Chapter 2 — Networks and internet services
Lesson map
Lesson 02 published. Map, example, EX004.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Addresses and ports"]
N2["2.2 A web request"]
N3["2.3 Encryption in transit"]
N4["2.4 Private and public networks"]
N5["2.5 Load balancers and proxies"]
N6["2.6 Network diagrams"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX004"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Addresses and ports"]
N2["2.2 A web request"]
N3["2.3 Encryption in transit"]
N4["2.4 Private and public networks"]
N5["2.5 Load balancers and proxies"]
N6["2.6 Network diagrams"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX004"]
[Learning outcomes]
|
v
[2.1 Addresses and ports]
|
v
[2.2 A web request]
|
v
[2.3 Encryption in transit]
|
v
[2.4 Private and public networks]
|
v
[2.5 Load balancers and proxies]
|
v
[2.6 Network diagrams]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX004]
Learning outcomes
You will (1) explain addresses, ports and protocols; (2) describe how a web request reaches a hosted service; (3) identify where encryption protects traffic.
2.1 Addresses and ports
Each machine on a network has an address. A port number identifies a particular service on that machine, such as 443 for HTTPS. When a firewall rule allows a port, it allows anyone who can reach that address to talk to the service behind it. Priya learns to read every firewall rule at Cobalt from this angle. A rule allowing port 443 on the proxy is intended, because patients must reach the booking page; a rule allowing the database port from any address would let anyone on the internet attempt a connection. She notes that the question is never only which port is open but also who is allowed to reach it.
2.2 A web request
When a dental patient opens Riverside Dental Group's booking page, their browser looks up the name using DNS, connects to Cobalt's proxy on port 443, and the proxy forwards the request to the web container. The response travels back the same way. Each hop is a place where something can fail or be misconfigured. If DNS points to an old address, patients reach nothing; if the proxy forwards to the wrong container, they reach the wrong service. Writing the path down hop by hop, with the port used at each step, is what lets Priya later check encryption on every hop instead of only on the first one.
2.3 Encryption in transit
TLS encrypts traffic between browser and proxy so others on the network cannot read it. Traffic between services inside a cluster may or may not be encrypted; Priya learns to check rather than assume. The path to Riverside Dental's booking page shows both cases. The browser-to-proxy hop uses TLS, and so does the hop from proxy to web container. The hop from web to API inside the cluster does not, which Priya only learns by checking the service configuration. Checking means reading how each connection is set up, not trusting that a secure front door protects everything behind it. Unencrypted internal traffic can be read by anything else able to observe that part of the cluster network.
2.4 Private and public networks
Some services, such as databases, should only be reachable from inside a private network. Exposing them to the internet without need increases risk greatly. For Riverside Dental, the booking database is the clearest example of this. Only the API needs to talk to it, so there is no reason for any address outside Cobalt's private network to reach its port. A database exposed to the internet can be probed by anyone, and a single weak password or unpatched flaw then matters far more. Priya adds a column to her request notes stating whether each component should be public or private, which later helps her compare intended exposure with what firewall rules actually allow. Of the components on the booking path, only the proxy needs to face the internet.
2.5 Load balancers and proxies
A proxy or load balancer receives traffic and passes it on. It is a natural place to enforce TLS, limit request sizes and log requests. At Cobalt, the proxy in front of Riverside Dental's booking system is where TLS ends for patient traffic. Because every request passes through it, the proxy can reject oversized uploads before they reach the web container and keep a log line for each request with time, path and response code. Those logs help answer simple questions, such as whether the booking page was available during a reported outage. The limit is that the proxy sees only traffic sent through it; workloads that call external services directly, such as booking calling an email API, bypass it entirely.
2.6 Network diagrams
Kwame keeps a simple diagram for each client showing which parts face the internet. Priya notices that two diagrams are out of date. Out-of-date diagrams mislead in two directions: they can show services that no longer exist, and they can omit new ones that face the internet. Priya compares each diagram with the proxy's current routes and the workloads listed in the client's cluster. Where they disagree, she marks the diagram as stale and asks the engineer responsible to confirm the real layout before redrawing it. Kwame agrees that each diagram should carry the date it was last checked, so readers can judge how far to trust it.
Worked example
Priya traces a request to the booking page step by step and writes each hop with its port and whether it is encrypted. She finds that the hop from proxy to web container uses TLS, but the hop from web to API inside the cluster does not. Kwame says this is acceptable for now inside the cluster, but it should be recorded as a known limit.
Synthetic case. The booking system is synthetic.
Errors and limits
A diagram is only useful if it is updated when the system changes.
Exercises
- EX004 — Port meaning. What does allowing a port in a firewall rule permit? Rubric: 3 = anyone who can reach the address can use the service; 2 = partial; 1 = vague; 0 = none.
- EX005 — Request path. Trace the booking page request from browser to container. Rubric: 3 = DNS, proxy on 443, forwarded to web container; 2 = two steps; 1 = one; 0 = none.
- EX006 — Inside the cluster. Which hop was not encrypted and how was it treated? Rubric: 3 = web to API; recorded as known limit; 2 = partial; 1 = vague; 0 = none.
Synthesis
Follow each request hop by hop and check encryption rather than assuming it.
Continue studying — chapter 02 of 30
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →