AWS VPC Networking Lab ☁️

Overview

This project was completed as part of my final for an IT Infrastructure course in college.

The goal was to configure and troubleshoot an AWS network containing an EC2 instance in a public subnet and a MySQL server in a private subnet. I had to restore internet access for the EC2 instance, install the MySQL client, configure security-group rules, connect to the private database server, run SQL commands, and document the finished network.

The project helped me understand how route tables, internet gateways, subnets, security groups, ports, and CIDR ranges work together inside an AWS VPC.

This was a structured college lab environment. It was not intended to represent a complete production AWS deployment.

Project Details

• Course: IT Infrastructure
• Original completion date: May 2023
• Cloud platform: Amazon Web Services
• Region used in the lab: us-east-2
• Main services: Amazon VPC and Amazon EC2
• Database: MySQL/MariaDB
• Main focus: Routing, subnet design, security groups, database connectivity, and network troubleshooting

Technologies and Concepts

Technology or Concept	How I Used It
Amazon VPC	Contained the public and private network resources
Amazon EC2	Hosted the Linux instance used to access the network and database
Public subnet	Contained the EC2 instance with internet access
Private subnet	Contained the MySQL server
Internet gateway	Provided a path between the public subnet and the internet
Route table	Sent default traffic through the internet gateway
Security groups	Controlled outbound HTTPS and MySQL traffic
CIDR notation	Defined the VPC and subnet address ranges
Linux terminal	Installed the MySQL client and connected to the database
MySQL/MariaDB	Verified connectivity by running SQL commands
diagrams.net	Used to document the AWS network architecture

Network Architecture

flowchart LR
    Internet((Internet))
    IGW[Internet Gateway]
    RT[Route Table<br/>0.0.0.0/0 to IGW]

    subgraph VPC["AWS VPC"]
        subgraph Public["Public Subnet"]
            EC2[EC2 Linux Instance]
            EC2SG[EC2 Security Group]
        end

        subgraph Private["Private Subnet"]
            DB[Private MySQL Server]
            DBSG[Database Security Group]
        end
    end

    Internet <--> IGW
    IGW <--> RT
    RT <--> EC2
    EC2 --> EC2SG
    EC2SG -->|TCP 3306| DBSG
    DBSG --> DB
    EC2 -->|TCP 443| Internet

Loading

The EC2 instance needed internet access so that I could connect to it and install the MySQL client. The database server remained inside the private subnet and was reached using its private IP address.

Troubleshooting Process

flowchart TD
    A[Attempt to Connect to EC2] --> B[Connection Fails]
    B --> C[Add Default Route to Internet Gateway]
    C --> D[EC2 Connection Works]
    D --> E[Attempt to Install MySQL Client]
    E --> F[Installation Times Out]
    F --> G[Allow Outbound HTTPS on TCP 443]
    G --> H[Install MySQL Client]
    H --> I[Attempt Private Database Connection]
    I --> J[Database Connection Fails]
    J --> K[Allow MySQL Traffic on TCP 3306]
    K --> L[Connect to MySQL Server]
    L --> M[Run SQL Queries]
    M --> N[Document Network Architecture]

Loading

1. Initial EC2 Connection Test

Goal

The first step was to connect to the assigned EC2 Linux instance.

Result

The initial connection failed because the subnet did not have a working route to the internet gateway.

This showed that creating an EC2 instance does not automatically guarantee that it can communicate with the internet. The subnet, route table, internet gateway, security group, and instance configuration all have to work together.

2. Configure Internet Access

What I Did

I located the route table associated with the EC2 instance's subnet and added a default route:

Destination: 0.0.0.0/0
Target: Internet Gateway

The 0.0.0.0/0 destination represents all IPv4 addresses that do not match a more specific route.

Result

After the route was added, the EC2 instance could be reached through the AWS connection interface.

What I Learned

The route table controls where network traffic is sent. The internet gateway provides the connection, but the subnet still needs a route telling traffic to use it.

3. Install the MySQL Client

Goal

The next goal was to install the MySQL client on the EC2 instance so it could communicate with the private database server.

I attempted to run:

sudo yum install mysql

Initial Result

The installation timed out.

The route table allowed internet traffic, but the EC2 security group did not yet allow the required outbound HTTPS connection.

Configuration Change

I added an outbound security-group rule allowing:

Protocol: TCP
Port: 443
Destination: 0.0.0.0/0

TCP port 443 is used for HTTPS traffic. Allowing it enabled the instance to retrieve the packages needed for the MySQL client installation.

Result

After adding the rule, I ran the installation command again and successfully installed the required client software.

4. Connect to the Private MySQL Server

Goal

After installing the client, I attempted to connect from the EC2 instance to the MySQL server in the private subnet.

