0

I am following this tutorial to configure multiple subnets and firewall:

enter image description here

https://networkfirewall.workshop.aws/setup/distributedmodel.html

This tutorial shows how to filter traffic through the firewall. However, when I look at the Public Subnet, the CIDR range for the subnet is 10.1.1.0/24 but the route table shows local destination to be 10.1.0.0/16, shouldn't it be 10.1.1.0/24?

Same thing for Private Subnet, the CIDR range for Private subnet is 10.1.0.0/24 but the Route table for local target shows the destination as 10.1.0.0/16

I am either very confused or have no clue why its configured this way. Can someone please help me understand.

Improve this question
2
  • If you aggregate all the networks, then you use the 10,1,0,0/16 network as the aggregate, meaning that is what you advertise to the public. Any packets in that range get sent to you, and your network knows how to deliver the packets to the correct subnet. Remember that packets only have the destination address, not the destination mask.
    – Ron Maupin ♦
    Oct 27, 2021 at 12:33
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Dec 23, 2021 at 23:11

3 Answers 3

Reset to default
3

"Local" in this context means "within my VPC." So any traffic destined for somewhere else in the VPC is "local." Traffic to the Internet (i.e. outside the VPC) goes to the Internet gateway.

AWS routing does not work exactly the same as "traditional" routing with physical routers, switches, and wires. So their terminology is sometimes different.

Improve this answer
0

It looks like from the diagram that 10.1.0.0/16 is your local domain so any traffic that is for destination 10.1.0.0 to 10.1.255.255 will be sent out a local interface into your network. Underneath is the default route 0.0.0.0/0 that sends all other traffic towards the Internet-gateway firewall.

So if an instance with the Private IP 10.1.0.111 sends a DNS lookup to google dns 8.8.8.8 it will route the traffic towards the yellow highlighted 'target' and follow the red arrows. enter image description here

If the instance 10.1.0.111 wants to send a DNS lookup to eg an internal DNS server 10.1.3.33 or 10.1.1.33, the route on each Firewall, Public or Private route table will send the traffic out of a local interface. But I agree that this is a bit unclear. I think if you imagine there is a virtual switch called 'local' in between all the subnets which I have added in black (and you must forgive my lack of artistic skill) then that helps with the logical direction the traffic takes.

For example, the routing table for Public Route Table 1 would traditionally probably look more like this

10.1.1.0/24 - locally-connected-subnet

10.1.0.0/16 - local

0.0.0.0/0 - nat-aaaa

Improve this answer
0

when I look at the Public Subnet, the CIDR range for the subnet is 10.1.1.0/24 but the route table shows local destination to be 10.1.0.0/16, shouldn't it be 10.1.1.0/24?

Here, private subnet and public subnet are terminology for subnets in different security zones (which is likely elaborated on in the further texts).

10.1.0.0/16 is your entire example address space, routed into your realm. That is subnetted into several /24 networks that you use to create your zoned environment - some of it public, some private, separated by firewalls.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.