad idea. Don't do that. I don't want hackers to come to your laptop, do you? And that's why you do not connect, and by the way, I missed this description. When you have a home, and you in that home, you have a Comcast company coming in with a public IP, and you have your laptop. Do you connect a laptop directly to the Comcast box? Direct connection, direct modem connection. Do you do that ever? Sometimes it is technically possible. It will work. But you most likely don't connect the laptop directly to Comcast. Do you know why you don't? Why do you use a router in between? Security. It prevents you and creates a public-private separation. And this private area is what you saw is available inside the home. The public is what is available outside. It is segregating and doing a network address translation. It's a router function. And that's why you want to connect your laptop to the private areas and not have bad guys on the internet come to your laptop. You don't want that. That's the same idea here. You don't want bad guys on the internet to come to your corporate machines. Next. We'll now go to the next idea. This is a reasonably okay design, and of course you can extend. But right now, this I think is a good design. But I don't want you to select this design and just do it because that's how kids do it. I want you to understand what's going on. And therefore, I am not using the wizards. Next one is the third one, which is a slightly more evolved version of the second one, in which what we have is a setup in which you have a public subnet and a private subnet. Public is directly connected to the internet, private is connected to the public area, but not directly connected to the internet. There is no connection like this. There is no such connection. And you have a VPN connection to your corporate data center. That's a good design. But again, I would like you to construct these designs yourself, not using the wizards. And the last one is this one, which is there is absolutely zero connectivity between anything on the internet. It is a private cloud. There is no internet connection. There's only a connection between your data center with a VPN established. So we have an exercise with VPN also coming up at some point. But right now, we are going to construct a VPC from scratch, like from nuts and bolts without using wizards. And so here we go, we'll begin. Go back a step and don't use the wizard. And go to Amazon AWS and then scroll to the VPC section, which is here. Remember that you are in the region of your choice, which is in my case, Oregon. Then I go to the VPCs and then I create a VPC and I will not use the default VPC just because I don't want to right now, we'll use it later. I'll assign it a name, so we'll call it some name, CG, cloud genius. I'll have to assign a cider block, a range of addresses allocated to this virtual private cloud, range of private addresses. And I will have to choose something like this. And from here to some other range. So I have to assign that address range. So you can choose a range of addresses. And I think my plan is to just select whatever, dot whatever, as long as it is 10, 0 here frozen. So that range of addresses, if I write in a cider block notation, CIDR notation, it will be 10.0.0.0.0.slash 16. That will give me 64K addresses, approximately speaking. Having said that, what I would like to do is check what Amazon is suggesting. Amazon is suggesting that your IP address in your VPC cider block can be, like for example this, and the block size must be between a 16 subnet and a 28 subnet mask. So I think this is the biggest you can get. And the smallest is 28. And 16 is bigger than 28, which is counterintuitive, but that's how it is. Just like 32 is smaller than, slash 32 is just one address. So 28 is smaller than 16. Just remember that, understand that. And having said, I want to get the biggest IP address range I can get in a Amazon VPC. So you will see that this Amazon VPC allows you 16 mask, slash 16 net mask is the biggest you can get. In other clouds, you will find, you can get even bigger range of addresses. So like console.cloud, cloud.google.com, you can get a much bigger address range in just one VPC. So we go see that and go to VPC networks and try to create one and say create. And here you will see the same idea. You have to give it a name and assign a region and then select the name. So here the address range limitations are, slash nine, even bigger. Here is your slash nine, bigger than slash 16. So it is a much bigger address span available in just one private VPC in a Google cloud. That's a different scenario, different than Amazon's, but that's just design implementation differences. The concept is not different. So we'll go with a 16 here, 10, 0, 0, 0, slash 16. And then I'll choose a tenancy here. I will go with a default tenancy because dedicated is a slightly more expensive option. You can get that, but for our exercise, default is good. I'll go with default and you click the create button and you now have a VPC ready. Here we go. That is available to you right there. Now keeping it like this doesn't cost you a thing. You can keep it if you like. You can delete it if you like. It's your choice. Just remember you don't delete the default VPC. That one, do not delete this. Having said, we created a VPC for ourselves, but that doesn't do it much for us. We have to actually walk through these sequences in a specific order for us to understand how do you construct? What does it go under the hood? What does it take to fully construct a functional VPC according to your business applications requirements? That's what we are really trying to build here. We just created a placeholder. In our placeholder, we have a range of addresses available to us. That's it. We have a couple of more things also available to us, given to us at the time of creation of this VPC with an ID number and a range, and there's a routing table, main routing table created and access control list created. The tenancy is default and the default VPC is no, and that's the idea that we just created. Now we'll go into deeper and understand what do we actually do with it. Now we'll go and see what subnets do we have already, and let's go see that. In our subnet selection, we see that we have three, but that is a wrong way of looking. You need to look at it very carefully to see what you actually have, and you have to filter by VPC. You have to go in this segment and say filter, and I should filter by the other VPC, which is not currently showing in the screen for some reason. That's a bug. It should pop up, but I see only the default VPC. I should see the newly created VPC for which I think the resolution is to refresh the browser. The browser doesn't know that I have a new VPC created, but now it does. I need to filter that CG. And now it is limited to only one VPC, which I have created manually. And so I see that I don't have any subnets that are missing. I can create one. I will create one right now by clicking the button and begin to create a subnet. Now let's see what we are doing here essentially. So I'm going to erase this and let's go understand what we're really trying to do is, I'm going to build out a VPC. And what is my plan, overall plan? The overall plan that I have is something like this. In my VPC that I now have, I have a range of addresses. I can have 64,000 machines in here. I need to have this area carved out for my applications that I want to run in this VPC. So I need to have an area which I will use to set up my database boxes. I will have another area which I will use. By the way, these lines that I'm drawing are just address ranges, address range. So this is another address range. And what I will do is assign this address range for my database boxes, assign address range for my application boxes. Assign another address range, a range of addresses for my web server boxes. And goes on. You can have any number of these because we have lots of addresses available. We can just carve out a portion and give it to database, give it to applications, give it to web servers, give it to something else that you may come up with. And then we'll have one more area which I will like to call, I think in my videos I call it what I forget, border check, I think, border checkpoint. That's what I think I called in the video, border check subnet. This is a subnet that I will, by the way, address range is a subnet, subnetwork, address range of networks. So this is a available address space. I'm going to get a portion of this, a piece of this, put it here. Another piece here, another piece there, another piece here. And what I'm planning to do is put in short ranges, 256 addresses here, 256 here, 256 here, 256 here. That's the small size VPC I'm planning to create. This border check subnet, you can call it public subnet in other language, other words. The public subnet will have 256 addresses. This web server will have web server address range or web server subnet will have 256 and like that. So that's the plan. What I would like to also have is a router here or other, I should say, a company like Comcast come in and they should give me internet here. So I need to have a gateway or a modem in place. I need to have this connected to the public subnet. And I don't want to connect this Comcast connection directly to any of this. No, no, no, no corrections. So that's the kind of setup I'm trying to build. And then I will put machines here, create a machine, put here, here, here, and run my database software on top. So I'll say db, db, db, more boxes running variety of databases. That's what I will specify and run them in these addresses, 256. I will have some application server running my application one, application two, application number 37, like that. They'll be running here in this segment. And web servers will be running here and some other things will be running here. We'll talk about some other things shortly. This is what we are trying to build. So the very first step that we are going to do is to create a subnet, which means we have to create these lines, which allocates a space of address out of this number available to us. We have a whole range available to us, 64,000. That's the limit, upper limit in the Amazon VPC. We are going to create a portion of that and create subnets like these examples show. So we'll go there in Amazon's browser window and assign it, call it border check subnet and make sure that I'm selecting the correct VPC, the cloud genius VPC and associating with the VPC sider, which is 10,000, 16 associated already. And now I will assign a shorter portion of this 16. So I'll select something like 10,000 slash 24, maybe is a subset of the 16 subnet because 24 is smaller than 16. Well, I'm not talking numerics, but I hope you understand that 24 or I should say slash 24 is smaller than slash 16. That's the idea. And so this 24 will fit in just fine. If you try to fit in like a 15, it will not. If you try to fit 16, that doesn't make sense. Try to fit in 24, that's a good one. So we'll get 256 addresses in this border check subnet and I create that. So it's created. We're done. Next, we co-create two more like that. It's very, very easy. Call it web, not webchen, but web subnet and assign it a address space. It has to be different address space. So I'll select that to be 10, 0, and I can change this particular byte to say number 1, and then 0 slash 24. And then I create. And we'll just play with two right now. We can create more, but