What is Bastion Host and why it is so important? - Step by Step tutorial (Part-6)

[@debashissinha8489]

O my God !! The unique way Rahul explains is the superb in my IT tenure. Is there any Azure DevOps series of terraform automation created by Rahul ?? Hats off for your rare quality, Rahul !!!

[@RahulWagh]

Thanks for liking it. As off now there is no terraform azure series

[@SureshKumar-kh5ht]

Your are one of the best DevOps trainers Who provides in deapth info for DevOps aspirants Thank you Rahul

[@RahulWagh]

Glad to help

[@dmt15]

What a great series with clear explanation. Please continue this series, I’m looking forward to the next chapter :)

[@RahulWagh]

There are more to come but if you are interested in more in depth content consider being KZbin member for more premium content

[@manthuvishwakarma]

You are the one who is teaching the topics from Scratch and explaining in easy way to understand the topics very easily. Thank you so much sir.

[@RahulWagh]

You are most welcome

[@NickVinckier]

Thank you for such a clear explanation and demo. The pace of this was perfect for me and I was able to grasp the concepts well. Created my own VPC with bastion/jump host and all was working as intended. Many thanks and keep the great content coming!

[@RahulWagh]

Glad to hear that it works for you

[@michaelakinyomitgod4961]

Your Training Method is superb Rahul; hats off for You!

[@RahulWagh]

You are welcome

[@pramodpunnuche5426]

Hi Rahul, Thank for the detailed session and I have one question here during NAT gateway session you connected from pubilc ec2 to private ec2 without enabling public IP subnet in private ec2 SG, how you did that? or its connected via NAT gateway?

[@RahulWagh]

both the ec2 instances are in the same VPC which means both are in same network. The public ec2 instance present in public is only accesible via internet but the ec2 instance present in private subnet can be accessed via public ec2 instance internally without the need of NAT gateway because both of them are in internal network

[@VijayaBaskarvvk]

Hi Rahul, when we define subnets, when have to use Private ranges right? Such as 192.168.x.x, 172.16.x.x to 172.31.x.x, or 10.x.x.x. Or it doesn't matter?

[@RahulWagh]

It totally depends on your org practice on assignment of cidrs

[@ThotaSrinath]

Hi Rahul, thanks a lot for the videos. Learning a lot from these videos. One question on bastion host, when we are copying the private key of ec2 which is in a private subnet to the internet exposed ec2 machine in a public subnet. Is it secured?

[@SinaSoltani-tf8zo]

Hi, thanks for the video. Is there anything like this for databases and other services too? I'm trying to find a way to access an internal database from my own PC. The internal database is just a database that is being used by an API on AWS. How can I use something like a VPN to open the database from my own PC?

[@RameshKr-ot4ju]

Sir you teach with the help of digrarm that makes the things CLEAR. Thank you sir best teacher 😍😍

[@RahulWagh]

Glad to hear that

[@mothusi]

Does having an EC2 instance in a public subnet automatically make that a Bastian host? Because in the video I did not see any specific configurations to the instance in the public subnet. What make an EC2 instance a Bastian host?

[@shaikayub1497]

This is I want to ask him. He did not made any configurations as bastion host. He just allowed the IP-address range of public subnet to the private subnet. How can he say that it is bastion host. Simply he can say that instead of using NAT gateway with elastic IP. we can only use public subnet range.

[@SrikanthKurri-t6e]

The public EC2 instance in the public subnet is called the Bastion Host (or Jump Host).

[@BarneyMyBoy]

Thank you sir , so far this is the best tutorial about the topic that I have been searching. The diagram and step-by-step demo are really easy and helpful for me to follow along. Liked and subscribed.

[@RahulWagh]

You are welcome

[@sameerkashmiri9947]

What a great series with clear explanation and thank you so much for this lecture.

[@RahulWagh]

You are welcome

[@nsquare_4]

whenever you create the instance you gave the name of test-key-pair , but when we login into the machine the name of the key will be different. how it happens

[@gouthamu5424]

Hi Rahul, Does all the Instances in the Public subnet will have the Public IP assigned to it ? I thought public subnet is the one with IGW and private subnet is the one with NAT gateway. In the AWS console i have VM's with Public subnet routed to IGW, but the internet doesn't work unless i enable it with Public IP assignment.

[@harryprsd1]

Great info. Can we have similar setup in azure?

[@RahulWagh]

Yes the bastion host concept is common and can be used in any cloud provider

[@iamsreejuks]

Hello Rahul, Correct me if I am wrong, both the ec2 instances are in the same VPC which means both are in same network, so it will connect right?. I still could not understand the concept of bastion. I already watched "Mastering AWS: NAT Gateway Setup in Your VPC" video, comparing these to, the differences are, in this video you explicitly adding Security group and in NAT gateway video all the configurations are same except the private subnet want to access internet(outbound only) using NAT. So adding the security group(enabling access from Private IPs of Public EC2 to all port in the Private ec2) is how a bastion host differs from normal private-public environment.

