Learning outcomes
- Trace one connection through names, addresses, routes, translation, ports, and policy.
- Separate endpoint reachability from authenticated identity and authorization.
- Find asymmetric, alternate, failover, and direct-origin paths.
- Test IPv4, IPv6, internal, external, and recovery behavior.
System and boundaries
Reachability depends on name resolution, source and destination addresses, prefixes, route tables, gateways, network address translation, load balancers, firewall or security-group rules, ports, protocols, and return paths. Each component answers where traffic can go. It does not prove who the user is or whether the application action is allowed.
Request and decision flow
- Resolve the client-facing name and select an address.
- Select a local route and source address.
- Traverse gateways, translation, filtering, and load balancing.
- Reach the access enforcement point on the expected protocol and port.
- After access policy allows, repeat the process from the gateway to the upstream.
- Authenticate each service endpoint separately from routing.
Failure domains
Failures include overlapping prefixes, wrong default routes, asymmetric return paths, stale DNS, translation exhaustion, IPv6 paths missed by IPv4 rules, health checks that bypass policy, failover to an old origin, broad security groups, and direct private access around the gateway.
Design tradeoffs and residual risk
Private addressing reduces public exposure and can hide broad internal reach. Translation conserves addresses and removes original endpoint context. Dynamic routing improves failover and can propagate unsafe reachability. Central ingress simplifies control and concentrates outage risk.
Residual risk includes unknown network attachments, compromised routers, tunnels, cloud peering, and application authority after connectivity succeeds.
Pomerium boundary
Pomerium requires clients to reach the configured route and Pomerium to reach the upstream. It supplies identity-aware policy on the protected path. Operators own DNS, addresses, routes, translation, firewalls, load balancers, endpoint TLS, and direct-path isolation.
Exercise
Trace one browser route and one non-HTTP route from client to Pomerium and from Pomerium to upstream. Record DNS answers, address family, source and destination, prefix, next hop, translation, port, filter, load balancer, and return path.
Test IPv4, IPv6, internal DNS, external DNS, failover, another subnet, another cloud attachment, and direct origin. Label which successful tests prove reachability only.
Evaluation checklist
- Can each hop identify its source, destination, prefix, next hop, port, and protocol?
- Do IPv4, IPv6, internal, external, and failover paths have explicit results?
- Is endpoint authentication separate from DNS and routing?
- Can a client or workload reach the upstream without the access policy?
- Does the return path preserve the expected state and evidence?
Next learning unit
Ingress and Egress
Place controls on traffic entering and leaving a workload boundary without treating direction or network location as identity.