that gets boring. We want to do the whole thing automatically, like in a scripted fashion. We'll do that, but there is an exercise coming up for that subsequently, not right now. We'll use a tool called Terraform, whatever I'm doing right now, we'll do the same exercise with one command line and it'll do exactly what you have in mind for your application designs. It will create the entire blueprint like you have here, setup machine, setup NAT, setup VPC, setup VPN, connect it to your company, all of that in one command. You can destroy the whole thing in another command and create it again, another command. That's easy how it is. We will see this, but not right now, first we have to understand what's going on. So we'll get there, but not right now. So we have two subnets currently. So this piece, subnet, we did that. Let's see what we have in route table. And this is something that I would like to discuss a little bit later because it actually is a little bit difficult to understand. I think in this topic, this idea of route table is slightly difficult to understand. So I'll pay attention to that, but I'll move forward and come back to the route table discussion in just a few minutes. I'd like to see what internet gateways we have. So we have something, do we? Nothing. Apparently we don't have a gateway. So what we mean by gateway is that we need to get a Comcast connection. I mean, we don't get Comcast in Amazon cloud. We get some other companies that provide connections and that connectivity is actually free. So we create one, we give it some name. I call it gateway, GW, and create. So it created a gateway for us. That's awesome. But then I don't see it in this list. I created it. I don't see it because I need to refresh the browser. And now I see that I have the gateway called GW created and detached, not connected yet. So I have to make a connection like this, and I will do that by selecting this gateway and saying, hey, you please attach it to the cloud genius VPC that I have here. So please connect. So I click that and say, attach, say attach. It is now connected. This, it is not Comcast. I'm just saying Comcast. It is a internet provider that gets connected to the VPC. That's the idea. So having connected that, by the way, you notice that I erase this link. I don't have that link yet, but it is that specifically because I want to create that link and I'll talk about those links yet later when we talk about route tables. So the gateway is created and associated with the correct VPC. We will now again narrow down to the VPC we have in question. So now we see the gateway available to us. There are some other types of gateways these days from Amazon and they are egress only gateway. It goes outbound traffic only, no incoming traffic, which is a good valid scenario for business usage. It is a protected out only gateway. So people cannot come into through that gateway. It's out only, no traffic allowed outside. That's a unique to Amazon and so you can use it if you like, but I would rather not use such customized solutions for our discussion because I would rather have a common understanding of how things can be accomplished in a variety of clouds. So that is a good solution. I'm not saying it is bad, but I'm saying that I will not use it, at least for this example. Next are DFCP option sets. These are basically the options that get assigned when you have a router assign you a name. You can specify the option sets to get that specified like this. So you will have a domain name associated like usv2 compute internal extension associated and that is decided by the option set. It is dynamically assigned. We can just leave it alone. Next is the other idea, which is something that is strictly not necessary and that idea is elastic IP. From a technical point of view, we don't need to have this. From a business point of view, it's a great idea. Technically don't need it. It will still work without having to have an elastic IP. I'm talking technical. When it comes to business and running an actual application from a company perspective, you want to use that. So business is a good idea to use elastic IP. From an academic technology usage perspective, nobody cares. And it costs money. So you're not wasting money. It's a good idea to use it for business. This one, by the way, I think it is not going to cost you money. It's probably like a $2 a month, even if it does, it's not that big a deal, but I think it is free for you for one year. There are some other services like endpoint services, endpoints, NAT gateways. This is like another type of gateway. So this gives you a ready-made router solution. And so anything that is ready-made for us actually prevents us from understanding what the thing is, because if it is done for you, you don't understand what they did. And that's why I don't like to use wizards. And that's why I don't like to use such ready-made router solutions because I would like to create my own router. And I can potentially go to Best Buy, buy a router and ask Amazon, hey, use my router. But that's not the idea. The idea is to actually create a router from a Linux box. So just plain old Linux machine, you can convert that box into a router with just two lines of code. So it becomes a router. That's the code I think I will be using. I'll go through the details specifically at the right time. But what I'm doing is not using these things, like endpoints, endpoint services, NAT gateway, not using peering connections. They're not strictly necessary for conceptual understanding. They're add-on services, we'll use them later, but not for the conceptual understanding part. So let's begin with the remaining step, which is this, sorry, sorry, sorry, this Routetable piece. And that piece is not done yet. So let's go look at that. What I want to do is go to the Routetable section, understand what we have, and we have been given this Routetable. We'll call it Default. Just call it Default for the VPC of your choice. So there is Cloud Genius VPC here. And there are two VPCs and there are two Routetables, and both of them are associated. So this is the Default VPC, Default Routetable, and this is the Cloud Genius VPC Default Routetable. So I have labeled them both as Default, and by doing that, what I intend to do is to not use them. We don't want to ignore them. So maybe I should rename this as Ignore, because I don't plan to use it, because it's again given to me ready-made. So I don't want to use it, because I want to understand and build what I need. So I'm ignoring them. So now I will create a Routetable myself, for me, and I would like to have a Routetable associated with each of these. I think I have only two subnets in this picture, so I don't have this, sorry, I don't have this and this. I have only two subnets right now in my current implementation. And so I will like to just have a picture of two. And so that's the two subnets, one and two. That's what I have, 10, 0, 0, 0, slash, 24, and 10, 0, 1, 0, slash, 24. That's the subnet sider, one and two. This is called public, and this is called what? I don't know. I don't remember. So we'll find out the names. And what I want to do is alongside these public and let's call it private, alongside these two subnets that we have, we need to have a way to route traffic, a way to route traffic is a route table. It tells you, or rather tells the traffic where it can go and where it cannot go. So we need to have a route table created for private traffic and a route table created for public traffic. That's what I will be creating now. So here we go on this page. I will create a route table in my Cloud Genius VPC, call it public create. So it's created. I'll create one more, call it private, and associate in the Cloud Genius VPC and say create. So these are empty route tables with nothing in there. And these two ignore ones, I will just ignore them by skipping them or just not looking at them. We'll also compare the subnet naming. In here we have some names that are kind of exotic, meaning I want to match these names with my labels that I created for my route tables. In my route table, I'm ignoring this, and I have chosen the name public and private, but my subnet names are different. So I'm going to rename my subnets also just to align with the route table for clarity of understanding. So I renamed this as public and the other one I call it private. The names are actually just for understanding, there is no other meaning to it. You can call it monkey and donkey if you like, but it has no connection. They are just names, they are strings of character. And so we have route tables, two of them, this is ignored. And now we will go look at these two route tables one at a time, beginning with the public route table. So we will now look in detail under the hood on the public route table to see how the traffic actually flows. And how do we know that this public route table is associated with the correct subnet? So we have this subnet called public, and we have a route table. But how do we know that these guys are connected, associated? We don't until, because we just created this like out of thin air, I say route table called public. We know that just the name doesn't have a meaning, you can call it as a monkey if you like, but that doesn't associate automatically. So you have to explicitly associate this route table with a subnet like this, or we have renamed it as public. So that re-association with this between the route table and the subnet has to be made explicitly. We haven't done that piece yet, so we'll do it now. The action is simple. The understanding is important, and that's what we're doing now. So here in our naming, I need to rename these guys, and I call it public, not border check. And so we have a route table here and a route table here, and we'll need to make an association between these two, route table association with the subnet, and a route table association that we have with the subnet here. So that's the association I will be making, beginning with this association, and let's do that piece. So we'll go look at our public route table and look at its subnet associations, and we find that it doesn't have any subnet associations. It tells you, you do not have any subnet associations, meaning this subnet, sorry, this route table is not associated with this guy, not. So let's make it associated with that guy. How do you do that? You edit. So we'll edit the subnet association, click. And then we associate the public route table with the public subnet. It's as simple as that, and then you save. So now you see that our route table has an association with the correct subnet of our choice, this one, this 0000 shows it is a public subnet. And this is your public route table associated with the public subnet. That's the association I just made. And I will make a similar association with the other subnets. So here we go, go to the private route table, look at its subnet association. We find that we don't have any subnet association. So we go edit the subnet association. And we say that, you know what, this one is a private route table, so it should be associated with the private subnet. I said, okay, save. So now I have my private route table associated with the private subnet. That piece is done. So the associations have succeeded. That doesn't yet let the traffic flow, yet it doesn't flow. Just an association. It's a mental association between, hey, that is my route table for that subnet and that is my route table for this subnet. That's the mental association we are able to do. But that doesn't actually provide routes for internet to actually flow traffic. So we'll now address that piece now, beginning with public route table associated with the public subnet. I will now look at the routes available in my public route table. This is where the tricky part comes into play. So please pay careful attention to what I'm doing because this is where most people stumble. And so let's go look. What do you see here is that the public route table associated with the public subnet, I'm going to edit the routes. But before I edit the routes, I want to look what routes to what destination are already available and how will they be connected and whether they're active or not. That's what I want to look. So I look and I find that the destination for traffic is this, which is 10-0-0-0-16, which is our VPC address, the entire VPC. You can go anywhere within the VPC. This means within the VPC. You can go anywhere you want with a local connection. You don't even have to go outside. It is all within the VPC. So it is already available to go from anywhere to anywhere provided you are within the VPC. Lesh, I have a question. Yes, please. I may be, you may be telling me the answer and I'm just too sick to get it. But I did actually go through all of your videos last night and this morning and I'm able to create the first two sets of table, you know, the first two sets of stuff. But creating the route table, I'm creating the route table and maybe I just did it wrong. But there seemed to be interference with the route tables being created public and private versus the other two guys. Is it because the two objects are completely different things and I was trying to do it too early in the morning? Because you have the two barriers? Yeah, probably you needed coffee. Okay. So make sure it's a route table before I go do stuff is what you're saying. Let's go see how it works out for this example that I'm going to show and then we'll open for questions. Okay, thank you. Thank you. So I'm going to erase my ink and then focus on expanding my routes. What I plan to do is my destination is narrowly limited to the VPC only and the connection is local connection and it is active. I want to expand. I want to go, this is like a public route table associated with a public subnet. So I want people to be able to come from outside. I want machines that are on the public subnet, M1, M2, this is the public subnet. I want the machines here to go visit cnn.com or foxnews.com or whatever you want to go. Whatever, internet, right? Go internet. So I want them to be able to go and internet is not inside my VPC. So internet is what, CIDR, it is 0.0.0.0 slash 0, CIDR. That represents the destination for the internet. I'm just using CNN and Fox News as a proxy. Anything like in a cloud genius site here, cloud genius, that's also on the internet, right? These sites, I want my machines to be able to go, they're on the public subnet. They are free to do whatever they want, connected directly to the internet. So I need to have another destination like this, but expanded to the internet, not just VPC. Now, this connection cannot be local. It just cannot be because it is on the internet. So I need to have a method of connecting and I have it already. It is called a gateway. So I need to just use it and make it active. And that should finish the route table for my public subnet. So that will allow these machines on the public subnet to go wherever they want through the gateway to the internet. That's the destination. That's what I want to create. So having said that, I'm going to now erase my red ink and actually do it. So I'll expand my route by editing it. So edit routes and then add another route. I want to go to the internet. So I'll type 0000 slash zero, like that. And I want to use a connection to the internet. The only connection I currently have is a gateway. Which gateway? I have an internet gateway and that is called just GW. That's the name I chose. So I will select that. I'll select that gateway and then it pops up and I'll say, save the route. So boom, it goes, saves it. And I close. When I close, I have a public subnet associated correctly with the public route, sorry. I have a public route table associated correctly with the public subnet. And the route not only goes to anywhere within the VPC through a local connection, which is active, but also goes to anywhere on the internet here using a gateway that I have set up, which is also active. So now any machine that happens to be sitting on the public subnet, we'll use this route table called the public route table to go wherever they want, inside the VPC, outside on the internet, wherever you want, just go. So this is one part of the puzzle for traffic. This is just one part. The second part of the puzzle is you have the ability for traffic to flow. Meaning in other words, is there a route available? Is there a highway available? Yes or no? So the answer to that yes or no question is this. Is there a highway? Yes. That's just one part of the equation. The second thing you need to have apart from a highway is a license to drive and a car. And that license to drive and car is called a security group. And we talk about that also. It is also one of the very critical things to understand flow of traffic. You not only need to have a road like this, but also need to have a permission to drive, which is separately assigned and we'll talk about that separately. It is here in the security section and we'll go there also. When we actually try to route traffic, we'll go and look at that. But this routing table is just one piece of the puzzle for traffic to correctly flow. That is, do you have a highway and then do you have a license to drive in a car? That's a permission. So this is a privilege, a privilege as opposed to, or I should say permission or even another word is authorization. Do you have the authorization to drive on the highway? And of course, just having the license doesn't allow you to actually drive to a place like you cannot technically drive to Hawaii from here. Even though you have a license, you cannot drive because there is no road, there is no route, there is no route table entry like this. So you cannot drive to Hawaii. You have to take another route, which is flying, maybe you will buy a ship or swim. I don't know what you do, but definitely not drive. So erasing my ink again, that was the public route table discussion. Now we will switch to the other idea, private route table. So now I will look at that. And here we have our association already marked correctly. This is your private subnet, this one, I think, yeah, private subnet. So we'll go to our route tables and look at the private route table and we see that our routes are again limited to VPC with a local connection active. But I want to leave it like this for now, because what I really want is to not allow my private machines on the private area. So this is your public machines, this is your private area, so private subnet. I would like the machines that I create here to not connect to the internet at all for right now. So I don't do anything and they are just isolated. So I cannot go there, except this machine can go here and this machine can go here and connect to this machine because it's all within the VPC, it's all within this range. Within the family, within the VPC, you're welcome to connect with each other. That's how routing is set up already, local connections within the VPC permitted. But you and you cannot go out. Nobody else can come in to talk to you, not allowed. You can go out because you have a gateway and a public route. So you can potentially go out if you have the authorization to drive a car, meaning if your security groups are open, you could go out. And companies outside, people outside can come in. That is also allowed because we have used a standard gateway, not an egress-only gateway, which allows only outbound connections, not inbound. No ingress, only egress, which is a security method. You can use that if you like, but not in our discussion. Just a question of selecting the appropriate gateway type. That's it. Nothing else. So that's what we have set up. We have decided to not allow these guys yet any connection whatsoever. So we're leaving it alone. And now we'll understand what does it actually take for us to allow machines over there on the private area to actually update themselves. Like if I have this machine here and I set up Ubuntu and I want to run app update. And so how do I do that exactly? I cannot connect to the internet, but then how do I update my Ubuntu box? I need to go and run this or maybe I have a Windows machine here which runs Windows update and it needs to go to Microsoft, but it cannot. So how do I update them? Any ideas? What do you do when you buy a new laptop from Best Buy, bring it home and you want to update that? To upgrade it, I go and update the Windows update, go to a website and see what Ubuntu says is the latest version and sometimes it'll even check for me and say, yes, exactly. So when you bring a laptop from Best Buy, it might update for you itself provided you connect it to the internet, you're going to put it here on the private area. So this is private, this is public. This can connect to the internet just fine, but these guys cannot and your laptop is in your home. This is your home. So what do you do in your home? Do you take your laptop and connect straight to the cable modem? I don't think so. So what do you do? You connect it to something. What is that thing? It's a router. So you need to have a router somewhere in your setup. The router needs to connect to the internet and router needs to provide IP addresses to your home. This is your home, by the way, just the same setup like you have in your home. But it is not accessible to you like directly physically, you cannot go there, but you still have to do the same exact thing like you do in your home. You bring a new laptop, put it right here on the private subnet. You need to have it connect to a router and then have the router connect to a gateway for this laptop to update itself. So we need a router. And then that's how we will be able to wire it up so that it will update. So we need to get a router. So how do you get a router? I told you about like creating a router out of two lines of code, so that's a little bit of step. So I would rather do that step later on. We have an exercise already. I told you. We'll do that later. But for right now, I just want to get a ready-made router because I cannot go to Best Buy and ask it to say, hey, take my router, put it in the VPC for me. It will not, they'll not do it for me. So I need to ask them, hey, do you sell a router? And they actually do. So we'll just go and get a router from them. So go to Amazon Web Services on the front page. And here we'll say AWS Compute Services here, Compute in the EC2 section. That's where you will find a router. You have to look for it though. It's not easy to find because they have newer services that make it easy for you to just use the NAT gateway, which is basically the new Amazon way of doing things. But it does not help you in understanding the concept of a router and the associated wiring and all that. That's why we are not going that route. Otherwise getting a router, it's so easy as clicking as NAT, you know, click here to get a NAT gateway and you're done. But that's not what we want. We want to understand the