[@bhardwaj_abhi3421]

yup ,whole setup is same as explained in VPC video

[@clipsupportgroup8292]

can we set the rule at S3 , after number of days the particular url link(downlodable) will not work if i shared it publically? Please guide me.

[@johnpol6968]

how ssh through bastion host into host in private subnet more secure? Perhaps shade some lite on that.

[@fahim8690]

Thank you very much for this series.. This series really helpful for beginner's like me❤️

[@RahulWagh]

You're welcome 😊

[@manthuvishwakarma]

Can you make an video related to how to build SSH connection from bastion Host to EC2 user in Windows PC

[@peterrubinstein6975]

Great video. How do you do the diagrams

[@RahulWagh]

I just use the ppts nothing more

[@shakunthalapulugu755]

Hi sir,Thankyou for your elaborated explanation.. please explain the purpose of Natgateway.

[@deexithshetty3563]

Best and clear explanation ❤

[@RahulWagh]

Thanks a lot 😊

[@clipsupportgroup8292]

Good job sir, I cleared my doubts. Thanks once again.

[@prateekverma5169]

on point demo , thanks for such content

[@RahulWagh]

Glad you like it!

[@nsquare_4]

sir im unable to understand how the name of the key you changed, please explain sir

[@AzamAslam-x2f]

Thank you Rahul bhai. you really doing great job for us.

[@RahulWagh]

Thanks and welcome

[@kammellapradeep7224]

Very nicely explained , do you cover google cloud topics as well Rahul?

[@RahulWagh]

Not yet on GCP yet but soon I am planning to do it. What would you like to see on GCP?

[@nurhossainsakil9904]

I can't copy the private key. Can anyone help me please?

[@paragvade]

Thank you Rahul.. wonderfully explained

[@RahulWagh]

Thanks and welcome

[@Dinesh_Krish]

Excellent explanation, This is very helpful for me...

[@RahulWagh]

Glad to hear that

[@chukwumaonu7687]

This is cool, what looks like a mirage, you made it so simple. Thanks Bro

[@pradipsharma8504]

Wonderful session. Thanks a lot for your honest effort.

[@RahulWagh]

Glad to know the feedback back

[@farhanmqsd]

Great Video

[@SrikanthKurri-t6e]

thank you so much for your videos. these are helping me a lot.

[@RahulWagh]

You are most welcome

[@nikkiheer4091]

I am not able to connect to private ec2 while connecting to private ec2 from bastion host. Doing ssh as shown in video, i did all steps correctly and tried but while doing ssh to private ec2 nothing is coming, its just blank

[@RahulWagh]

could be many reasons but check the security groups

[@VarunH-w3w]

Can you please make a video on how to Configure the Web application(Python Flask) And Database (Postgre SQl) in the EC2 instance, by using the same security bastion host.

[@RahulWagh]

It is already there - Real Time DevOps Project | Use Terraform Jenkins AWS to deploy REST API kzbin.info/www/bejne/paW0opdtfLeJgZI

[@oluwabusayoshofowora4372]

Thank you, you made me think deeper.

[@RahulWagh]

You're very welcome

[@nurhossainsakil9904]

@RahulWagh please help to get the copy of my private key. I can't read or copy the key from my .pem file

[@gurunathaade4499]

Hi sir , You are doing great jobs pls make a series continuesly, i hope you have to be done with the best way 🙏❤

[@RahulWagh]

Cheers

[@kumarswamyba5876]

Thank you very much for such a wonderful session sir

[@RahulWagh]

Keep watching

[@tathagatadas2825]

Awesome content bro....thanks

[@RahulWagh]

So nice of you

[@sahilk335]

Thank you for detailed explanation.

[@RahulWagh]

You are most welcome

[@MahekMordani-pu8sx]

Hi Rahul do you also do one on one consulting for entrepreneurs

[@RahulWagh]

There is paid consulting which I do, if interested you can reach out to me at - [e-mail]

[@ramamoorthy3444]

Great explaination. I clear understanding

[@RahulWagh]

Great to hear!

[@kiranyadav-gf6cd]

Amazing content bro.. keep going on please do aws solution architect entire course..

[@RahulWagh]

Thanks and sure

[@oluwasilea1307]

Thank You! I am a beginner ❤

[@RahulWagh]

You're so welcome!

[@ShaliniSingh-mu3em]

How do we establish an internet connection on private ec2?

