#vpc
Amazon VPC networking in practice — subnets, route tables, NAT, network ACLs, DNS limits, and the failure modes that look like something else entirely.
9 articles tagged #vpc, newest first.
Cross-AZ data transfer: How to Find Them and What They Cost
Cross-AZ traffic is charged per gigabyte in both directions, invisible on the bill until you know where to look. What it costs, and how to cut it.
Idle NAT gateways: How to Find Them and What They Cost
Idle NAT gateways bill by the hour for a path nothing uses. What they cost, the command that lists yours, and what to check before deleting one.
Orphaned network interfaces: How to Find Them and What They Cost
Orphaned network interfaces hold IP addresses and block security group and subnet deletion. What they cost, how to list them, and what to check first.
EC2 MTU: 1500 vs 9001, and Why Jumbo Frames Break at the VPC Edge
EC2 instances default to a 9001-byte MTU inside the VPC and 1500 bytes to the internet. Where the boundary sits, and why transfers hang while pings succeed.
100.64.0.0/10 in AWS: Using CGNAT Space to Fix EKS IP Exhaustion
When an EKS cluster runs out of pod IPs and the VPC has no RFC 1918 space left, a 100.64.0.0/10 secondary CIDR is the fix. Why AWS allows it, and what breaks.
Why AWS Reserves 5 IP Addresses in Every Subnet (and What Each One Does)
AWS takes five addresses out of every VPC subnet: network, router, DNS resolver, one in reserve, and broadcast. What each is for, and how it changes sizing.
Ephemeral Ports and the Network ACL Rule Everyone Forgets
Security groups are stateful, network ACLs are not. A NACL allowing inbound 443 but not outbound 1024-65535 lets a connection start, then kills it.
NAT Gateway vs NAT Instance vs VPC Endpoint: Which One, and What It Costs
Three ways to give private subnets outbound access, with very different bills. Where each one wins, and why an S3 gateway endpoint is the cheapest fix.
The VPC DNS Limit: 1,024 Packets per Second per ENI
The VPC resolver caps every network interface at 1,024 DNS packets per second. It is not adjustable, has no CloudWatch metric, and looks like random SERVFAIL.