Networking: Private Networks, Load Balancing, DNS, and VPN
What this domain covers
Networking tests private LAN design, load-balancer health checks, DNS records, and VPN connectivity. Most failures in this domain come from address overlap, missing routes, or a health check that does not represent application health.
Core rules
- A private LAN is an isolated network. Divide it into subnets with non-overlapping CIDR blocks. Servers receive private IPs; routing to other networks is explicit.
- A load balancer has listeners, backend targets, and health checks. The health check path should return success only when the app can serve traffic. Use multiple targets across zones.
- DNS uses hosted zones and record sets. A records map names to IPv4 addresses; CNAMEs map names to names; TTL controls caching. Lower TTL speeds changes but increases query load.
- VPN gateway connects on-premises networks to a private LAN over IPsec. Match pre-shared keys, encryption and integrity proposals, and interesting traffic or CIDRs on both sides.
- NAT gateway provides outbound internet for private servers without inbound exposure. Global IP provides inbound public addressing.
- Security groups and firewall rules must allow the load-balancer-to-target and VPN-to-subnet flows.
Worked example
Two web servers sit in private subnets in zones A and B. The load balancer is in the same private LAN; DNS has an A record to the load balancer's global IP; the health check is GET /health expecting 200. On-premises 10.0.0.0/16 connects by VPN to 10.10.0.0/16. Reasoning: non-overlapping CIDRs allow routing; the load-balancer health check removes a failed zone; private targets avoid public exposure.
Traps
Overlapping CIDRs between on-premises and private LAN; health checks that return 200 on a static page while the app is down; forgetting return routes; mixing DNS TTL expectations; and putting the load balancer in a different network from its targets.