Networking you actually need
You do not need to be a network engineer to design systems, but you need a small set of ideas: addresses and ports, TCP and UDP, the HTTP versions, certificates, and how a safe network is laid out. With these you can look at a server setup and spot the door that was left open.
By the end you can
- Tell public from private IP addresses and explain what a port is
- Explain how TCP makes delivery reliable, and when UDP is the better fit
- Say what HTTP/2 and HTTP/3 change for slow mobile networks
- Draw a safe layout: firewall, reverse proxy, private app servers, hidden database
- Put Nginx with TLS in front of a NestJS app and lock down the ports
The everyday picture
TCP is a registered courier. Every parcel has a number. The person who receives it signs for it. If no signature comes back in time, the courier sends that parcel again. Parcels are handed over in the order they were sent. It is slower, but nothing goes missing without someone knowing.
UDP is an announcement over the loudspeaker at a busy bus station: "The 7 pm bus to the city centre is leaving from gate 3." It is fast and reaches everyone in range at once, but nobody confirms they heard it. If a truck horn drowns out one word, the speaker does not repeat it. For a live announcement, that is fine. By the time you repeated it, the news would be old anyway.
Addresses and ports
Every machine on a network has an IP address. A public address can be reached from anywhere on the internet. A private address works only inside one local network. Three ranges are reserved for private use: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Hundreds of Mangrove stores can all use 192.168.1.21 for a handscanner without conflict, because those addresses never leave the store.
One machine runs many programs, so an address alone is not enough. A port picks the program, like a counter number inside a post office. The ports you will see most: 22 for SSH, 80 for HTTP, 443 for HTTPS, 5432 for Postgres, 6379 for Redis, and 3000 for a Node app in development.
When a program listens on a port, it also chooses which addresses it accepts connections on. This choice is a security decision:
127.0.0.1(also called localhost) accepts connections only from the same machine.- A private address like
10.0.2.10accepts connections from the private network. 0.0.0.0means every address the machine has, including the public one. Use it with care.
Quick check
A request has reached the right machine. What decides which program on that machine receives it?
The IP address only finds the machine, and the DNS name was already turned into that address. The port number picks the program: 443 for Nginx, 5432 for Postgres, and so on.