The general command used was:

mysql -h <private-database-ip> -u student -p

The original classroom password is intentionally not included in this repository.

Initial Result

The first database connection did not work because the required MySQL traffic was not yet allowed through the EC2 instance's security-group configuration.

Configure MySQL Network Access

I added an outbound rule that allowed:

Protocol: TCP
Port: 3306
Destination: Private MySQL server address using /32 CIDR

TCP port 3306 is the standard port used for MySQL connections.

The /32 CIDR limited the rule to one specific private IP address instead of allowing MySQL traffic to an entire network.

Result

After adding the rule, I successfully connected from the EC2 instance to the MySQL server in the private subnet.

5. Verify the Database Connection

After connecting, I selected the class database and ran several SQL commands:

USE is311;

SHOW TABLES;

SELECT *
FROM movies
LIMIT 1;

SELECT MAX(budget)
FROM movies;

These commands verified that:

• The database connection was active
• The assigned database could be selected
• Its tables were accessible
• Records could be retrieved
• Aggregate functions could be executed

The database and its data were already provided as part of the class environment. My work focused on configuring network access, connecting to it, and verifying the connection with SQL queries.

6. Network Addressing

The original lab used the following address ranges:

Network Component	CIDR Range	Available Addresses
EC2 subnet	/26	64 total addresses
MySQL server subnet	/24	256 total addresses
Full VPC	/16	65,536 total addresses

This portion of the project helped me practice reading CIDR notation and understanding how the prefix length affects the size of a network.

The address totals represent the full mathematical size of each CIDR block. AWS reserves some addresses inside each subnet, so not every address in a subnet can be assigned to a resource.

7. Final Network Diagram

I created the following diagram to document the finished AWS environment:

The diagram shows:

• The AWS VPC
• Public and private subnets
• The EC2 Linux instance
• The private MySQL server
• The internet gateway
• The route table
• Security groups
• HTTPS and MySQL ports
• Communication between the EC2 instance and database

Security Design

The project demonstrated several basic network-security ideas:

• The database server was placed in a private subnet
• The EC2 instance was used to reach the database
• MySQL traffic was limited to TCP port 3306
• The MySQL rule targeted one specific private address
• HTTPS traffic was opened separately for package installation
• Route tables and security groups handled different parts of connectivity

The route table determined where traffic could travel, while the security groups controlled which types of traffic were allowed.

What I Learned

This project helped me understand how to troubleshoot connectivity in separate layers.

When something failed, I had to determine whether the problem came from:

• The route table
• The internet gateway
• The subnet configuration
• The security group
• The destination IP address
• The port number
• The software installed on the EC2 instance
• The database connection command

The biggest takeaway was that a route and a firewall rule solve different problems. A valid route does not automatically mean the traffic is permitted, and an allowed port does not help if there is no route to the destination.

I also gained experience connecting cloud networking concepts to actual troubleshooting instead of only learning the definitions.

Skills Practiced

• AWS VPC configuration
• Amazon EC2
• Public and private subnet design
• Route-table configuration
• Internet gateways
• Security groups
• TCP ports
• CIDR notation
• Linux package management
• MySQL client connections
• Basic SQL verification
• Cloud network troubleshooting
• AWS architecture diagrams
• Technical documentation

Project History

I originally completed this project in 2023 as part of my IT Infrastructure course final.

The screenshots and architecture diagram come from my original submission. I created this GitHub README later to organize the project, explain the troubleshooting process more clearly, and make the work easier for other people to understand.

The original assignment and Word document are not included because they contain instructor directions, repeated screenshots, classroom credentials, and material that has been reorganized here.

The original assignment used a humorous heading containing “Just kidding.” I replaced it with Configure MySQL Network Access so the public documentation is clearer and more professional.

Security and Privacy Notes

• No active AWS credentials are included
• No access keys or secret keys are included
• The classroom database password is not included
• The private IP addresses shown in the original diagram are from an old lab environment and are not publicly routable
• The project did not involve customer information or a production system

Future Improvements

These were not part of the original final. They are improvements I would make if I rebuilt the environment today:

• Rebuild the VPC in a personal AWS account
• Use security-group references instead of fixed private IP addresses
• Add network access control lists for comparison
• Use AWS Systems Manager for instance access
• Add VPC Flow Logs for traffic visibility
• Place private resources behind a NAT gateway when outbound internet access is required
• Create the infrastructure using Terraform or AWS CloudFormation
• Add CloudWatch monitoring and alerts
• Test connectivity using tools such as ping, traceroute, nc, and telnet
• Create a more detailed diagram showing route-table and subnet associations