🌐 AWS IOT IL-Central-1 ENV Network Summary¶
This document describes the network setup for the iot-il environment in AWS region il-central-1.
Diagram¶
🗺️ Network Overview¶
- Name: iot-il
- VPC CIDR: 172.18.0.0/20
🧩 Subnets¶
| 🏷️ Name | 🗺️ Zone | 📦 CIDR |
|---|---|---|
| 🔥 firewall | il-central-1a | 172.18.0.0/24 |
| 🌐 pub-subnet-a | il-central-1a | 172.18.1.0/24 |
| 🌐 pub-subnet-a | il-central-1b | 172.18.2.0/24 |
| 🌐 pub-subnet-b | il-central-1c | 172.18.3.0/24 |
| ⚖️ lb-int-subnet-a | il-central-1a | 172.18.4.0/24 |
| ⚖️ lb-int-subnet-b | il-central-1b | 172.18.5.0/24 |
| ⚖️ lb-int-subnet-c | il-central-1c | 172.18.6.0/24 |
| 🧑💻 eks-controlp-a | il-central-1a | 172.18.7.0/24 |
| 🧑💻 eks-controlp-b | il-central-1b | 172.18.8.0/24 |
| 🧑💻 eks-controlp-c | il-central-1c | 172.18.9.0/24 |
| 🌐 nat-az | il-central-1a | 172.18.10.0/24 |
| 🏗️ eks-workers-a | il-central-1a | 172.18.12.0/24 |
| 🏗️ eks-workers-b | il-central-1b | 172.18.13.0/24 |
| 🏗️ eks-workers-c | il-central-1c | 172.18.14.0/24 |
Abstract
Internal/External subnets should be tagged so that aws alb controller can discover them.
Warning
EKS-Workers needs to have this subnets since this will be advertised via BGP to Pelephone
🚦 Routes¶
| 🏷️ Name | 🚩 VIA | 📝 Notes |
|---|---|---|
| 🔥 firewall | igw | AWS FW needs to have edge associated to VPC |
| 🌐 pub-subnet-az | firewall | |
| 🌐 nat-az | igw |
Note
Only one NAT will be used.
🔥 Firewall¶
- AWS Firewall will be deployed as a single endpoint.
- Routes from pub-subnets-a-b-c will be routed to the single zone.
FW Rules:
1. 🟦 SIM-TCP - ingress (suricata rules)
2. 🔒 HTTPS - ingress (standard rules)