AssociateFree account25 min
INC-1088 Lab 02: The Hardened Subnet That Broke Everything
Reporting service cannot reach the database after a NACL hardening change
NACL / Security GroupsAWS VPC
Cloud networking, at packet level
Master cloud networking by fixing real-world production outages.
Reading about VPC routing does not build intuition. Debugging a broken one does. Every lab hands you a Terraform file that deploys a genuinely broken environment and an incident ticket — no hints, no answer key until you ask for it.
- Diagnostic labs
- 22
- Learning tracks
- 5
- Guides
- 9
Trace a real failure — the outage behind Lab 01:
packet-trace10.0.11.34:49820 → 52.94.236.248:443
- EC2Batch instance10.0.11.34 · subnet-private-a
- SGSecurity group egresssg-app · allow 0.0.0.0/0
- NACLNetwork ACLdefault · allow all
- RTBPrivate route table0.0.0.0/0 → nat-0f8e
- NATNAT Gatewaynat-0f8e · state: available
- RTBNAT Gateway's own subnet route0.0.0.0/0 → itself (no IGW route)
- DESTapi.processor.example52.94.236.248:443
Run the trace to see where the packet dies.
Lab of the weekOpenAssociate~20 min
INC-1043
Lab 01: The Misplaced NAT Gateway
A batch job in a private subnet cannot reach a third-party API. The route table looks correct, the security groups are wide open, and the NAT Gateway reports Available. Find out why every outbound connection still hangs.
AWS VPCNAT Gateway
Open the ticketReported symptom
Outbound API calls from the private subnet time out after deploying the new VPC
Reported by Payments Platform
More labs
All labs →ProfessionalFree account30 min
INC-1142 Lab 03: The Spoke That Could Not Be Answered
Newly onboarded spoke VPC cannot reach shared services; the existing spoke works
Transit GatewayAWS VPC
SpecialtyFree account30 min
INC-1207 Lab 04: The Endpoint That Answered To Nobody
Application cannot reach the vendor API through its new PrivateLink endpoint
PrivateLinkNACL / Security GroupsAWS VPC
Learning tracks
Full roadmap →VPC Core & Subnet Topology
2 guidesAddress planning, subnet tiering, route table scoping, and the boundary rules that decide whether a packet ever leaves the VPC.
Ingress Architecture & Load Balancing
3 guidesWhat a target actually sees as the source address, how health checks decide which zones receive traffic, and the defaults that silently change both.
Egress Architecture & Cost Optimization
1 guideNAT Gateway placement, per-AZ data processing charges, gateway versus interface endpoints, and where egress spend actually accrues.
Traffic Inspection & Transit Gateway Routing
1 guideCentralized inspection topologies, appliance mode, route table associations, and propagation across attachments.
Hybrid Connectivity
2 guidesDirect Connect, Site-to-Site VPN, and the BGP attributes that control which path your traffic actually takes on the way back.
Latest deep dives
All posts →The one network limit that does not grow when you scale up
Every instance can send 1,024 packets per second to the VPC resolver, per network interface, and the number is the same on a t3.nano and a u-24tb1.metal. Throttled queries never reach anything that logs, so the symptom is intermittent DNS failure with no evidence anywhere — and scaling up, the instinctive fix, changes nothing.
Networking5 minYour 25 Gbps instance does 5 Gbps to the internet, and that is documented
EC2 instance bandwidth is one number on the spec sheet and at least three in practice. Traffic through an internet gateway is capped at 5 Gbps on anything under 32 vCPUs, and a single flow is capped at 5 Gbps nearly everywhere. Neither is a fault, and both get filed as one.
Networking6 minTen kinds of traffic VPC Flow Logs never record
A flow log with no REJECT lines is routinely read as proof that nothing was blocked. AWS documents ten categories of traffic that flow logs exclude by design, and several of them are precisely the traffic you would be looking for when something is wrong.
Networking6 minA regional NAT Gateway makes the most common NAT mistake impossible to express
The zonal NAT Gateway has a placement rule, a per-AZ route table requirement, and a single-zone dependency, and each one is a documented outage. Regional mode does not fix those bugs. It removes the configuration they live in.
Networking7 min