concept. So we'll launch a new machine, but not just any machine, you have to launch a router machine. How do you find a router machine? You go search for it right in the search window. And there you search for something like NAT. And we find that there are no results directly, but they are available in AWS Marketplace. So let's go see 22 results from the Marketplace and what do we get? Yeah, these are commercial results. I don't want them. They're from various companies. So I'm not going to Marketplace. So I like to go open source, community resources. So I'll look at the community results, community AMI. And there I see something that I seem to like because they're open. And let's go focus on a variety of solutions for NAT from a variety of open source places. You can get an Amazon Linux, which is basically a clone of Red Hat to some extent. You can get a bunch of other open source Linux or OSes. They all give you NAT solutions. So you can choose whichever NAT you like. I'll just go with Amazon NAT. So I'll further refine my search query to say AWS or rather I should say AMZN NAT, not AMZN. That's how the naming is apparently. So AMZN NAT and I go search and I find some results and I'll go review them. And I review and I find that I have 49 answers. That's a lot of items. I want to narrow it down. How do I do that? I say 2019. Let's see if we have any answer in the 2019 version. No, we don't. How about 2018? So 2018, we got some answers, 16 of them. So we'll just manually look for the biggest number, the oldest, sorry, the latest number. And we find that maybe one of these guys is a good one. This is that a bigger number than that? Yeah. Yeah, that one is a newer. Do we have any newer than that? Probably not. No. No. So that's the number. So that's what we pick. We select Amazon AMI VPC NAT HVM. So that's a mouthful. So I'll go expand it now. Amazon AMI is Amazon machine image, VPC is using the virtual private cloud, NAT is a router, HVM is hardware virtual machine, dated 2018, March 0, some number, 64 bit, elastic block storage. And here is your AMI ID. So machine image ID, Amazon machine image ID. That's the item I want to select. This is going to give me a readymade NAT created by Amazon in the open source and I'll select. And then T2 Micro is a good enough size. Doesn't hurt. It's free is good. It is free for you. So take it. We go next. And now here, pay attention to the settings here. We have done this before one time, maybe two times, but I'll pay attention to some of the details here now. I'll say I need one such device. I want to make sure that I am getting in my correct VPC, which is not the default, but the other one. That's what I want it to be. And in the other one, I want to put this in the correct subnet, where do I want to put public or private? Which one do I select? Where should the router go? Public. Router goes public. So we can correct it like this. Like router goes public, machines go here on the private side. The router goes public subnet. Now I would like to choose the next option. This is again a critical step. Don't miss on it. This option is to automatically assign a public IP. The default is to disable, meaning your router will not be able to be able to actually connect to the public internet. You want it to connect. So you want to get a public IP. So you say enable. And remember that. You have to explicitly automatically assign a public IP to your router you are creating. And that's the critical step. There are rest of the things we'll discuss later. They're not critical for this exercise. Moving on. We'll go and add some storage. And I don't know why, but these guys give me magnetic storage and I hate them for that every single time. Magnetic. That's my default, apparently. So don't get magnetic. Get SSD. At least. There is an even higher speed SSD available that costs a little bit more money, but there's no need for it. So it is just higher performing SSD called Prodigy and IOPS SSD, IO1. Get that later. But right now GP2 SSD is equally priced as magnetic and good enough. And we're just not even using the hard disk. So 8 GB is good. We'll add some tags. In the tag, we can add it, call it, this is my nat. Not ne, but nat. And so not Nathan. Okay. Next, we add some security groups. Now comes the discussion about security groups. So we'll have to pay attention to this again very carefully because it is the authorization for you to get a driver's license to be able to drive your traffic on a whatever you want. So that's critically important is the next idea of security groups. And so we'll go click on that next step. Understand what security groups do we have already. And we have been given one by default. And I never like to use anything that is given to me by default. So I create a new security group. And so I'll never to name it. And this collection of permissions and authorization or license to drive, I'm going to give it a name. I'll call it Nat. That's my description. And for right now, I'm going to allow certain traffic, for example, I'm allowing SSH access, which is port number 22, this port, allowing it to connect from my IP. And that's the only thing that I'm currently allowing. So just me, just SSH from my home office. That's it. There's no other connectivity I'm permitting right now because I'm giving only me the permission to only use SSH only from my home. No other location. Even if I change my location, I will be prevented from access to my own boxes. If I use any other protocol other than SSH, I will be rejected. If I am not logging in as me using my private key, using somebody else's private key, I will be rejected. And that's the idea. So it is very, very narrow scope of permissions, but I'm allowing only just that scenario. Me coming from port 22 on my home IP address, originating from my home. That is my current implementation of security selection called, or rather, I call Nat. That's my name or that's my label for this permission. I can later on change the permission structure, but right now just understand that this permission allows only me coming in from port 22 from my home. Nothing else. That's the limitation. I'm deliberately choosing it to be very, very narrow because I want things to fail and then we'll fix it by opening up little things one at a time to understand. That's the best way to understand security groups, by the way, is to prevent everything and then slowly open one thing at a time to understand what makes it work. And that's a proper way to analyze security settings. Just lock everything down, open carefully one thing at a time. So that's the right approach to handling security scenarios. So therefore that's the reason why I'm keeping it so narrow. Actually ideally I would like to expand it, which I'll do that later, but that's my selection right now for my network, no, this is network address translation, NAT security group that I just create like that and I review and launch. When I launch, it is expecting that I give this setup a private key, key pair. I need to provide a key pair to this guy so that I can connect to the NAT box, this box. That box is about to start and so I'm going to launch the box and it says, Hey, do you know your key pair? And so apparently, huh, okay. I don't know which key pair is this, but I'm just going to go with Nilesh for right now because I don't remember. I think I might have the Nilesh key pair, let's check. I should have checked the key pair first before I went through this, but let's go check whether we have Nilesh and I do. Okay. So we'll be able to succeed. So I acknowledge that I have the corresponding private key. And by the way, when you're doing this exercise, please remember to put your public key already with Amazon web services in the region of your choice. Like in this example, I'm using Oregon. You will be same or different. I don't know, but you remember to add the key pair first before you come to this point. So let's go forward. So I'm going to now launch the machine. This will start a NAT. So now I am getting a router from Amazon open source, Amazon Linux, and I'm going to view the router. It is currently pending initializing. I'm going to examine it. I see already that I have a public IP that can go there if I want to, and I will, I have a private IP and you will observe that this private IP is in the range of 10,000, 24. This number changed. This can change as long as you are in the public subnet. This is the public subnet private IP. It is clumsy to understand, so I'll clarify. I hope you understand. So this is going to be a private IP in the public subnet. This is a private IP in the private subnet. This is a public IP, which is here, public IP for the NAT. This is your private IP on the public subnet for the NAT. The subnet name is here, the VPC name is here, and a bunch of other things. We are using Amazon, AMI, VPC, NAT, hardware, virtual machine, this date, 64-bit AMI ID. The security group name is NAT. It is running T2 Micro. What else we have? We have a very important thing here that is critically important to understand that applies specifically to network address translation devices, only to them and nobody else. That idea, I'm going to clear my ink. That idea is, where is that, here. This idea applies only to NAT devices. By the way, this is a security feature and it is enabled, it is marked as true. The idea is to check source and destination. There's a check for that for every machine that is running in Amazon Cloud, and that check has to be met. That's the design from Amazon's perspective. What we are really trying to do is to create a design that actually breaks the rules. The rule needs to be broken, which means we need to understand how NAT actually behaves. The bottom line is I need to make it false, and I'll tell you why I need to make it false. Because in short, one sentence, I want my NAT to pretend to be me. That's the way to say it. I want my NAT to actually lie and tell other people that NAT is my iMac. That's what I would like my router to do, is when I visit cnn.com or whatever website I go, I want my router to blatantly lie to CNN that iMac is visiting you. That's the lie that a router is supposed to do. By design, the technical word for this lying business is called masquerade. I hope the spelling is right. That masquerade is the name of the technology that what NAT does. It just blatantly lies to everybody that Nilesh McIntosh is coming to see you. When I open a browser and say cnn.com, whatever.com, I open a new tab and say cnn.com, it pops up something. CNN thinks that the McIntosh is coming to connect to it. No, it is not. No, it is not. My router is blatantly lying, telling, hey, it's the Mac, but it is not. It needs to lie like that. The idea of the lying business is actually defined in the word masquerade in Wikipedia. You can see it. There should also be a reference in my videos a little bit, not too much, but I'll describe for that, masquerade, masquerade, and so masquerade is, so that is not the right way to search, so masquerade in NAT, and I think this is the right answer, first think. There it is. Here you can find what is masquerading, and we can read it. Allows a set of machines to invisibly access the internet via the mask gateway. That's one way to think of. The other way is IP masquerade feature allows other internal computers to connect to the Linux box to reach to the internet as well. Couple of other variations to this description, by the way, this is the TLDP website, which is a reasonably decent website