[@RahulWagh]

Use NAT gateway

[@tanayabanerjee2380]

Hello sir...if possible then please try to make a detail video on IP, Subnetting or other networking concepts ,it will be very helpful...Thank you🙂

[@RahulWagh]

Here is a video which is already there on my channel- AWS how to setup VPC, Public, Private Subnet, NAT, Internet Gateway, Route Table? - (Part-5) kzbin.info/www/bejne/amTXeottbpVkfdU

[@vikki5329]

Awsome Example Bro can you please cover examples for Elastic Network Interfaces,Elastic Fabric and Elatic adapter network and placement groups

[@RahulWagh]

Noted

[@A.Sandeep-18]

Liked , commented and subscribed with this one video ❤... looking forward to learn more

[@RahulWagh]

Glad to have you

[@dips_07]

What an insightful share... thank you 🙏🙏

[@RahulWagh]

Cheers

[@shailendraverma1675]

Hello sir what if we created our bastion host in private network so is there anyway ? How we can access that

[@RahulWagh]

The whole purpose of bastion host is to enable access to server present into private subnets. Bastion host in private subnet doesn’t make a sense

[@shailendraverma1675]

@@RahulWagh thanks for replying !!! To make this process more secure what can we do any suggestions ?? Like can we attach a VPN

[@thapasujan07]

Thank you Sir. 💞

[@RahulWagh]

Always welcome

[@raghavayoga]

Very well explained

[@RahulWagh]

Keep watching

[@subash000000]

why we are using ipv4 cidr 0f 12 range why not 10 ?

[@RahulWagh]

When it comes to choosing a CIDR range for a network, there are several factors to consider, including the size of the network, the number of hosts that need to be accommodated, and the availability of IP addresses. The "/12" in IPv4 CIDR notation corresponds to a subnet mask of 255.240.0.0, which means that the first 12 bits of the IP address are used for the network portion, leaving 20 bits for host addresses. This allows for a total of 2^20, or 1,048,576, IP addresses in the subnet (though the first and last addresses are reserved for the network and broadcast addresses, respectively). On the other hand, a "/10" CIDR range corresponds to a subnet mask of 255.192.0.0, which provides for 2^22, or 4,194,304, IP addresses in the subnet. The decision to use a "/12" CIDR range instead of a "/10" range would typically be based on the need for fewer IP addresses than a "/10" range provides. Using a "/12" range when a "/10" range is not necessary can help conserve IP addresses, which is particularly important given the limited availability of IPv4 addresses. However, it's also worth noting that the decision could be influenced by other factors, such as the design of the larger network, routing considerations, and the allocation policies of the organization or service provider managing the IP addresses.

[@subash000000]

​@@RahulWagh.thank you for your explanation but i mean we use 10.x.x.x but you use 12. i liked your teaching and explanation.🙂

[@RahulWagh]

@@subash000000 there is no rule on using 10.x.x.. or 12.x.x…. It is your own vpc just pick the range which you like. The vpcs are not in public domain so you have liberty to choose any range

[@subash000000]

@@RahulWagh thank you for such quick response.

[@nikkiheer4091]

Now it's working thank you.

[@atharvameher5880]

Great content man

[@RahulWagh]

You are welcome

[@rupakmahto2095]

Thank you so much .

[@RahulWagh]

You're most welcome

[@mandodarimodi7555]

Thaks for sharing.

[@manojgandham-lu7tu]

Well explained ❤

[@RahulWagh]

Glad it was helpful!

[@an859]

Felt like sunder pichai teaching me 😀

[@SanketGaikwad-o9e]

in ssh its not connecting

[@RahulWagh]

Check security groups and source

[@prashantsukhadeve9642]

Good Evening Rahul. I hope you are doing well

[@RahulWagh]

hi parshant good evening i am good thanks for asking

[@githinthomas4787]

well explained thank you

[@RahulWagh]

You're welcome!

[@PravinN-z8q]

Thank you

[@RahulWagh]

You're welcome

[@DeepikaDecodes]

Awesome 👌

[@RahulWagh]

Thank you! Cheers!

[@manojgandham-lu7tu]

Can we expect ks8 series from you..?

[@RahulWagh]

Hopefully soon I will prepare in k8s

[@brianlevu3507]

why didnt you use scp to cpoy the pem file

[@RahulWagh]

Yes you can use SCP instead of manually copying the ssh keys

[@brianlevu3507]

@@RahulWagh 😆

[@srihari9381]

All ok but in the last why you not created a new key pair instead of using a existing....last 10 mins unable to understand...

[@neetupalLife]

👏

[@qolbinurwandi]

I always get this error ubuntu@ip-10-0-0-80:~$ ssh -i "aws_ec2_instance_key.pem" ubuntu@10.0.1.179 ubuntu@10.0.1.179: Permission denied (publickey,gssapi-keyex,gssapi-with-mic). anyone have any idea?

[@bikdigdaddy]

i did the exact same but i didn't make a private route table and it still worked. why

[@RahulWagh]

May be you might have made the private subnet as public subnet

[@bikdigdaddy]

@@RahulWagh I'm pretty sure i did not. upon further inspection, i found that there's a default route table assigned to the private subnet (you see it at 10:44) and that allows connectivity inside the same VPC. so that implies if you allow ssh to pvt ec2 in the security group, you'll be able to connect to it from the public ec2 thus no route table needed.