DEEP DIVE For the parts you can't afford to spin up on real AWS

Practice AWS networking.
Without the AWS bill.

An interactive simulator for Transit Gateway, Direct Connect, BGP, and VIFs. Build a topology, run a connectivity trace, and see exactly where the path breaks — and why.

Open the simulator free · no signup
no aws account no $2,000 lab bill runs in your browser
trace · 10.0.1.10 → 192.168.0.55 live
◆ vpc · VPC-A 10.0.0.0/16 SUBNET · PRIVATE us-east-1a subnet-a1 10.0.1.0/24 ◆ vpc · VPC-B 10.1.0.0/16 subnet-b1 10.1.0.0/24 VIRTUAL GATEWAY vgw-a ASN 64512 VIRTUAL GATEWAY vgw-b DX GATEWAY dxgw-main ASN 64600 2 VIFs DIRECT CONNECT dx-iad 10Gbps REACHED
forward · 7 hops 01subnet-a1 vpc_rt vgw-a dxgw vif-1 dx-iad cgw-1 reached
§ 01 · THE PROBLEM

The hard topics are the ones you can't afford to practice.

A technical audience trusts figures, not adjectives. So here are the figures.

The hardest AWS networking domains — TGW routing, Direct Connect, BGP path selection, VIFs, DXGW — are exactly the ones that are prohibitively expensive and often structurally impossible to build on real AWS as a solo learner.

Dedicated Direct Connect doesn't just cost money — it requires physical presence at an AWS DX colo facility. Most learners literally cannot build a multi-VIF DXGW + transit-VIF + BGP lab at any price. So they read diagrams and hope.

aws · estimated 2-month study lab INVOICE
  • Dedicated Direct Connect
    1 Gbps port
    $216 / mo
  • Colo rack + cross-connect
    required for dedicated DX
    $500–2,000 / mo
  • Transit Gateway
    base + per-attachment + per-GB
    metered
  • Site-to-Site VPN, NAT GW
    hourly + data processing
    metered
  • Public IPv4 + data transfer
    while you fumble scenarios
    metered
total, ~2 months $500 – $2,500+
§ 02 · WHAT IT DOES

Three things, done well. Nothing else.

Not a course. Not a video library. A simulator that responds to the exact networking decisions real AWS makes.

01 · BUILD
VPC-A VPC-B TGW

Build a topology

Drop VPCs, gateways, VIFs, and on-prem peers onto a canvas — or paste a YAML topology and watch it render. Fourteen service primitives, real CIDR math, real ASNs.

02 · TRACE
src dst vgw

Run a connectivity trace

Pick a source IP and destination IP. TransitLab evaluates route tables, propagation, allowed prefixes, and BGP best-path — hop by hop — the way AWS does.

03 · EXPLAIN
01 subnet-a1 → vpc_rt 02 vpc_rt → vgw-a 03 dxgw ✗ no allowed_prefix 04 …

See where it breaks — and why

When a trace fails you get the line: the missing prefix, the blackhole route, the propagated route that loses to a more-specific static. Not "check your config."

§ 03 · THE SIMULATOR

YAML in, topology out, trace running.

Your topology is text — source-controllable and diff-able, like terraform plan. The canvas is the rendering.

examples / dxgw-multi-vpc ● 7 hops · reached
TOPOLOGY · YAML LIVE 010203 040607 091011 121314 151617 # DXGW with multi-VPC reach # two VPCs in different /16s # one DXGW assoc. both VGWs # one DX, one private VIF id:topo-dxgw-multi-vpc name:"DXGW: multi-VPC" accounts: -id:acct-prod vpcs: -id:vpc-a cidr:"10.0.0.0/16" subnets: -id:subnet-a1 cidr:"10.0.1.0/24" + VPC + TGW + VGW + DX + DXGW + CGW ◆ vpc · VPC-A 10.0.0.0/16 SUBNET · PRIVATE us-east-1a subnet-a1 10.0.1.0/24 ◆ vpc · VPC-B 10.1.0.0/16 SUBNET · PRIVATE us-east-1b subnet-b1 VIRTUAL GATEWAY vgw-a ASN 64512 VIRTUAL GATEWAY vgw-b DX GATEWAY dxgw-main ASN 64600 2 VIFs · 1 DX DIRECT CONNECT dx-iad 10Gbps · us-east-1 TRACE source IP 10.0.1.10 destination IP 192.168.0.55 run trace RESULT REACHED FORWARD PATH 01subnet · subnet-a1Source 10.0.1.10 in subnet-a1 02vpc_rt · rt-a0.0.0.0/0 → vgw-a 03vgw · vgw-aAttached to vpc-a, ASN 64512 04dxgw · dxgw-mainAmazon-side ASN 64600 05vif · vif-1Private VIF (cgw-1) 06dx · dx-iad10Gbps, us-east-1 EQDC2 07cgw · cgw-1Reached on-prem (ASN 65001)
§ 04 · COVERAGE

