# VPC Control - Virtual Private Cloud on Linux

Build and manage AWS-like VPCs on Linux using native networking tools. Complete implementation of VPCs, subnets, NAT gateways, peering, and security groups.

## Features

- ✅ VPC creation with isolated networks
- ✅ Public & Private subnets
- ✅ NAT Gateway for internet access
- ✅ VPC Peering
- ✅ Security Groups (firewall rules)
- ✅ Service deployment with web UI
- ✅ Complete isolation using namespaces

Architecture

How it works:

• Linux Bridge = VPC Router
• Network Namespace = Isolated Subnet
• veth Pair = Virtual Cable
• iptables = NAT + Firewall
• tmpfs = In-memory filesystem for isolation

Prerequisites

# Ubuntu/Debian
sudo apt update
sudo apt install -y python3 iproute2 iptables bridge-utils

# Clone repository
git clone https://github.com/EmmyAnieDev/hng13-stage4-devops.git
cd hng13-stage4-devops

Quick Start

# Create VPC and subnets
sudo python3 vpcctl.py create-vpc vpc1 10.0.0.0/16
sudo python3 vpcctl.py add-subnet vpc1 public 10.0.1.0/24 --type public
sudo python3 vpcctl.py add-subnet vpc1 private 10.0.2.0/24 --type private

# Deploy test services
sudo python3 vpcctl.py deploy-service vpc1 public --port 8000
sudo python3 vpcctl.py deploy-service vpc1 private --port 8001

# Test intra-VPC connectivity
sudo ip netns exec vpc1-public ping -c 4 10.0.2.2

# Create second VPC
sudo python3 vpcctl.py create-vpc vpc2 172.16.0.0/16
sudo python3 vpcctl.py add-subnet vpc2 public 172.16.1.0/24 --type public
sudo python3 vpcctl.py deploy-service vpc2 public --port 8002

# Setup VPC peering
sudo python3 vpcctl.py setup-peering vpc1 vpc2

# Apply firewall rules
cat > /tmp/firewall.json << 'EOF'
{
  "ingress": [
    {"port": 8000, "protocol": "tcp", "action": "allow"},
    {"port": 9000, "protocol": "tcp", "action": "deny"}
  ]
}
EOF
sudo python3 vpcctl.py apply-firewall vpc1 public /tmp/firewall.json

# List all VPCs
sudo python3 vpcctl.py list

# Cleanup
sudo python3 vpcctl.py delete-vpc vpc1
sudo python3 vpcctl.py delete-vpc vpc2

CLI Commands

Command	Description
create-vpc <name> <cidr>	Create VPC
add-subnet <vpc> <name> <cidr> --type <public|private>	Add subnet
setup-peering <vpc1> <vpc2>	Connect VPCs
apply-firewall <vpc> <subnet> <file.json>	Apply firewall
deploy-service <vpc> <subnet> --port <port>	Deploy service
list	List all VPCs
delete-vpc <name>	Delete VPC

Testing

Test 1: Intra-VPC Communication (Same VPC)

# Public to Private subnet
sudo ip netns exec vpc1-public ping -c 4 10.0.2.2
sudo ip netns exec vpc1-public curl http://10.0.2.2:8001

# Private to Public subnet
sudo ip netns exec vpc1-private ping -c 4 10.0.1.2
sudo ip netns exec vpc1-private curl http://10.0.1.2:8000

Expected: ✅ Both directions work (same VPC)

Test 2: NAT Gateway (Internet Access)

# Public subnet - should work
sudo ip netns exec vpc1-public ping -c 4 8.8.8.8
sudo ip netns exec vpc1-public curl -I https://google.com

# Private subnet - should fail
sudo ip netns exec vpc1-private ping -c 4 8.8.8.8

Expected: ✅ Public works, ❌ Private blocked

Test 3: VPC Isolation (Before Peering)

# VPC1 public to VPC2 public
sudo ip netns exec vpc1-public ping -c 2 172.16.1.2

# VPC1 private to VPC2 public
sudo ip netns exec vpc1-private ping -c 2 172.16.1.2

Expected: ❌ Both fail (VPCs isolated)

Test 4: Cross-VPC Communication (After Peering)

# VPC1 public to VPC2 public
sudo ip netns exec vpc1-public ping -c 4 172.16.1.2
sudo ip netns exec vpc1-public curl http://172.16.1.2:8002

# VPC1 private to VPC2 public
sudo ip netns exec vpc1-private ping -c 4 172.16.1.2
sudo ip netns exec vpc1-private curl http://172.16.1.2:8002

# VPC2 public to VPC1 public
sudo ip netns exec vpc2-public ping -c 4 10.0.1.2
sudo ip netns exec vpc2-public curl http://10.0.1.2:8000

# VPC2 public to VPC1 private
sudo ip netns exec vpc2-public ping -c 4 10.0.2.2
sudo ip netns exec vpc2-public curl http://10.0.2.2:8001

Expected: ✅ All combinations work (bidirectional peering)

Test 5: Firewall Rules

# Test allowed port
curl http://10.0.1.2:8000

# Test blocked port
timeout 3 bash -c "echo > /dev/tcp/10.0.1.2/9000" 2>/dev/null && echo "OPEN" || echo "BLOCKED"

Expected: ✅ Port 8000 open, ❌ Port 9000 blocked

Automated Testing

For quick validation of all functionality:

# Run complete test suite (setup + tests)
sudo ./script/setup_vpc.sh

# When done, cleanup all resources
sudo ./script/cleanup_vpc.sh

See Testing.md for detailed manual testing guide.

Project Structure

HNG13-STAGE4-DEVOPS/
├── docs/
│   ├── README.md
│   ├── TESTING.md
│   └── vpc-diagram.jpg
├── html-template/
│   └── service-template.html
├── script/
│   ├── cleanup_vpc.sh
│   └── setup_vpc.sh
├── src/
│   ├── __init__.py
│   ├── firewall_operations.py
│   ├── peering_operations.py
│   ├── service_deployment.py
│   ├── subnet_operations.py
│   ├── vpc_manager.py
│   ├── vpc_operations.py
│── config.py
│── vpccctl.log
│── vpccctl.py
├── .gitignore

How It Works

Network Namespaces provide isolation per subnet
Linux Bridges act as VPC routers
veth Pairs connect namespaces to bridges
iptables handles NAT and firewall rules
tmpfs provides in-memory filesystem isolation

Troubleshooting

# Check logs
tail -f vpcctl.log

# View namespace config
sudo ip netns exec vpc1-public ip addr
sudo ip netns exec vpc1-public ip route

# Check iptables
sudo iptables -L -n -v
sudo iptables -t nat -L -n -v

# View bridges
ip link show | grep br-

Acknowledgments

Built for DevOps Intern Stage 4 Task
Inspired by AWS VPC, Google Cloud VPC, Azure VNet

---

⭐ Star this repo if you find it useful!