Search
30 results for “networking”
Search results
AWS VPC Networking
How Amazon VPC, subnets, security groups, and network ACLs control traffic in AWS, and why security groups (stateful, instance-level) and network ACLs (stateless, subnet-level) are not interchangeable.
Azure Networking
How Virtual Networks, subnets, and Network Security Groups control traffic in Azure, and how VNet peering differs from a VPN gateway for connecting networks together.
Cloud Networking Fundamentals
How virtual private clouds, subnets, and security groups model network isolation in the cloud, and why "public" vs "private" subnet is a routing decision, not a labeling one.
Docker Networking
How Docker's bridge, host, and overlay network drivers work, how container DNS resolution happens, and the port-publishing model that trips up most beginners.
Linux Networking
How ip and ss replaced ifconfig and netstat as the modern tools for interfaces and sockets, what TCP socket states like LISTEN and TIME-WAIT actually mean, and how nftables organizes firewall rules into tables and chains.
Linux Processes & Networking: Monitoring, Signals, Ports, and Connectivity
How Linux Runs, Communicates, and Stays Alive.
Build a Secure Azure Environment in Minutes with Bicep: VMs, Networking, Private Endpoints & Blob Replication
A hands-on Infrastructure-as-Code lab deploying a production-ready Azure environment from a single Bicep template.
Azure Networking with PowerShell: VNet Design, Peering, VM Provisioning & Network Watcher (Beginner to Pro)
A hands-on lab deploying VNets, peering them securely, provisioning Windows Server VMs, and validating connectivity with Network Watcher.
Service Mesh Basics
What a sidecar proxy actually intercepts, why service meshes exist once you already have Kubernetes Services, and the mTLS/observability/traffic-shaping capabilities that justify the added complexity.
What is the difference between a security group and a network ACL in a VPC?
A security group is stateful and attaches at the instance/ENI level: it only supports allow rules, and if inbound traffic is allowed, the corresponding response traffic is automatically allowed back out regardless of outbound rules. A network ACL is stateless and attaches at the subnet level: it supports both explicit allow and explicit deny rules, numbered and evaluated in order starting from the lowest number, and because it has no memory of prior traffic, allowing inbound traffic does not automatically allow the matching outbound response, that has to be permitted by its own rule. Security groups are the primary, fine-grained access control per resource; network ACLs are a coarser, optional second layer at the subnet boundary.
If VPC A is peered with VPC B, and VPC B is peered with VPC C, can A reach C through B?
No. AWS VPC peering connections are explicitly non-transitive: a peering connection is a strict one-to-one relationship between exactly two VPCs, and you cannot use one VPC as a transit point for another peering connection it happens to also have. To let A reach C, a separate, direct peering connection between A and C has to be created; there is no way to route through B. A Transit Gateway, not a mesh of peering connections, is the AWS-recommended way to connect more than a couple of VPCs that all need to reach each other.
What is the difference between a public and a private subnet in a VPC?
The difference is entirely about the subnet's route table, not any property of the subnet itself: a public subnet has a route to an internet gateway for `0.0.0.0/0`, so resources with a public IP in it can reach and be reached from the internet directly. A private subnet has no such route, so its resources typically use a NAT gateway (in a public subnet) for outbound-only internet access, or no internet path at all. Both subnet types can otherwise have identical security group and NACL configuration; "public" and "private" describe reachability via routing, not a separate networking feature.
What is an Azure Virtual Network (VNet) and how does it relate to subnets?
A VNet is an isolated network within Azure, scoped to a subscription and region, defined by an address space (a CIDR block). Subnets divide that address space into smaller segments, and every resource with networking (a VM, an App Service with VNet integration) is deployed into a specific subnet, not directly into the VNet itself. Subnets are also where Network Security Groups and route tables actually attach, so subnet design is where most Azure network segmentation decisions get made.
What is the difference between VNet peering and a VPN gateway?
VNet peering connects two VNets directly over Microsoft's backbone network, low latency, high bandwidth, no gateway required, but both VNets need non-overlapping address spaces and peering doesn't transit by default (VNet A peered to B, and B peered to C, doesn't mean A can reach C without its own peering). A VPN gateway creates an encrypted tunnel, typically used to connect an on-premises network to Azure, or between Azure and another cloud, over the public internet rather than Azure's internal backbone. Peering is for Azure-to-Azure connectivity at the best possible performance; a VPN gateway is for connecting to networks outside Azure, or when encryption over the transport itself is a specific requirement.
How does a Network Security Group (NSG) evaluate traffic rules?
An NSG contains a prioritized list of allow/deny rules, evaluated in priority order (lowest number first) until the first rule matching the traffic's source, destination, port, and protocol is found, that rule's action wins, and no further rules are evaluated. NSGs can attach to a subnet, a network interface, or both, and are stateful, meaning an allowed inbound connection's return traffic is automatically permitted without needing a matching outbound rule. Because evaluation stops at first match, rule priority ordering is the actual logic, a broad allow rule placed before a specific deny rule silently makes that deny unreachable.
What makes a subnet "public" versus "private" in a cloud VPC?
It is entirely determined by routing, not by any label or flag on the subnet itself. A subnet is "public" if its route table sends traffic destined for the internet (0.0.0.0/0) to an internet gateway. A subnet is "private" if that route instead points to a NAT gateway (for outbound-only internet access) or has no internet route at all. Two subnets can be configured identically in every other respect and differ only in that one route table entry, which is why auditing actual route tables matters more than trusting subnet names like "public-subnet-1."
What is the difference between a security group and a network ACL?
A security group is stateful and attached to individual resources (like an instance or load balancer), if you allow inbound traffic on a port, the corresponding outbound response is automatically allowed, and rules are evaluated as an allow-list only. A network ACL is stateless and attached to a subnet, evaluating both inbound and outbound rules independently for every packet, including explicit deny rules. Security groups are the primary, more commonly used tool for per-resource access control; network ACLs add a coarser, subnet-wide layer, often left at their permissive default and used mainly for defense-in-depth or to explicitly block something.
Why would you use a NAT gateway instead of just putting a resource in a public subnet?
A NAT gateway lets resources in a private subnet initiate outbound connections to the internet (to pull a package, call an external API) while remaining unreachable from the internet for inbound connections; the NAT gateway only translates and forwards traffic the private resource itself initiated. Putting a resource directly in a public subnet with a public IP makes it directly reachable from the internet in both directions, which is unnecessary exposure for anything that only needs outbound access, like an application server that doesn't need to accept direct public traffic.
What is the default Docker network driver and how does container-to-container communication work on it?
The default is the bridge driver, Docker creates a private virtual network on the host, and each container gets its own network namespace with a virtual ethernet interface connected to that bridge. Containers on the same user-defined bridge network can reach each other by container name, because Docker runs an embedded DNS server that resolves container names to their internal IPs on that network. Containers on the default (unnamed) bridge network do not get this automatic DNS resolution, only user-defined bridge networks provide it.
Why does publishing a port with -p 8080:80 not automatically make the container reachable from other containers?
-p (or --publish) maps a port on the Docker host to a port inside the container, specifically for reaching the container from outside the Docker network, from the host machine or the internet. Other containers on the same user-defined network do not need that mapping at all; they can reach the container directly on its internal port via the container's name and internal port, because they share the internal bridge network. Publishing a port is about host-to-container access, not container-to-container access.
What is the difference between the bridge and host network drivers?
With the bridge driver (the default), a container gets its own isolated network namespace and IP address, and ports must be explicitly published to be reachable from the host. With the host driver, the container shares the host's network namespace directly, no isolation, no port publishing needed, the container's ports are the host's ports. Host networking is faster (no NAT/bridge overhead) but sacrifices network isolation, so it is used selectively, not as a default.
