the_critic

exactly... The dots are slowly but surely connecting in my head

actually the answer I got gave me an example of what is stateful: The replier says "Security groups are stateful and network groups are stateless". There are Security groups in AWS (not sure if there are in general network environments)

slide 11 seems to illustrate the topology of AWS de.slideshare.net/wlscaudill/aws-network-topologyarchitecture

Yes, I believe that's the term

Agree 100%

I mean the conceptual flow, there has to be a general scheme for that, no ?

You are the man! Thanks for making the effort!

I think the first stop would be the IP of my Internet Gateway ? that will route the traffic to my load balancer and then on to the web server ?

Let's start at the client: Let's say a user wants to access some information in a service hosted on my webserver, how does the traffic flow through my infrastructure ?

Another question: I'd love to know the flow traffic comes in/goes out. There is a lot of bits and pieces, I'm not entirely sure how they interact with each other. I have a VPC, that is (as far as I understand) a private network in the cloud. In that cloud, I have different subnets for the different hosts (webserver, database server, etc) which allows me to have full control over how traffic comes in/goes out.

Thanks, I get the idea of inbound and outbound traffic, it's just a little confusing because I'd love to know which configuration options actually do have the trait that makes them stateful (it's just a thing I would like to know, not necessarily need to know)

I get what the message is trying to say, but what's the reason for that ? I need an example that illustrates the opposite case ... how can a configuration be stateful, or rather which configuration can be stateful in such an environment ?

Okay, I just wasn't used to it being so very restrictive in the first place (all the ports are closed by default, which makes sense for security reasons obviously, but still). Alright that makes sense, so another question would be this: Why are ACLs stateless ? Or let me rephrase that: What is stateful contrary to ACLs ? In the AWS console for the ACLs I can see a little Notice that says: "Allows inbound traffic. Because network ACLs are stateless, you must create inbound and outbound rules."

currently trying this solution serverfault.com/questions/760948/… which was my original question and seeing if that does it for me... Only opened this chat to actually understand what's happening there

the EC2 instance (webserver) is not able to communicate to the database servers, probably due to lacking permissions

So that's where I'm kind of stuck

The core issue however actually lies in the security groups and Network ACLs for those instances

The EC2 instance (webserver) and the database server are in a private subnet connecting to the Internet via the NAT

RDS instances are database servers

The ELB is the elastic load balancer

So just as a heads-up, the EC2 instance is simply a web server

Or should I say, is what I have done above reasonably correct ?

Did everything I said earlier make sense to you ?

Okay, I guess those come pretty close. Mind helping me a little with my setup ?

Nice! Have you ever set up an infrastructure on AWS ?

Are you good with networks ?

Amazing! I get the idea!

alright, thanks! And what is an Internet Gateway compared to that ?

Not having the fundamentals under my belt I have difficulties understanding what the difference between targeting the NAT for my private subnets and the IGW for my public subnets exactly mean. I don't feel comfortable setting it up like that without knowing what's happening behind the scenes

then I added another custom route table for my public subnets which target the internet gateway

As far as I understand, the NAT connects my private subnets to the internet

updated the main route table to include my private subnets and added a route targeting the NAT

Another subnet for my NAT and ELB, all of those belong to a VPC I created

*instance

I have created private subnets for my EC2 instance and two private subnets (in 2 availability zones) for my RDS instances

Currently looking at this document docs.aws.amazon.com/AmazonVPC/latest/UserGuide/… to make sense of the NAT gateway. Can anybody explain what a NAT gateway does exactly ? I know that it enables my private subnets to communicate with the internet, but how does it do it ? And what is an Internet gateway exactly ? Sorry I'm a Software Engineer haven't worked in a server environment yet, trying to make sense of the backend stack

Hi there!