AWS Cloud Networking: From IP Addresses to Production VPCs
About this course
A complete, patient course on networking in AWS, starting from what an IP address actually is. You will learn binary and subnet masking properly, find network boundaries and block sizes by hand, and understand CIDR well enough to plan an address space you will not regret — all before a single AWS service appears. From there it builds the whole picture: VPCs, subnets and route tables; internet and NAT gateways; security groups and NACLs and why they behave differently; peering, Transit Gateway, VPN and Direct Connect; endpoints and PrivateLink; DNS and Route 53 Resolver; IPv6; load balancing and the edge; flow logs, traffic mirroring and reachability analysis; Network Firewall; and a full section on what all of it costs, because AWS networking bills surprise people more than any other part of the platform. Written to be read, with the reasoning behind every design rather than a list of settings.
What you'll learn
- Read an IP address and subnet mask in binary, and find the network boundary and block size by hand
- Plan a CIDR range for an organisation without creating overlaps you cannot undo
- Explain what a VPC, subnet and route table actually do, and what makes a subnet public
- Choose correctly between an internet gateway, NAT gateway and egress-only gateway
- Reason about security groups and NACLs, including why stateless rules break return traffic
- Connect networks with peering, Transit Gateway, Site-to-Site VPN, Direct Connect and Client VPN
- Reach AWS services privately with gateway and interface endpoints, and publish your own with PrivateLink
- Understand DNS inside a VPC, including private hosted zones and hybrid resolution
- Run dual-stack IPv6 networks and know where the rules differ
- Diagnose why traffic is not flowing, using flow logs, Reachability Analyzer and a repeatable method
- Predict and reduce what a network design will cost before it is built
Stuck on something? Ask
Every lesson has an assistant that can see the lesson you are reading. Ask in your own words and it answers using the same examples and table names in front of you — no switching to a search engine and losing your place.
Why does WHERE come after FROM?
Because the database reads the rows first, then decides which to keep. That order is also why WHERE cannot see a SELECT alias.
It will not give you assessment answers — it explains the idea they test, so the certificate still means something.
Not ready yet?
One email when something new is published. Nothing else.
Course content
What a Network Actually Is 9 lessons
- What a network actually is Preview
- Packets: why data is chopped up Preview
- The layers, and the two that matter here Preview
- MAC addresses and the local network
- What a router does
- Ports: one machine, many services
- TCP and UDP
- Knowledge check: how networks move data
- Section 1 handout (PDF)
IP Addresses and Subnet Masking 8 lessons
- What an IP address is Preview
- Binary, just enough of it Preview
- The subnet mask Preview
- Finding the network boundary and block size
- How many hosts actually fit
- Public and private addresses
- Knowledge check: addresses, masks and boundaries
- Section 2 handout (PDF)
CIDR, Overlaps, and Planning an Address Space 6 lessons
- Why CIDR replaced address classes
- Splitting a block into subnets
- Overlapping CIDR, and why it cannot be fixed later
- Choosing a VPC CIDR you will not regret
- Knowledge check: CIDR and address planning
- Section 3 handout (PDF)
Your First VPC: Subnets and Route Tables 7 lessons
- What a VPC actually is
- Subnets and Availability Zones
- Route tables and the implicit router
- What actually makes a subnet public
- The default VPC, and why not to use it
- Knowledge check: VPCs, subnets and routing
- Section 4 handout (PDF)
Getting In and Out: Gateways, Public IPs and Bastions 10 lessons
- The internet gateway
- Public IPs, Elastic IPs, and what AWS actually does
- Elastic Network Interfaces
- The bastion host, or jump box
- Session Manager: the bastion you do not have to run
- The NAT gateway
- NAT gateway or NAT instance
- The egress-only internet gateway
- Knowledge check: internet access and NAT
- Section 5 handout (PDF)
Controlling Traffic: Security Groups and NACLs 6 lessons
- Two mechanisms, and why there are two
- Security groups
