Stop 03 · Networking FundamentalsTopics · 8/9

VPNs & Private Networking

In short

Your databases and admin panels shouldn't be on the public internet at all. Private networks keep them hidden, and a VPN is how you and your team reach them safely from anywhere.

Creating secure, private connections over a public network — used to access internal infrastructure securely without exposing it directly to the internet.

The mascot sits on a city bus holding a locked courier pouch tightly on its lap.

Think of it like this

A sealed pouch on a public bus

An office sends documents across the city in a sealed, locked pouch on a regular public bus. Anyone can see the bus, but nobody can read what's inside. Only the branch office has the key. A VPN sends your traffic across the internet the same way.

Watch it happen

Reaching a private database through a VPN

Your laptop

VPN gateway

DB 10.0.2.5

psql 10.0.2.5

1/6Without the VPN, this fails. 10.0.2.5 is a private address that the internet can't route to.

The big ideas

What you need to know

Private IP ranges

10.x, 172.16 to 172.31, and 192.168.x are reserved for private networks. The internet doesn't route them.

Cloud VPCs

A VPC is your own private network in the cloud. Put databases in private subnets with no public IP.

Site-to-site vs remote access

Site-to-site links two networks, like office and cloud. Remote access VPNs connect individual laptops.

Bastion as an alternative

Some teams use one hardened jump server or cloud session tools instead of a VPN to reach private machines.

See it in code

Walk through the code

ini

1# /etc/wireguard/wg0.conf on your laptop2[Interface]3PrivateKey = <laptop-private-key>4Address = 10.8.0.7/325 6[Peer]7PublicKey = <gateway-public-key>8Endpoint = vpn.example.com:518209AllowedIPs = 10.0.0.0/16

1/3Your side: your private key and the private address you get inside the VPN.

Bring it up with sudo wg-quick up wg0. Only traffic for 10.0.0.0/16 goes through the tunnel. Everything else uses your normal internet.

Save yourself the pain

Common mistakes

Oops

Giving the database a public IP and relying on a strong password.

Do this instead

Keep databases in a private subnet with no public IP. Reach them through a VPN, bastion or the app itself.

Oops

Sharing one VPN config file across the whole team.

Do this instead

Give each person their own keys, so you can remove one person's access without changing everyone's config.

Your mission

Map your private network

~20 min

Quick check

Why can't someone on the internet connect directly to a database at 10.0.2.5?

Go deeper

1Learn the basic concept of how a VPN tunnels traffic securely.
2Explore a cloud provider's private networking options (e.g. VPC peering, private subnets).
3Understand why sensitive infrastructure is typically placed in a private subnet, not public-facing.