for conceptual understanding of Linux concepts. This is what you could read if you like, and there are more ways to read this idea of masquerading, but I think the simplest way to understand is flow of traffic from your laptop to a website. Let's go see that. I will now switch to a white sheet and discuss this bit of masquerading a little bit. In masquerading, what's going on? You have, say, iPad and Macintosh, two machines. You have a router here, and you have cnn.com, and a cloud genius website, so cloud genius website. I cannot even write cloud genius here, so two websites, two devices, and they're connected internally. This is connected to the world outside, to a gateway, and this is public internet. Now, when I open a browser here on the iPad, and I say, hey, go to CNN. What this iPad will do is go request, hello, router. Can you please send my request over to CNN and lie to them that I am the iPad? Router will say, yeah, let me lie for you. Router will take that traffic and go to CNN and say, hey, the iPad is here. I'm the iPad. CNN says, oh, you, iPad. Take it. Take my response, and it will reach here. Now, at this point, the router needs to know where the traffic originated from. It came from here, so it needs to know that this incoming traffic is destined for this iPad, so it goes and shows you CNN here. At the same time, on this machine, another person opens a browser and says, I need to go to the Cloud Genie website, so it tries to connect. The only route is through the router, and so the router knows that it's a router. It's an act. It needs to lie. It needs to masquerade and pretend to be the iMac to the Cloud Genie website, so it goes, and Cloud Genie website responds. It thinks that the iMac is here, and so the response comes back. This was a request for a page. This is a response to the page request, and the response reaches here. The router then decides, oh, who requested this packet? Oh, you. Here you go. You have the packet. That's the internal business. From outside perspective, these guys don't know that it is not the iPad or the iMac that is actually talking, but the router is cheating, lying blatantly. That's the translation role of the function called network address translation. That is what is going on under the hood here in any router. That's what routers do. What it means is that the source of traffic and the destination of traffic are different. See the source of traffic that reaches CNN and comes back, it pretends to be something else to this guy, but the source doesn't actually match the destination. The source of traffic is originating from here, the request originates, and the destination goes somewhere else. It is not destined for this machine. This iPad request for CNN is not destined for this box. Only for this box, we have to break this rule of source destination check. You have to say false, please don't check because I'm going to actually want to lie and masquerade traffic so that my router functions like a router. And therefore, I need to make sure that this entry, where is that? Here this entry, source destination check, which is currently true. I need to make it false. I will do that. How do you do that? You go right click on the NAT device and say instance for the networking and then change source destination check. It says source destination check. I want to disable. So I disabled it. Now I have it disabled. This is the only time when it is actually a good idea to disable source destination check. Only when you are deliberately setting up a NAT. Now that I have set up a NAT, I will call it a NAT. That's my NAT machine. So now I have NAT machine functioning, my source destination check adjusted, my traffic permissions are in the NAT security group, which are allowing me inbound permissions only and only me, only SSH from port 22 from my IP address, just me, just from this location goes out. That's the permission structure. We'll go back to our NAT machine and you will see that you can actually see these rules right here on this page itself by clicking on the inbound rules. It tells you that only that particular rule is allowed. Everything else rejected. Outbound rules, let's go look. Everything is okay. 0, 0, 0, 0, 0, allowed. All traffic, all ports, go outside, do whatever you want. Incoming only me, only from my location, only port number 22. Only then I can come in using my private key, no other access. That's the limitation. That's how you set up a NAT. You can do this whole thing very, very easily by just not using all this, but using a readymade NAT gateway, which is a whole lot easier solution, but it doesn't help you understand a thing. That's why I don't go that route. I hope you understand why I don't go that route because it doesn't make sense to me. It makes sense, but I don't want to make you understand. That's the point. Go back to our VPC. In our VPC, we have two of them. We'll go to the Cloud Genius VPC and here we'll look. What do we find? That we have route tables that are associated with our Cloud Genius VPC. The ignore is ignored. The public is all fully configured because we have our routes already all the way to the internet, but when we look at our private route table, our routes are limited. I would like my new laptop that I bought in my home to be able to connect to the internet, even though it is currently sitting right in my private area. Public area is connected to a gateway and all is good. It goes to the internet. This laptop that I got is not connected to anywhere, so I would like to have a router here and the router is connected to the gateway and so it is all accessible to the world outside. This is me in my real home. This is by the way a VPC. I am outside the VPC in my actual home and from here I want to go from here and connect to the router. Port number 22 SSH, that is only permitted just for me, nobody else. I need to come from my home. I cannot go to my Starbucks and try to connect. It will fail. It has to be from this location, only then it will work. Any other location reject. That's the rule, the security group rule. With that understood, I would like to have this laptop get connected to the internet. Route table associated with this guy doesn't have a route like this yet. I need to have a route for that so it knows how to go to connect to the internet and update itself. It needs to go to the internet, but I don't want it to connect directly to the gateway. No. I want it to go connect through the router I have. I have this router called Amazon net, whatever that longish name that we have, that net. That's what I want to use and I want to route through the router and then go out. I want this router to actually masquerade for me. Here we go. I want to edit my private route table. Subnet association is already okay. It is mapping the private subnet, but my route table private does not yet have a route that goes to the 0000 slash zero destination. I will edit my routes and then add a route to the internet like that and connect. How do I connect? There are a variety of choices, we'll see all of them and choose the one we want. We'll first see egress only gateway. That's okay idea. It'll work, but we are not using it. We can choose an internet gateway. That's a bad idea. It's going to publicly expose our internal things, internal private subnet machines. That's a bad idea. We can go the easy route and use an ad gateway and that will set up an ad gateway for us and that's a good way, but it doesn't help us with understanding, so we're not using that. We have a network interface we can connect it to. We can get a peering connection. We have a transit gateway and there are a bunch of other choices, virtual private gateway. We have a variety of ways to connect them, but we have set up a NAT already using an instance. That's what I want to actually use, use my NAT. Which one? This one. Doing it again. I'm erasing this, doing it again just to understand that I'm going to use an instance and then select the NAT. So here we go and then save. Once I have saved it, I'll go examine my route and my routes show that I can go anywhere on the internet using my router. This is not your gateway. You can compare how the gateway looks in the public side, public subnet, public route table. The gateway is called IGW. In the private side, the gateway is not the gateway, it is a NAT device with an ENI interface, the network adapter interface for that NAT device that we just established on EC2 here, that machine. That's what we have it hooked up to. You can see that it shows up in our VPC, in the Cloud Genius VPC, in our route table. Private route is now available. That was the most difficult part of this exercise. Now that we have this routing correctly configured, what I would like to now do is we have established a connectivity like that through to the gateway so laptop can update. But now let us put an actual machine right there. We don't have any machines in our cloud for real yet, so let's create one, put it right here and let's see if it can actually update itself. We'll see that, can it update? That's the experimentation that we'll create a box here and see if it updates. Let's go check. We create one box right here in the private subnet and let's do that. So go back to the Amazon console, go to EC2, create an instance. And here we'll select say Ubuntu 16.04. That's my current favorite choice, 16.04. And we select. We select E2 Micro. And then we select the VPC, Cloud Genius. Then let me set this to a DND was set already. Yeah, it was Do Not Disturb. How come the phone comes in, I mean, come on. This is buggy. It was Do Not Disturb already. Still it rings. It's crazy. So VPC, Cloud Genius, then Subnet Selection, I would like this machine that I'm going to create right now, Ubuntu machine. I would like this to go to the private location like here, private. So not public, private. So it goes to private area. Next I would like to look at this idea carefully, auto assign public IP. Do I want a public IP for this machine? Absolutely not. Disable. That's the right answer. To be explicitly clear about it, I can drop down and say disable. That's also okay. You can do either way. It's not a big deal. But make sure that you don't get a public IP. You don't want it. Do not want a public IP. Having said the rest of the ideas, not important right now. So we'll move forward and add some storage. It is GP2 SSD. That's good. Add some tags. Tags can be skipped. Add security group. That's important. And so we'll not choose an existing security group because that's not what I do. I don't choose the default and that doesn't make sense. So create one. Create one that I will call applications in the private area or just call it whatever I want. So apps. And in that, I'll also go very narrow to begin with and allow only SSH access as long as it is coming from. And I'll let you answer. What should I select here? What's the right way to think? What should be the selection for source? See I don't have a public IP address. We have two subnets, public, private. We have a router here that has a public IP. We have a machine that we are going to create that doesn't have a public IP. So from a security group standpoint, what should be the source of traffic for accessing this machine? I want to access that machine first. I'm outside, not in the cloud. I want to go in there. I don't have a public IP. So I don't even know how to connect to it. And so we'll show you with live examples, but just want to understand that the source, what should