Cloud Infrastructure · Cluster
Cloud Networking
VPCs, load balancing, and private links.
- 01 VPC Address Space, Subnets, and the Implicit Router How a CIDR block becomes an isolated forwarding domain, where the router joining its subnets actually runs, and why several addresses in every subnet are never usable.
- 02 Route Table Precedence and the Local Route Why a VPC route table has a local entry that cannot be deleted, how longest-prefix match interacts with static and propagated routes, and how a blackhole entry fails silently.
- 03 Security Groups and the Stateful Connection Tracker How an interface-level firewall decides that a returning packet belongs to an existing flow, why there is no rule for replies, and what happens when the tracking table fills.
- 04 Network ACLs and Stateless Filtering at the Subnet Boundary Why an ordered, stateless rule list needs an explicit rule for return traffic, how ephemeral port ranges make that rule hard to write, and where the ACL is evaluated relative to the interface.
- 05 Internet Gateway, NAT, and Source Address Translation How a VPC reaches the public internet without exposing private addresses, why a NAT gateway is one-way, and how the translation table interacts with connection tracking and path MTU discovery.
- 06 Load Balancer Listeners and Target Selection How a listener decides to accept a connection, how a target is chosen from a registered set, and why the balancer terminates the client connection instead of forwarding packets.
- 07 MTU and Fragmentation Across a VPC Boundary Why the usable MTU inside a virtual network is smaller than the physical link MTU, how encapsulation and translation each consume bytes, and what happens when a packet that needs fragmenting is dropped instead.
- 08 Why VPC Peering Is Not Transitive and What a Transit Gateway Adds How a peering connection is a pairwise route exchange rather than a shared fabric, why a hub VPC cannot relay between its peers, and what a transit gateway changes about the routing model.
- 09 Private Endpoint Services and the Reverse-Direction Connection How a service in one VPC becomes reachable from another through an address that lives in the consumer subnet, why the connection is accepted by the provider, and what the endpoint does not hide.
- 10 BGP Sessions and Route Propagation over Hybrid Links How a gateway exchanges prefixes with a customer network over a dedicated link, why the AS path and local preference determine the winner, and how a flapping session poisons a route table.