What is the difference between ss and the older netstat command, and why would you reach for ss first?
Both report socket/connection information, but ss reads directly from kernel data structures and can display considerably more TCP and socket state detail than netstat, including fine-grained state groupings like every "connected" state (everything except listening and closed) or every "synchronized" state, which makes targeted filtering much easier. netstat has been effectively superseded across current Linux distributions, and ss is the tool actively maintained as part of the iproute2 suite alongside ip, which is why it is the modern default for socket inspection rather than a mere alternative.
A socket shows up in the LISTEN state versus ESTABLISHED. What is actually different about what that socket is doing?
LISTEN means a server-side socket is bound to a port and passively waiting to accept incoming connection requests, it isn't attached to any specific remote peer yet. ESTABLISHED means a full connection has completed its handshake and is actively associated with a specific remote address and port, data can flow in both directions. Seeing a service you expect to be running not show a LISTEN socket on its expected port is usually the very first, most direct signal that the service isn't actually up or isn't bound where you think it is.
How does nftables organize firewall rules, and what actually changed compared to iptables?
nftables organizes rules into tables (containers with no inherent semantics of their own) which hold chains, and chains hold the actual rules; a chain becomes active by being attached to a kernel hook such as input, output, forward, prerouting, or postrouting, which is the point in packet processing where its rules actually get evaluated. The structural change from iptables is consolidation: instead of separate tools for IPv4, IPv6, ARP, and bridge filtering (iptables, ip6tables, arptables, ebtables), nftables provides one framework and one command, `nft`, spanning multiple address families (`ip`, `ip6`, `inet`, `arp`, `bridge`), so a ruleset no longer has to be duplicated per protocol family the way it historically did.
What does a service mesh add on top of what Kubernetes Services already provide?
A Kubernetes Service provides basic load-balanced routing to a set of Pods by label selector, that's it. A service mesh intercepts every request in and out of a Pod (via a sidecar proxy) to add a uniform layer of capabilities across all services without changing application code: mutual TLS encryption between services, fine-grained traffic control (canary percentages, retries, timeouts, circuit breaking), and rich per-request observability (latency, error rate, and request volume between every pair of services). Services give you connectivity; a mesh gives you control and visibility over that connectivity.
How does the sidecar proxy pattern actually intercept traffic without changing application code?
A sidecar proxy (typically Envoy) runs as a second container inside the same Pod as the application, sharing its network namespace. Traffic rules (usually iptables rules injected automatically by the mesh's admission controller) transparently redirect all inbound and outbound traffic through that proxy before it reaches or leaves the application container. The application still just makes normal HTTP/gRPC calls to `localhost` or a service DNS name, it has no idea a proxy is involved, which is exactly what makes the mesh's capabilities (mTLS, retries, observability) apply uniformly without any code changes.
What is the main trade-off a service mesh introduces?
A sidecar proxy is injected into every Pod, adding a small amount of latency per request (an extra network hop, even if localhost) and meaningful additional resource consumption (CPU/memory for every proxy, multiplied across every Pod in the cluster) and operational complexity (another control plane to run, upgrade, and debug). For a small number of services, this overhead frequently outweighs the benefit, service meshes tend to pay off once the number of services and the need for uniform mTLS/observability/traffic control across all of them grows large enough that doing it per-service in application code becomes unmanageable.
DHCP Server Deployment on Hyper-V: From Scope Creation to Failover Configuration
Step-by-step deployment of a highly available DHCP service in a Hyper-V virtual environment
Deploying Windows Server on Hyper‑V with Static IP Configuration
Building reliable, scalable infrastructure starts with mastering the fundamentals. I revisited one of the most essential skills in systems administration: deploying and configuring Windows Server on Hyper‑V, complete with proper networking and static IP assignment. This hands‑on project mirrors rea…
Subnet Calculator
Calculate network address, broadcast address, usable host range, and subnet mask from an IPv4 CIDR, runs entirely in your browser.