I select here? What's the right approach to thinking about it? Who should be able to take the car to that destination? Yes I want to go. How will I go? The only route available is this. There's no other gate to go. There's only a gateway. And I can go only through this endpoint that I have it open currently public IP available. That's the only gateway for me to go in, but I want to go here. So how do I go? And what do I put in here? Into your VPC? Yeah, you can put VPC. You have entire VPC allow anybody to come in or you can further narrow it down and say, you know what, come in only from here. So narrow is better than wide. And so you can say that, you know what, if you're coming from the router, welcome. That's a way to think. You can of course put in whatever you like. It's not critical because it is already inside so you can put a 0000. That's also okay. Nobody can actually reach that location, but my way of description is I will say custom and instead of filling in a 0000, what I will do is actually type in a security group name for NAT. And so I'll select NAT security group as the license, I should say, as the collection of machines that belong to the NAT security group are allowed to connect to this machine. So I'll select NAT as my custom connection, custom source. So people can come in only if they are coming through the NAT route and then save. I will of course later on modify these permissions structures because everything as we try to update that machine, it will fail. And so we'll then open up security group permissions for us to understand what's going on. But for right now, I'm going very, very narrow and only allowing inbound connections coming from the NAT to the machine that I'm creating right now and only me from my home coming in like this. That's the limitation that I am set. So it's very, very narrow. It doesn't actually allow this machine to go do anything outside because the arrows are inbound only. It doesn't let even this box to update itself. It will still fail because the permissions are not in place. The license, you don't have a license to go. So we are preparing this machine and getting ready for it to fail and update. And then we'll slowly expand our security group structure to help us visualize what makes it work. We have a road, but we don't have license to drive yet. I'm deliberately limiting myself right now. So with that understanding, I will review and launch and click the launch button, select my key and acknowledge. I still doubtful about the key here, but we'll check. I think it might work. So not a problem. Otherwise, we'll do the whole thing again quickly. So NileshKeyPair launch an instance, so it launches the instance, the new machine is getting launched inside in the private area. It is currently pending and it doesn't have a public IP missing. Only has a private IP in the private subnet 10 0 1 dot whatever and the whatever value happens to be 95. This one indicates it's a private IP, private subnet in the private IP. In the private subnet, that's what this one indicates. So it is now running and I need to be able to go there. So now, okay, I think I made a mistake, but I'll tell you how will I work around with that mistake. So I think I need the mistake is that I should have used the virtual machine, not my local machine, my iMac to do this exercise, but I had to go transport a key from my real computer to the virtual computer. I will do the transportation right now. So you can watch me do it. It's not going to be visible to you, but I'll still show you. So clearing my ink, the mistake, I'll describe what mistake I did, is that I want this exercise to be able to be able to, for you to be able to do it. I would like to demonstrate that inside the VM and I did not do that. I should not do it this way, but I should actually create a virtual machine and then create a key pair inside the VM so that you don't get stuck when you're doing the exercises. For right now, what I need to do to correct my mistake is to take my actual key from the iMac and copy it over to this machine and then my mistake will fix. That's what I'm doing right now. So you will see me copy my keys from one machine to the other with a command line. Okay, my key is now available to me right here. I will move that key into my.ssh folder. So this trickery that I did is primarily to allow me to get my key from the real machine onto the virtual machine with a command line and now my key is available in my.ssh folder. You can see the listing of the key, but you cannot actually see the key itself. That's the private key that I want to use and I will add that key. So this next command is also another command line trickery. I'll talk about it later, but let me just run it. I will talk about this command line trickery later and I'll also do some cleanup in this folder to help us understand it very clearly that I want to delete the known host file and then we are inspecting our.ssh folder. It contains only two files. Those two files are config example. So just leave it alone, don't delete that by mistake. If you delete it, no worries. I'll give it to you again and this Nilesh is my key pair that I imported from the iMac. So I fixed my mistake. Having seen this setup ready, I put them on one half of the screen, this one on the other half and now I will attempt to first connect to the NAT, but this will be called my laptop, the other box. I always call it my laptop sitting in my private area, private submit in the cloud. It's not my laptop, but the same. So that's the NAT. That's the laptop. So I'll connect to the NAT machine first. To connect to the NAT machine, I have a public IP. I can copy it and just go there. So how do I go there? I'll say SSH and then username and then add symbol and then the IP address like this and then it should connect, but then I don't know the username. So what do I do? I go find out what operating system is this. This is Amazon AMI, this one. So AMI ID, I find it. I know about this machine and since I already have read the documentation, I know that the username for this machine is EC2-user. That's the machine username. This is through practice and also reading documentation you can find. What's the username for Amazon NAT? That is the answer. So with that username at the IP address of the NAT box here that I copied and pasted there, I should be able to connect successfully because my security group allows. You can see that and I have my key pair in my hand now in the virtual machine. My key pair is with me, IDRSA. I have renamed it as Nivesh, but that's not a problem. Just the name of the file. So with that in hand, so I have my license to drive, I have a road to go, I can go. So I will reach my NAT. So I will say, let's go. It says, are you sure? And I'll say, yes. So it connects and I'm now connected to the Linux Amazon AMI, which is my NAT box. Awesome. I come out of it. Now how do I get to the other box? I called it my laptop, but it is not a laptop as you already know. There is no public IP at all. So how do I even go there? So if I type something like, by the way, this is a Ubuntu box, this is Ubuntu, this one. And the inbound rules are, yeah, you can come in. So how do I then go here, SSH. And I know the Ubuntu is the username for Ubuntu boxes, Ubuntu, then add symbol. And then what? Private IP here, like that? No, this doesn't go. This will be routed to something in my home. That's my home range. So it will not route correctly to this box here. Let's call it machine instead of laptop. So yeah, that machine. It will not connect to that machine because it is not routable. There is no road to go there. So how do I go? What do I do? Tell me. So we have a machine here. We have a router here, and I'm here. And I'm connected here and I succeeded. Now I have the private IP here, and I have my key pair and all that good stuff, but there's no road, road not found. So what do I do? How do I go there? So I want to update that box, the machine box. What do I do? Anybody? It's a trick question. So it's okay to not answer. Let me show you. So the bad way is like this. You know that we have modified our security group here and it allows connections from the NAT security group, meaning it allows connections. If you're sitting here, you can come in, but I'm here. So the bad way is to log in here first, take my private key, copy it here, and then make another SSH connection and that will work because this is routable anywhere within the VPC 10, 0, 0, 0, 16 local connection, routable already. That will work. But then why do I call it bad way of doing things? Maybe that answer is you can guess. It is bad because my private key is outside my control. It is away from me somewhere on this box. I don't want that to happen. I already told you, private key should remain private. So this is my private key. I actually shouldn't even have copied to this box, but that's okay. I'm just being very, very particular about my private key right now, but this is also my box. It's okay. It's in my control. So it's no big deal. Yeah. Don't move your private key out to another box. That's not a good idea. Don't share it. Don't give it to a cloud machine. That's what I'm saying is that this method of one and then use the private key again from here to go will work because of the security group allows you to connect from the NAT to the machine. NAT being the source, port number 22 SSH protocol will allow connections to any application machines, which happens to be this app security group. So it will allow that, but the problem is I'm exposing my private key unnecessarily. So I do not want to do that. So then I am in a soup in a sense. So what I need to do is clear my drawings again and ask you another way, or I'll just tell you about a capability in SSH protocol that allows you to handshake with a specific command called SSH proxy command without actually transmitting your secure private key, which happens to be this name for me. It may be a different name for you. It will be in your laptop, in your workstation, and you don't want to copy it over to the router, but you still want to connect to the machine. So you want to have a way called the proxy command method to get to this box without actually copying your key over to that box. That's what I will now show you. So erasing my ink for that proxy command method to work. We need to not use this instruction right away, but instead break it. Go back to the dot SSH folder. Look at what we have in there. We have a file called known host, which you can temporarily delete again just to cut confusion. So now we don't have that file anymore. Now we have only two files, the private key, which is going to be IDRSA for you, and this example file. Let us look at that example file because it actually tells you how to invoke SSH proxy command and do a one hop jump from the NAT to the machine in one command and go straight through and through without having to copy your private key. So let's go look. So what I will do to do is for that to activate, I need to rename that file to just config. No dot example. And delete the dot example. That's one way to handle. The other way to do is just copy the config example to a file called config. That's another way. So here we now have a file called config. That's automatically now available to SSH protocol. That is the SSH protocol configuration. This is an example that I provided to you, and this is a copy of the example. This is the one that will be used, not this. This is more like an example for