⚡ Interactive Visual Guide for Everyone

How Networking & Security Actually Work Inside AWS

Cloud networking often feels like alphabet soup (VPC, ENI, NAT, NACL, SG, PrivateLink, TGW, SCP). Click any component on the interactive architecture map below or run a live question flow to see how network packets travel—and how AWS keeps them secure.

🏢

The Everyday Mental Model: Think of an AWS VPC as your company's private fenced office campus. Public Subnets are the ground-floor lobby with a front door (Internet Gateway). Private Subnets are locked back-office vaults that use a mailroom concierge (NAT Gateway) for outbound errands, private underground tubes (VPC Endpoints) to reach AWS services, and two layers of guards (NACLs at the hallway door and Security Groups right on each server's ENI badge).

🚀 Start Step 1: VPC & Subnets → 🧪 Jump to Troubleshooting Lab

VPC Boundary Public Subnet Private Subnet Security Group (Stateful) NACL (Stateless) AWS Organizations Guardrail

💡 Tip: Click any box in the diagram to inspect it!

🔍 Click Any Component or Flow

Interactive Guide

Select any element on the map (like NAT Gateway, ENI, VPC Endpoint, or AWS Organization) to see:

Plain-English Analogy: What it does without jargon
How Connections Work: What happens to IP addresses and packets
How to Make It Secure: Common mistakes & best practices

Explore Module 1: VPC, Subnets & Routing →

📡 Live Packet Hop-by-Hop Trace

Ready

Click a Flow Button Above IDLE

Try clicking "1. Web User → App → DB" or "2. Private Server → NAT → Internet" in the toolbar above the diagram to watch a packet travel step by step.

🗺️ Deep-Dive Interactive Modules (Multi-Page Curriculum)

Each module below is a hands-on interactive simulator where you can flip switches, break and fix routes, inspect packet headers, and test security guardrails.

Module 1

🏢 VPC, Subnets, Route Tables & IGW

Understand what makes a subnet "Public" vs "Private" (spoiler: it's the Route Table!), how CIDR blocks slice IP ranges, and how the Internet Gateway works.

Open VPC & Routing Simulator →

Module 2

🪪 ENIs (Network Cards) & NAT Gateways

See why IPs and Security Groups live on the ENI (not the EC2 server), hot-swap an ENI between servers, and watch a NAT Gateway rewrite packet headers live.

Open ENI & NAT Workbench →

Module 3

🚇 VPC Endpoints & AWS PrivateLink

Compare sending S3/Secrets Manager traffic through NAT + Public Internet vs. Free Gateway Endpoints vs. Interface Endpoints (PrivateLink ENIs).

Open Endpoints Simulator →

Module 4

🛡️ Security Groups vs. Network ACLs

Master Stateful vs. Stateless firewalls, SG-to-SG chaining, ephemeral return ports, and fix real security vulnerabilities in a 3-tier architecture.

Open Security & Firewall Lab →

Module 5

🏛️ Cross-Account & AWS Organizations

Compare VPC Peering, Transit Gateway (RAM), and Cross-Account PrivateLink. Toggle Organization SCPs, RCPs, and `PrincipalOrgID` guardrails to block rogue networks.

Open Multi-Account & Org Lab →

Module 6

🧪 Interactive Packet & Troubleshooting Lab

Diagnose 8 classic AWS networking mysteries ("Why does my connection time out?", "Why can't Account A reach Account C?") and click to fix them live.

Launch Troubleshooting Sandbox →