The expensive parts of AWS networking. Simulated.

The simulator implements the behavior, not a UI skin. Seventeen primitives and real route evaluation.

VPC
VPC + Subnets
CIDR allocation, route tables, public/private subnets derived from IGW routes.
TGW
Transit Gateway
Attachments, association vs. propagation, blackhole routes, appliance mode, Connect, peering.
VGW
Virtual Gateway
VPC attachment, ASN assignment, route propagation.
DX
Direct Connect
Dedicated + hosted, LAG, jumbo frames, MACsec, location/region.
DXGW
Direct Connect Gateway
VGW & TGW associations, allowed prefixes, SiteLink, cross-region reach.
VIF
Virtual Interfaces
Private, public, and transit VIFs — VLAN, BGP peering.
CGW
Customer Gateway
On-prem peer, ASN, advertised prefixes, route filtering.
VPN
Site-to-Site VPN
Static vs. BGP, tunnel up/down failover over TGW or VGW.
BGP
BGP best-path selection
LOCAL_PREF, AS_PATH length & prepend, MED, communities, longest-prefix match, ECMP. The subtle behavior lives here — so does the evaluator.
IGW / NAT
Internet edge
IGW attach, public + private NAT, egress route evaluation.
PL
Prefix lists
Managed prefix-list references in TGW route tables.
PEER
VPC Peering
Intra/inter-region pcx, non-transitive routing, CIDR-overlap rules.
PLINK
PrivateLink
Interface + gateway VPC endpoints, service prefixes, endpoint policy.
GWLB
Gateway Load Balancer
Forced inspection through an appliance fleet — perimeter-VPC routing.
§ 05 · WHERE IT FITS

Nobody else simulates the routing.

Quiz banks

Tutorials Dojo

Test recall. Never hands-on.

Video courses

Cantrill · Maarek

Great teaching — but the labs run on your AWS bill.

API mocks

LocalStack · Floci

Fake the control plane so SDKs talk. No routing.

LocalStack mocks the AWS control plane. TransitLab models the data plane — the routing itself.

A different category. An interactive AWS networking simulator that didn't exist until now.

§ 06 · WHY I BUILT IT

I've run networks for twenty years — and going deep on AWS's hybrid-networking stack still humbled me. Not the concepts, but that I couldn't afford to practice the topics that mattered on real AWS.

So I built the thing I needed: a simulator that models the routing faithfully enough to learn from, with none of the bill. This is it.

network engineer · building TransitLab
Read the full story
  • $0 aws No AWS account, no idle charges. The whole thing runs in your browser — nothing to provision, nothing to tear down before the bill arrives.
  • deterministic Same topology, same trace, same result — always. Route evaluation is a pure function, so you can diff what BGP did on Tuesday vs. today.
  • break it Sandbox the failure modes you'd never trigger on real AWS. Drop a propagated route. Inject a more-specific static. Misconfigure allowed_prefixes. Watch the path break.
  • portable YAML topologies, like Terraform. Share one in a PR or a study-group note; bisect a routing problem by version-controlling the network.
§ 07 · WHAT IT COSTS

It's free.

TransitLab is a learning tool, and it's free to use — no paywall, no subscription, no AWS bill. Open it in your browser and start tracing.

  • Free to use — no subscription, no per-hour metering, no credit card
  • Every topic: TGW core, hybrid VPN + BGP, the full Direct Connect suite
  • Runs in your browser — nothing to provision, nothing to tear down
§ 08 · READY WHEN YOU ARE

Practice the hard parts.
Skip the bill.

It's free and runs in your browser — no signup, no aws configure required.

Building in the open · join the community on Telegram