you to read. So ignore this now. Don't delete it. Ignore it. Use this. Now I want to now open this file. So we'll see it. And you see some things here. What do you see? You see that there is a specific reference to a device called that. It has an IP address that needs to be edited. It needs to be matching with the actual IP address we have for real, which is this. So that number should be copied over in this location. Next we have a forwarding agent. We say yes to it. What we are really doing is taking our identity file from this location. It is called ID underscore RSA for you. I need to rename that to Nilesh. And then that identity file will be forwarded to the next hop. In the next hop, we are using a host, the destination we want to actually go, which is the other machine, which is this one, the 10.01.95 as opposed to this 92, which is the old example. I need to rename that. I need to look at this proxy command that I was talking about. And this is how you actually forward the agent from your computer through agent forwarding and running a proxy command SSH and hopping it through the NAT to the 95 machine. Again, using agent forwarding, using the appropriate key. And our username to connect to this machine, the NAT machine is ec2-user. And our username to connect to the Ubuntu machine is ubuntu-user. That's what you see here. So I need to edit this file accordingly. I will use a tool called atom. I think that's what I would recommend that you use. So just say atom and dot. It will open up atom editor. You can edit that file comfortably. But since atom will expose the files inside my folder, and I do not want to expose my private key, I will not use atom. I will use something called vi, which you don't have to use, but I'm just using it because I want to modify it. So I'm using vi to edit host name, and that IP address needs to go. I need to delete that, so I'll delete. And then I'll add the correct IP address for the NAT box, which happens to be this. So I copy it and then save. Now I have the IP address saved there. Next I will change my identity file name to match my actual file. I will keep the EC2 user. That's the name of the user on the NAT machine. Next I need to change this number 92 to match my machine IP address, the internal IP address there, 95. I will change this 92 to 95. I will do that, like that. And I will like to also change the identity file here. And then I'm done making changes to the configuration. As you will notice, I needed to change my IP address for the NAT box. I need to change the IP address for the host machine I want to connect to, which is the second machine that I have. And from your point of view, you don't need to change it to Nilesh and Nilesh here because that is not applicable to you. With that change is made, I will now save. So now I have my new configuration already available. I can cat it to see it. I see it and it is ready. Let's go see my file structure again. You see that I do not have a known host file at all. So I will now attempt to connect to my NAT box. And now that I have SSH configuration, I don't even need to type its IP address. I can just say NAT. I don't even need to copy this. Don't need to provide the username either. I can just say SSH NAT because the NAT word is known to the SSH configuration. It knows the name as this IP address and this username and uses the identity file. So it just connects like that. It says, are you sure? And I'll say yes. And so when I say yes, it connects. So I'm connected to the Amazon Linux AMI. This is the NAT box. I quit, come back. And then I cat my configuration again. Now if I want to go to this machine, what do I do? I know the username already specified. And this time, if I say SSH, and I think I made another mistake. So the mistake I made was in a part of a demonstration to you where I modified my settings of this machine to go directly connected to my home box, which means this IP address, if I try to go directly to, it will go attempt in my home router and fail. If I try it like this, it doesn't know where to go. It thinks it is in my home. So I need to go reboot my box by setting up the NAT routing correctly, otherwise it will fail. Let me just try it before. It may not fail. Let's go experiment. It might fail though. So I'll experiment. And so I'll say yes. It says, are you sure? And I'll say yes. And it did not fail. Awesome. I have to think as to why it did not fail. I'll come back to you later about why this did not fail. It's good that it didn't, but you remember I changing my NAT to directly connected bridging through a Wi-Fi. That change has taken place, but it still worked out because apparently in my home, there is no such IP address as of this moment. Some machines might start and they might try to get the IP and there's going to be a concrete at some point. So this is not a technically pure clean solution, but it is working right now because there is no such number, 95, allocated to any box in my home. I have many, many machines and many internet of things and a cloud in my garage. So lots of machines come and go and they might get this number allocated and there'll be conflict, potential conflict might happen. Having said, I quit again and now I look at my known host configuration. I find that I have two entries here, one and two. If I delete both these files again, no known host file again, so RM, known host. Now I don't have it anymore. Now I will try to connect to the 95 machine, which is this one. Let's see what happens this time. If I say yes, go, sorry, I say enter. It says, are you sure you want to go what where I typed you 10 0 1 95 and you're trying to go where do you know what's going on? You see when I type 10 0 1 95, it tries to go where here because that's the route that I specified in my configuration. To go to this location, the only way to go there is first here. That's the router, the cloud router. And so I say yes. And then again, the same question, are you sure this is the second hop happening right now SSH proxy command kicking in, taking my authorization from this key, handing it off to the next hop, which is this. The first hop, second hop is the actual machine. Are you sure? And I'll say yes. So it connects and I'm connected to the Ubuntu box and I can see that this is a Ubuntu machine. Ubuntu 16.04, just like I chose. That's the name. But if I try to update this, it will fail. Now do you know why it fails? I think you do. I think you know. So tell me why it's failing. Why is failing not able to connect to Ubuntu.com? Because even though there is a road, you don't have a license. The road exists through a route table that goes through the NAT and then goes to the world outside. But you don't have a license for the application security group, doesn't have permissions to go like this into the NAT zone. And even this security group doesn't have permission to go outside. The only permission I currently have is for me to come and then from here to go here. That's the only set of permissions I have very, very narrowly opened. Having said this, I will now expand my permissions, specifically allowing application security group to connect to the NAT security group, that's one, and then check whether NAT security group can go outside. I think it can. Let's go check. So here is our security group, there it is. So security groups. So we got some. Let's go focus on the one we have of interest. And then look at the NAT security group and look at its outbound capabilities. So you can see that all traffic is allowed with all protocol, all port ranges to go anywhere on the internet. As long as you are in the NAT security group, you're okay to go. But for the NAT security group for inbound permissions, who can come into NAT? So into NAT, can this guys in the app security group, can they come into the NAT? No. Can I come into the NAT? Yes. But not these guys yet. They're not allowed. That's why this traffic is stuck attempting to connect and unable to go forward. It is stuck. So what we'll do is in the NAT security group, we will look at the inbound routes where I'm currently allowing only me from my IP address to connect using port number 22. So I need to expand this to allow certain rules. What do I want to allow? I want to allow my app security group to do whatever they want. All traffic as long as it is coming from the application security group. That should be allowed. These are my boxes. They should be able to go out. So permit that. As soon as I say app, all traffic allowed to come into the NAT and save. Let's see what happens. So you will see that this traffic should start flowing in just a second. In the application security group, outbound access is already permitted. Let's bring this and do it again. There it is. It's working already. So it is flowing. Traffic is flowing just fine. Ubuntu is updating as you can see on the right side and it is permitted to go to anywhere it wants through the NAT because NAT inbound permissions allow all traffic as long as it is coming from application security group, which is, come on, where is that, these, no. Let me get my white sheet. That one, no. That one, I think something is wrong. Let's quit, quit, close. Too many windows open, I guess. Okay. That's there. There it is. Yeah, there it is. So this, what we did is in the NAT security group, we allowed inbound access as long as you're coming from this security group, all traffic allowed. And this guy in the NAT security group already has the permission to do whatever they want to do, wherever they want to go, they're okay to go, but inbound was limited only to me. So now we opened up for these guys, which is this group. And so now it can update itself. So that's the scenario. Now let us see a couple of other interesting observations, which is, where did that go? The Amazon window here. So now our dashboard has two machines running. One of them is a NAT machine. The other one is a T2 micro machine in the internal subject. So now I'll tell you a couple of best practices. So how you should handle these things. So the first best practice is to not mess around with your NAT. What does that mean? It means don't go there. Don't touch it. But I did the not so best way just to help us simply get to this point, to help you understand what's going on, to help you understand the concepts. But having done this, what I will now do is to tell you to don't mess with the NAT. NAT is a critical piece of equipment. You don't want to be able to SSH-ing into a NAT to see what's going on. You can, and yes, you have the right and authority and it's your cloud. You can do whatever you want, but don't. The idea is to not mess with NAT. So then having said that, to not mess with NAT. So I have a NAT and I have a machine and you told me to not mess with it. So what do I do now? Sorry. This is public, that is private, and you just told me, you know, to keep out, a kapu. Don't touch it. So how do I now do my business? I mean, I want to go there, I want to run my applications and do whatever I want. But then you said, don't go. So how do I solve it? What do you think? I told you don't mess with the NAT because NAT is a critical piece of equipment that allows traffic to flow like this and other things depend on it and the whole internet system for your internal resources within your private cloud depends on the NAT. So don't mess with it, kapu, which is a Hawaiian word for stay away. And so how do you go here? What's the solution? Very simple solution. It's a very simple solution. Just