Building a Cloud VPC from Scratch Using Linux Tools

A beginner’s guide to understanding AWS VPCs by building one with ip, iptables, and network namespaces

A DevOps intern built a CLI tool called vpcctl to replicate AWS VPC functionality using only Linux network namespaces, bridges, and iptables. The tool creates isolated public and private subnets, enforces firewall rules, and enables NAT for internet access.

Why This Matters

Real-world VPCs like AWS’s rely on the same low-level primitives: network namespaces for isolation, bridges for routing, and iptables for security. Misconfigurations in these layers can cause outages or security breaches. For example, a misconfigured NAT rule could block all internet access for a subnet, while flawed firewall policies might expose private resources to the public internet.

Key Insights

• “8-hour App Engine outage, 2012” (Google’s misconfigured firewall rules blocked traffic)
• “Sagas over ACID for e-commerce” (distributed transactions require eventual consistency, like VPC peering)
• “Temporal used by Stripe, Coinbase” (stateful workflows mirror VPC resource orchestration)

Working Example

# Create a VPC with public and private subnets
sudo ./vpcctl create --name prod --internet-interface eth0

// firewall.json example
{
  "vpc": "prod",
  "subnet_type": "public",
  "ingress": [
    {"port": 8000, "protocol": "tcp", "action": "allow"},
    {"port": 22, "protocol": "tcp", "action": "deny"}
  ]
}

# Test web server in public subnet
sudo ip netns exec prod-pub python3 -m http.server 8000 --bind 0.0.0.0

# Access from private subnet (same VPC)
sudo ip netns exec prod-priv curl -s http://10.10.1.2:8000 | head -1

Practical Applications

• Use Case: Learning AWS VPC internals by replicating routing, NAT, and security group behavior
• Pitfall: Forgetting to clean up network namespaces, leading to resource leaks and port conflicts

References:

• https://dev.to/sehiconcept/how-i-built-a-cloud-vpc-from-scratch-using-just-linux-no-cloud-22pj
• https://github.com/Sehiconcept/hng-stage4-devops-vpc

---