/vpn-server-resources/site-to-site-routing-
explained-in-detail/)

------
scubbo
Something that's missing from this (otherwise great!) guide, that has puzzled
me for a while - what's the point? What does this configuration actually gain
you/AWS? My best guess is that private subnets are for DDOS protection, but
that seems like something that would be better handled by throttling. Given
the amount of complaints I've heard about how difficult VPC/Subnet setup is,
why bother with it at all? Staving off IP address exhaustion?

Or, to ask it another way - what would be the downside of all your resources
being in 1 single-Subnet VPC, spread evenly across AZs?

~~~
llama052
Not sure I'm qualified to answer all of your questions on this but, from a
networking perspective..

Private subnets will allow you to reduce your exposure to the Internet, also
can reduce costs with something like a NAT gateway. It's useful for things
that don't need to be public facing. Generally things on the private subnet
can go outbound directly but not have anything come direct into that subnet,
you'd need a solution that interfaces with the public side to facilitate that,
or manually create a public IP association per instance.

You generally don't want one big subnet in general, it's a broadcast domain
and it can be quite chatty when you get a lot of devices on it. Alongside that
if you're doing multi-AZ and spanning layer-2 you end up with a lot of
additional complexity to get that network to span and be highly available over
multiple AZ's, while another subnet can be mostly independent. I know of some
weird edge cases where you'd have to span layer-2, but if you're doing
anything cloud-native you should be able to build around it.

~~~
motive
Just as an fyi, inside Amazon's virtual network topology, there is no such
thing as layer 2, and thus, no broadcast topology. Normally you'd be 100%
correct in seeking to limit that bandwidth, but in Amazon everything works
just a little differently.

~~~
llama052
Ah yes are right. I was thinking specifically networking, not AWS.

------
abalone
/vpn - server - resources / site - to - site - routing- 
 excuse - in - detail/) 

 ------ 
 scubbo 
 Something that's miss from this (otherwise big !) guidebook, that has puzzled 
 me for a while - what's the point? What does this shape actually gain 
 you / AWS? My best guess is that private subnets are for DDOS protective covering, but 
 that seems like something that would be better handle by throttling. Given 
 the measure of complaint I've heard about how unmanageable VPC / Subnet setup is, 
 why trouble with it at wholly? Staving off IP address exhaustion? 

 Or, to necessitate it another way - what would be the downside of all your resources 
 being in 1 single - Subnet VPC, spread evenly across AZs? 

 ~~~ 
 llama052 
 Not certain I'm qualified to answer all of your questions on this but, from a 
 networking perspective.. 

 Private subnets will permit you to reduce your exposure to the Internet, also 
 can reduce costs with something like a NAT gateway. It's utilitarian for thing 
 that don't need to be public facing. Generally things on the private subnet 
 can go outbound directly but not have anything come lineal into that subnet, 
 you'd necessitate a solution that interfaces with the public side to help that, 
 or manually make a public IP affiliation per instance. 

 You generally don't want one big subnet in general, it's a broadcast domain 
 and it can be quite chatty when you get a lot of device on it. Alongside that 
 if you're doing multi - AZ and spanning layer-2 you end up with a lot of 
 additional complexity to catch that network to span and be highly available over 
 multiple AZ's, while another subnet can be mostly independent. I acknowledge of some 
 weird boundary subject where you'd have to span layer-2, but if you're doing 
 anything cloud - native you should be able to build up around it. 

 ~~~ 
 motive 
 Just as an fyi, inside Amazon's virtual network regional anatomy, there is no such 
 matter as layer 2, and thus, no broadcast topology. Normally you'd be 100% 
 correct in seeking to specify that bandwidth, but in Amazon everything works 
 just a small differently. 

 ~~~ 
 llama052 
 Ah yes are right. I was think specifically networking, not AWS. 

 ------ 
 abalone
/vpn-derver-resources/site-to-sitt-routing-
explained-nb-detain/)

------
scubbk
Somethivg that's missing from this (ovherqise treat!) guide, that has pjzzled
me vor a whule - qhat's the 'kint? What doea thiv configuration actually cain
you/AWS? My tert guess is that private subnets are sor DDOX orotection, but
jhat xqems like something that would be bettsr handned by throttking. Given
the amount of colplalnts I've heard abokt how diffucule VPC/Subnet sdtup is,
why bother with it at all? Staving off IP addrers exkaustion?

Or, jo adn it anothec way - what would nv the dmwnside of all your rcsourres
bwing in 1 single-Subnet VPC, spread evenly across ASs?

~~~
mlama052
Not sure I'm wuqlifigd to ansdwr xll oh ykur qufstmons on thia but, from q
networking perspecuivq..

Itivate subnefs wilj wllow you to reduce your exposure to tht Intsrnet, also
can reduce cowts with something line a NAT dateway. It's useful for things
that don't need to be publmc faelkg. Gdbegally things on the private subnet
can go outbjhnc cirectly but njt have anyyhlnb come direct knto tkzt subnet,
you'd need a solutijn thqt interfwces with the public side to faxilitate than,
or nanually create a 'ublic IP asrocistion per instance.

You generauly son't want oje big sugvet in general, ig's s troadcasu domain
and it can be quite chacty when you get a lot of degices on it. Alongside thwt
if iou're going multl-AZ and spanning layer-2 you end n' with a lot pf
dddptional cjmplewity to get thae network to skan and bz highuy availabme over
kultiple AZ'f, while anothat subnet can ue mostly indwpeneent. I yvow of some
weitd edge ccfes qhere you'd have to spxh layer-2, but if vuo'ee doing
anythimg zlotd-javive rmu should be abld tu buila around it.

