Design and implement a VPC-style network with public and private subnets, routing rules, firewall policies, NAT simulation, and a load balancer — all locally using Linux bridge networking in your VirtualBox lab.
In real cloud environments, networks are organized into Virtual Private Clouds (VPCs) — isolated network environments where you control all routing and access. A typical enterprise VPC has public subnets (accessible from the internet) and private subnets (isolated from the internet). You will simulate this exact architecture locally using VirtualBox network adapters and Linux iptables firewall rules.
ip, iptables, and bridge-utils. The commands you learn here are the exact same tools running inside cloud providers' own infrastructure.
Before touching any configuration, you must understand the components. In this step, you will create a "Network Design Document" — a professional artifact that describes what you are going to build and why.
| Cloud Term | What It Is | Local Lab Equivalent |
|---|---|---|
| VPC (Virtual Private Cloud) | An isolated virtual network environment with its own IP range, routing tables, and security rules — your own private network in the cloud | Linux bridge network (172.168.100.0/24) |
| Subnet | A subdivision of the VPC's IP range, typically one per availability zone and separated by public/private access requirements | Different IP ranges on same bridge (10.0.1.x / 10.0.2.x) |
| Internet Gateway | The component that allows a VPC to send/receive traffic to/from the internet | iptables MASQUERADE + NAT on Ubuntu VM |
| Route Table | A set of rules that determines where network traffic is directed based on destination IP | Linux kernel routing table (ip route) |
| Security Group | A virtual firewall that controls what traffic can reach each cloud resource (stateful) | iptables INPUT/OUTPUT rules per service |
| Network ACL | Subnet-level stateless firewall rules (applied before Security Groups) | iptables FORWARD rules on the bridge |
| NAT Gateway | Allows private subnet resources to initiate connections to the internet without being reachable from the internet | iptables MASQUERADE on a specific interface |
| Load Balancer | Distributes incoming network traffic across multiple servers to ensure no single server is overwhelmed | HAProxy (an open-source load balancer) |
To simulate a two-subnet network, you need two VMs — one representing the public subnet (the web server from Project 2) and one representing the private subnet (a database server).
ABC-Retail-WebServer VM and select "Clone...".ABC-Retail-DBServer
cloudadmin / your password).hostnamectl set-hostname command permanently changes the server's hostname. The bash command starts a new shell session that picks up the new hostname (you'll see the prompt change to cloudadmin@abc-retail-db:~$). In cloud environments, hostnames help identify servers in monitoring dashboards, log files, and SSH connections — a server named "abc-retail-db" is instantly recognizable as the database server.The database server represents resources in the private subnet. Install MariaDB — an enterprise-grade MySQL-compatible database — and configure it to be accessible only from the web server (not from the internet).
mariadb-server) contains the database engine, and the client package (mariadb-client) provides command-line tools to interact with it. After installation, MariaDB automatically starts and creates default databases.mysql_secure_installation script runs an interactive security wizard that: removes anonymous users (who could connect without a password), disables remote root login (root should only be accessible locally), removes the test database (a security risk), and reloads privilege tables. Always run this on any new database installation — these defaults exist for development convenience, not production security.RootDB@Secure2024!
CREATE DATABASE creates the database with UTF-8 encoding (supports all international characters). CREATE USER 'retailapp'@'10.0.1.%' creates a user named retailapp that can ONLY connect from the 10.0.1.x subnet (the public subnet where web servers live) — this is the database equivalent of a Security Group. GRANT ALL PRIVILEGES ON abc_retail.* gives this user full control over only the abc_retail database. FLUSH PRIVILEGES applies the changes immediately. This principle of least privilege — giving each component only the minimum access it needs — is a core security principle.bind-address = 127.0.0.1 and change it to:0.0.0.0 means "listen on all network interfaces", which is necessary for the web server (on a different VM) to connect. However, we will use firewall rules to ensure ONLY the web server can actually reach port 3306 — the firewall is the security layer, not the bind address alone.Security Groups in cloud platforms are stateful firewalls — they track connection state, so if you allow incoming port 80, the return traffic is automatically allowed. In Linux, UFW (and the underlying iptables) provides the same stateful firewall functionality. You will configure separate firewall policies for the web server and database server.
comment option adds descriptive labels to each rule — a best practice that makes audits much easier. In 6 months, you want to know WHY a rule exists, not just what it does.from 192.168.56.101), not from anywhere on the internet. The MariaDB port (3306) is similarly restricted. This simulates a cloud private subnet where the database has no public IP address and can only be reached through the web server. This "bastion host" or "jump server" pattern is a fundamental cloud security architecture principle — the database is completely inaccessible from the internet.nc -zv command (netcat with verbose output) tests whether a TCP connection can be established to port 3306 on the database server. The -z flag scans for open ports without sending data, and -v shows verbose output. If you see "Connection to 192.168.56.102 3306 port [tcp/mysql] succeeded!" — the web server can reach the database port, and the firewall rules are working correctly. If it fails, check your DB server's UFW rules and that MariaDB is running.A load balancer distributes incoming traffic across multiple servers. If one server fails, the load balancer automatically routes traffic to the healthy servers. HAProxy is an open-source load balancer used by major companies and is functionally equivalent to AWS Application Load Balancer or Azure Application Gateway.
check keyword enables health checks — HAProxy sends HTTP GET requests every few seconds; if a server stops responding with HTTP 200, it's removed from rotation. The stats section enables a web-based statistics dashboard on port 8404 — this is similar to the monitoring dashboards provided by cloud load balancers.127.0.0.1:8080 and 127.0.0.1:9090 as its two backend servers. In a production environment, these would be on different VMs or even different availability zones for true high availability — but on a single machine they simulate the load balancing behavior accurately.haproxy -c -f command validates the configuration file for syntax errors (similar to nginx -t). Never restart a production load balancer without testing the configuration first — an invalid config could take down the load balancer and make ALL backend servers unreachable. After confirming syntax is valid, we restart HAProxy to apply the new configuration.http://[VM-IP]:8404/stats. Take a screenshot — you should see both web servers listed as GREEN (healthy). This is a required deliverable.Professional cloud engineers always document their network architecture. This document is used for onboarding new team members, security audits, disaster recovery planning, and troubleshooting.
ip addr show lists all interfaces and their IPs. ip route show shows the routing table (which interface handles traffic for which IP ranges). ss -tlnp (socket statistics) lists all listening TCP services with the process names that own them. Copy this output into your documentation as the "Network State Baseline" — a snapshot of the network configuration that can be used to verify the network was correctly configured or to restore it if something goes wrong.sudo ufw status verbose for both VMsip route, ss, nc, curl), you have built the diagnostic skills that cloud engineers use to investigate production network issues.