- NACLs, and the ephemeral port trap
- A method for "it cannot connect"
- Knowledge check: security groups and NACLs
- Section 6 handout (PDF)
Connecting Networks: Peering, Transit Gateway, VPN and Direct Connect 6 lessons
- VPC peering
- Transit Gateway
- Site-to-Site VPN
- Direct Connect
- Knowledge check: connecting networks
- Section 7 handout (PDF)
Reaching AWS Services Privately: Endpoints and PrivateLink 5 lessons
- The problem: your traffic leaves the building
- Gateway endpoints, and why they are always worth it
- Interface endpoints and PrivateLink
- Knowledge check: endpoints and PrivateLink
- Section 8 handout (PDF)
DNS: Route 53, Private Zones and Hybrid Resolution 5 lessons
- How a name becomes an address
- DNS inside a VPC
- Hybrid DNS with Resolver endpoints
- Knowledge check: DNS in and around a VPC
- Section 9 handout (PDF)
IPv6 in AWS 5 lessons
- Reading an IPv6 address
- Dual-stack VPCs, and what changes
- The IPv6 mistakes worth avoiding
- Knowledge check: IPv6
- Section 10 handout (PDF)
Load Balancing and the Edge 5 lessons
- Why a load balancer, and which one
- Target groups, health checks and cross-zone
- CloudFront and Global Accelerator
- Knowledge check: load balancers and edge services
- Section 11 handout (PDF)
Seeing What Is Happening: Flow Logs, Mirroring and Analysis 5 lessons
- VPC Flow Logs
- Querying flow logs, and what to look for
- Traffic Mirroring, Reachability and Access Analyzer
- Knowledge check: network visibility
- Section 12 handout (PDF)
AWS Network Firewall and Inspection 4 lessons
- What security groups cannot do
- Deploying it: subnets, routing and patterns
- Knowledge check: firewalls and inspection
- Section 13 handout (PDF)
What It All Costs 6 lessons
- The three shapes of a network charge
- The data transfer matrix
- Where the money actually goes
- Reducing the bill, in order of return
- Knowledge check: network cost
- Section 14 handout (PDF)
Putting It Together 5 lessons
- Every component, and what it costs
- Designing a VPC, start to finish
- The method, and where to go next
- Final assessment: AWS networking
- Section 15 handout (PDF)
Frequently asked questions
Do I need any networking experience?
None. The course spends its first four sections on networking itself — packets, addresses, binary, subnet masks and CIDR — before AWS appears. If you have never worked out a network boundary by hand, that is exactly who this is written for.
How is this different from the AWS Solutions Architect course?
That course covers the whole SAA-C03 syllabus, with networking as one section at exam depth — it assumes you already understand subnetting. This one is a specialist course: it teaches the networking itself from zero and then goes far deeper into VPC design, hybrid connectivity, DNS, IPv6, inspection and cost than any exam requires. They complement each other, and either can be taken first.
Is this only useful for AWS?
The first four sections are general networking and apply anywhere — the addressing and CIDR you learn here works identically in Azure, GCP and a data centre. From section five onward it is AWS-specific, though the concepts transfer more than the names do.
Do I need an AWS account to follow along?
Not to read it, and yes to get the most from it. Almost everything demonstrated fits inside the AWS free tier, with two exceptions that are called out where they appear: NAT gateways and interface endpoints bill by the hour whether or not you use them. The cost section exists partly so you do not learn that from a bill.
Does it cover the Advanced Networking specialty certification?
It covers a large part of that syllabus, but it is not organised as an exam course and has no timed mock exam. It is written to make you able to design and debug real networks; passing that exam afterwards would need some targeted revision on top.
Is this a video course?
No. Every lesson is written out in full, so you can read at your own pace, search it later, and keep it open beside the console. Each section also ships as a printable PDF handout — useful here, because subnet tables are worth having on paper.
Instructor
Fepiq Courses
Practical engineering courses written for people who prefer reading to watching.
We'll send your receipt and a sign-in code here. No password needed.
Full lifetime access · Certificate on completion · AI tutor in every lesson