think and tell me, what would that be? The solution is like this, put another box here, call it jump box and use to jump from here to there. That's it. That's the solution. It's kind of trivially simple idea to not mess with it, your NAT, just leave it alone. Use the jump box to go do whatever you want, to go here, through the inside, there is a chat request. Let's go see that chat. The chat is easy, yes, it is easy. And so just a separate box, you don't mess with the NAT, it is a critical piece of equipment. And by the way, using this way has another advantage. The advantage is, first of all, that you can, what you can do is like this NAT permissions, you have a permission to go like directly like that, you prevent yourself. You know what? Even you are not allowed to go mess with it. So don't mess with the NAT, don't mess with it. Only you can do is you go and go into the jump box. So that's allowed and you can go to whatever you want to do from inside, not from the outside. So no access for you from the outside. You can go as long as you're inside the VPC, through the jump box, you go here, go here, go here. But again, don't go here. There's no point in messing with things. Once you set it up, just don't touch it unless you need to, in which case it's okay. But then go from here. So that's a classic method of using a stepping stone, jumping box, jump box, call it whatever you like is a method that is recommended to keep this isolated separate. And the good part about this jump box is when you have such a thing, when you need it, you create it, you use it to jump, to do whatever you want. And when you're done doing your business, you delete the jump box. And so when you delete the jump box, what happens? Well, nobody can go. That's what you want. That's what you get. Nobody can go. And when you want to go again for some repair fix, you can just jump box, create one more and then go. That's the idea. When you don't need it, delete it. So even you cannot go. Nobody can go. It's already secure by definition. There's no route. So what about hacking? Not possible. I mean, how do you go? There's no route. You cannot go like this. You can go only from within, but you need to be inside where you don't even have a box when you delete it. So it's gone. That's the idea. It's a very simple thing to execute and implement. So now homework. And I know, I know. So as I said already, homework is not something that is forced on you, but it is something that you want to do. So if you want to do this, what I would like to see is a setup in which you succeed. And I'll trust your word. You know, all I'm really expecting is to tell me that you succeeded and I'll tell you in what. I'll describe that. I want you to say, yes, I succeeded in making my traffic low like the picture I'm going to draw for you right now. I would like you to tell me that I created a public private subnet that I was able to connect through a jump box into the machine. And I updated it successfully. And then I deleted this box. And now I don't have a way to get there. And it worked. Okay. That's what I want to hear. Yes, I did the exercise and I trust your word for it. So that's the exercise. So now if you have a question, go ahead and ask about the homework. The homework answer is very simple. The only you're to tell me is yes, I did this and I succeeded or doesn't the dozen odd videos that you had wanted us to read before this, we need to build. We need to build all of that before we can get anywhere near to the next stage, which is to create the jump box, connect through the jump box and so on. Correct. Yeah. The videos, the 13 videos that you saw, I already covered it today. So there is nothing new in the 13 videos anymore. Does it discuss the creation of the jump of the jump box? I don't remember that, but that doesn't mean it wasn't there. It is not there, but it is kind of pointless to have that because it is not different than that. The only only thing that is different is that you will be using a different OS, which is your choice. You can use the Ubuntu jump box and use the Ubuntu user as opposed to EC2-user. That's the difference, but there is actually no other difference. Just like this box, you will create this box. It will have some security group constraints that will allow you to connect like this. It will have security group constraints to allow you to go here and here. It will have security group constraints to allow traffic from here to go here and from here to go here, but no traffic coming in like this, none. That's the only difference is that you create a new box here. It's a variation that you have to explore and do on your own. Just like I did here for NAT, you will create a different box like this and connect. Everything else is same. The config example will change a little bit. How will it change? It will not use the EC2-user, but it will use the Ubuntu box if you decide to use Ubuntu OS here. If you use some other OS, you have to read the documentation for the OS to find out the user and then use that. If you just use the NAT machine and other machine here, that will also work by the way. That will be an easier option, but you're not actually using the NAT like a NAT. We're just using NAT like a machine, which is fine. That also works as a Jumbbox. Does that help you understand that the 13 videos now are useless? They're not useful anymore at all for you because it is redundant. I already covered all of it with the exception of this Jumbbox, but I can do that right now in two minutes. Here we go. Here you go how you do this Jumbbox thing. You want to launch another machine and I will use an Ubuntu machine, so I'll do 16.04, select and launch configuration. I want to choose my VPC as CloudGenius and I want to put this on the public subnet like that and I would like to get an IP address enabled because I want to connect to the Jumbbox. This is going to be my Jumbbox, so CloudGenius VPC, public IP, public address, subnet, public address enabled, those settings are critical. Then I will go add some storage, 8 GB is good enough. Add some tags. I'm skipping tags. Add configure security group. Another security group here this time, I'll create one, call it Jumbbox and then allow some rules. The rules I want to allow is just me from my location for right now to begin with, very, very narrow permission structure, review and launch and I launch and I pass my key pair selection and I acknowledge and I launch. Then I am creating the machine, the Jumbbox is now getting ready, which will happen soon. Now having done that, I will prevent my NAT access for me to go to the NAT directly. I'll modify my NAT security group. This is just a security method. I'm limiting myself. So I'm editing and removing the SSH rule, so here we go, delete and save. So now I cannot access my own NAT and you can test it here and here. You can see that if I say SSH NAT, it fails and oh sorry, break that, that's wrong. You can see that SSH NAT, it fails because there is no route, it will not flow. Nothing will happen now because I broke the security group right now. Having said this piece, let's go configure the security group for my Jumbbox. Jumbbox allows me to go. That's good. So I'll go look at my Jumbbox, look at here, the running instances, is it running? Let's give it a name, Jumbbox and then here is the IP address. So I grab the IP address copied and I don't need to bother about source destination checks because this is not actually a NAT, just a Jumbbox. So I'll go back here. See it is still stuck and I want it to stuck, so I break. I edit my configuration and here I will modify the name NAT, call it Jumbbox as my beginning point and then I'll assign the host name, put the new IP address right here. And delete the old number. This is the new IP address for the Jumbbox. I'll confirm and match it here. It does matches. It matches nicely. Okay. Next, this username is Ubuntu now because the OS is Ubuntu, so I'll go to modify that. Now the host machine is still the same. No other change here. I change to Jumbbox, I change it to Ubuntu user for the machine OS is different. The user is different. Then I save my config. Now I will wait for the Jumbbox to be ready, which I think it is at least initializing status checks that's happening, but it should respond. So I'll say SSH and then Jumbbox and here it goes, connects, connected, awesome, quit. Now I want to go inside into the O95 machine, whatever that machine IP address is at config, that address is this one. So here I go copy and SSH IP address and boom, it goes straight in one hop through the Jumbbox inside to the, and it is not, it is not, it is stuck because my security groups are still not permitting the Jumbbox to go to the app security group. So you have to go look at security groups again, carefully look at the app security group and this is probably a little bit of rushing, so I'm not going to rush, I'll slow down here app security group. Look at the inbound permissions. It allows only when it connects coming from the NAT, coming only from the NAT sources. It doesn't allow coming in from Jumbbox trying to modify this and it will say, you know what, your custom is wrong. So delete that, allow it to come from app, oh sorry, allow it to come from Jumbbox and then save and then it will allow. So I'll go back here and say, try again, hold on I think it didn't save, check, check the settings again, Jumbbox setting shows up, application allows connection from Jumbbox. Let's also check the Jumbbox security settings. It allows me to connect, outbound access are open, application access is, outbound is open, inbound is through Jumbbox, it should work, let's go check and it is not. It may be because of the problem that I think I have in my home network is clashing with this IP address which I think I already alerted to you about, so that is unique. I told you, I cautioned you that this might happen and it seemed to have happened. It did work, but now it is not and that is a configuration of my machine IP address ranges conflicting with the private ranges in the cloud for me. So in your case, most of your homes are probably not going to be running in the 10 dot address space, but 192 address space, so you will not even have this problem. But if you run into a problem, ping me, I'll fix it, we'll figure it out. This I need to reboot and do a bunch of setting configuration changes for me to move my private subnet to a different IP address range, not 10, 0, 1, X. That is the conflict that's happening. Yeah, that is the reason why it is not moving forward. It does connect to the jump box directly, just like that, but not going through and through inside, which is the reason we already understand. Let's go modify one more time. One more check, RM known host and tried one last time. So SSH to this machine. Is my IP address wrong or what? I think I can go debugging this, but we crossed seven minutes over. So don't want to keep you on hold. I have this portion recorded. If you understand this, please do it. And the actual action of delivery of homework is very simple. I just want to hear from you that you succeeded in making the traffic go like this, making the machine update and you have a jump box to go in. You have a NAT in place and that you were able to configure it like this for yourself, for understanding. That's the goal. The homework action is very simple. Just tell me that you did and then you're done. That's it. Any questions? No questions. So I'm stopping recording. I'm still here.