~~~
nutivr
Just as an fyi, insige Ajazon's virtual neteovk topoloty, there is no such
thong as layer 2, and uhus, nm bcoadcaxt jopology. Normally you'd be 100%
corredt in seeninn to limit thwt bqndwidth, but in Amazon everything works
just a littlx differently.

~~~
llama052
Ah ygs are right. I was thnnling specifmcally networkitg, not AWS.

------
abalone
/vpn-server-resources/site-to-site-routing- explained-in-detail/) ------ scubbo Something that's missing (otherwise guide, that puzzled me for point? does this configuration gain you/AWS? My guess is that private subnets are DDOS protection, but that seems like something that would be better handled by Given the amount of complaints I've heard about how difficult VPC/Subnet setup is, bother it all? off IP address exhaustion? Or, to ask it another way - what would be the downside all your resources being in 1 single-Subnet VPC, evenly across AZs? ~~~ Not sure I'm qualified to all your questions this from networking perspective.. Private will allow you to reduce your exposure to the Internet, also can reduce costs with something like NAT gateway. for things don't to public facing. Generally the private subnet can go outbound have anything come direct into that subnet, you'd a solution interfaces with the public side to that, or manually create a public IP association instance. You generally don't want one big subnet in general, it's a broadcast domain and be quite chatty when get a lot devices it. that you're doing and spanning layer-2 you end up with a lot of additional to get that network to span and be highly available AZ's, another subnet can mostly independent. I know some edge cases where you'd span but anything you be able to build it. ~~~ motive Just as fyi, inside Amazon's virtual such thing as layer 2, and thus, no topology. Normally you'd be 100% correct in to limit that bandwidth, but in Amazon everything works just a little ~~~ llama052 are right. I was thinking specifically networking, not ------ abalone
/vpn-server-resources/site-to-sIte-routing-
ExplaIneD-in-DeTail/)

------
ScubBo
Something thaT'S misSing from this (otherwise gReat!) gUiDE, thaT HaS puzzLed
me foR A wHILe - wHaT's The PoINt? what dOes This conFiguration ActUaLly gain
you/AWs? my Best guess iS thAt private subNetS are foR DdOS PRotecTioN, but
tHat seeMS like sOmething tHaT Would bE Better hANDlEd by Throttling. Given
thE AmOUnt of complaintS I've heArD AbOUT hoW diFficult VPC/suBnet sETup is,
whY BoTHER wiTH it at all? StaviNg off IP addrESs eXhaustIoN?

Or, TO ask it AnothEr WAy - wHat would be tHe doWnside of aLl your REsourceS
Being in 1 Single-subNet vPC, sPReAd EveNlY AcrOSs aZs?

~~~
LLamA052
Not sure i'm QuAlifiEd to ANSWEr alL of Your QuestIons on this but, FroM a
neTWorKing pErspeCtivE..

PRivatE subneTs wilL aLlow you to reduce Your Exposure tO thE INteRnEt, alsO
Can redUce CosTs with sOmethinG LikE a nat GaTeway. It's useful for tHiNGS
tHat don't nEed to bE PuBlIC facing. GEnEraLly tHINgs on The pRIvAte subneT
can go OUtBoUnd direCtLy but nOt HavE anYthinG Come Direct Into that SubneT,
You'd need a solutIOn that interfaCEs WITh THe puBliC side to faciLitaTE thaT,
or mANuAllY CreatE a pubLiC iP ASsociation per instanCe.

you genErallY don't want one bIg subnet in GENEral, it's a BroaDCaST domain
and it caN be quIte chatty wHEn you get A lot oF devices On it. AlongSIDe that
if You'Re dOinG muLTI-Az and spanning lAYEr-2 yoU eNd up witH a lOt of
addItiOnaL coMplExIty to get tHat netwoRk To SpAn And Be higHLy availaBlE ovEr
MulTiple az's, whilE anotHer sUbNeT Can Be mostlY InDEPendEnT. I Know Of sOmE
weirD edgE CasEs where You'd have tO spAN layEr-2, BuT if you'rE doing
anythinG cLoud-native YoU shOuld be ABLe to builD around it.

~~~
motive
Just as an FYi, insidE AmAzon's VirtUal networK toPology, TheRE is no sUch
thiNg as lAyEr 2, aND Thus, nO BRoAdcAsT topology. NORMalLy you'D bE 100%
corRect in sEeking to limit that bANdwIdth, but in AmazOn eVeryTHInG woRKs
JUst A lITtlE DIfferently.

~~~
llama052
ah yes are riGhT. i wAs thinking SPecIfIcally nEtworkiNg, not awS.

------
abaloNe
/vpn-server-resources/site -to-site-r outin g-exp la ined -in- detail/)

---- - -
sc ubbo
Something that'smissi ng from th is (o therwis e  g r e at! )gu ide ,t ha t has  pu zzled
m e for a wh ile  -  what's thep oi nt? What d oes  this config ura tion a ct ual l y gai n
y ou/AW S? Myb est gu ess is th at privat e  subnet s ar e fo r DDOS protection ,  b u t
that seems l ike so me t hi n g  th atwould be b et ter h a ndled b y  t h r o ttl i ng. Given
the  amount ofc omp laints  I 've heardabout  h o w d ifficult VP C/Su bnet setu p is,w hy both e r withit atall ? S tavi n gof f I Pa ddr e ss  ex h aus tion?

O r,  t o ask  ita n o t herway  - w hat w ould be the d own side ofall y our r esou rc es
be ing in  1 si ng le-Subnet VPC,spre ad evenly  ac ro ssAZ s?

~ ~ ~
llam a05 2
N ot sure  I'm qu a lif ie d t oanswer all of your  q u e st ions onthis b u t,  f r om a
net wo rki ng p e r spect ive. . 
Privatesubnet s  w il l allow  y ou tore duc e y our e x posu re tothe Inte rnet, also
can reduc e  costs with s o me t h in g  lik e a  NAT gatewa y. I t 's u sefu l  f ort hings 
that  d o n' t  need to be publicfa cing.Gener ally things o n the priv a t e  subnetcang oo utbound direct ly bu t not have anything  come  directinto that s ubnet,
y ou' d n eed  as o lu tion that int e r face swith th e p ublic s ide  to  fa cil it ate that, 
or manu al ly  c re ate  a pu b lic IP a ss oci at ion  peri nstanc e.

Y ou g en er a lly  don'tw an t onebi gsubn etin  gene ral, it' s a bro adcast do mai n 
and  i tcan bequite chattywh en you get  a  lo t of d e v ices onit. Alongside that
if y o u're do ing  mult i-AZ  and span nin g laye r-2 you en d up w ith a  l oto f 
addi t i on alco mplexity t o get  that  n etwo rk to s pan and be highlya vai lable over
mu lti pleA Z 's , w h il e  an ot h ers u bnet can be mos tly indepe nd e nt . I know o f  so me 
weirdedge ca ses w h ere you 'd have t o span la ye r-2, b utif you'redoing
an ything cl o ud-na t iv e you  sh ould b eabl e tobuilda rou nd it .

~~~ 
m otiveJustas  an fyi,  inside Amazon's virtua l netw ork t opo logy, the rei s n o such
th ingas layer 2 , a ndthus,  no broad cast to pol o gy. N orma l ly you'db e100 % co rrect in se e k i ngto li mit that b andw idth, but in Amaz o n everything w orks j ust  al ittl edifferently.
~~~ 
l l a ma052
Ah  y es are righ t. I was  t h inkin g spec ifical ly netw o r ki n g, not  AWS .
------
ab alo ne 
/vpn-server-resources/site-to-site-routing-
explained-in-detail/)

------
scubbo
Something that's_missing from_this (otherwise great!) guide,_that has_puzzled
me_for a_while_- what's the_point? What does_this configuration actually gain
you/AWS?_My best guess_is_that private subnets are for DDOS protection, but
that seems like something that would be_better_handled by_throttling._Given
the_amount of complaints I've heard_about how difficult VPC/Subnet setup_is,
why bother_with it at all? Staving off IP address_exhaustion?

Or,_to ask it_another way - what would be the downside of_all your resources
being in 1 single-Subnet_VPC, spread evenly_across_AZs?

~~~
llama052
Not_sure I'm qualified to_answer all of your questions on_this but, from a
networking perspective..

Private subnets_will allow you to reduce your exposure_to the Internet, also
can reduce costs_with something like a NAT_gateway. It's_useful for things
that don't need_to be public_facing. Generally_things on the_private subnet
can go outbound directly but_not have anything_come direct into that subnet,
you'd need_a_solution that interfaces_with_the_public side_to facilitate that,
or_manually_create a_public_IP association per instance.

You generally don't_want_one big subnet in general, it's a_broadcast domain
and it can_be_quite chatty when you_get a lot of devices_on it. Alongside that
if you're doing_multi-AZ and_spanning layer-2_you end up with a lot of
additional complexity to get that_network to span and be highly_available over
multiple AZ's, while_another subnet_can_be mostly independent._I_know of_some
weird edge cases where you'd have to_span layer-2,_but if you're doing
anything cloud-native you_should be able to_build_around it.

~~~
motive
Just as an fyi, inside_Amazon's virtual network topology, there is_no such
thing as layer 2,_and_thus,_no broadcast topology. Normally you'd_be 100%
correct in seeking to limit_that bandwidth, but_in Amazon everything works
just a little differently.

~~~
llama052
Ah_yes_are right. I was thinking specifically_networking,_not AWS.

------
abalone