**Network Diagram Description for AI Generation:** **1. AWS VPC (Virtual Private Cloud):** - **Label:** `ASL Internet Monitoring VPC` - **CIDR Block:** `10.0.0.0/16` - **Components:** - **Internet Gateway (IGW):** Attached to the VPC for public internet access. Label: `IGW-ASL`. - **NAT Gateway:** Placed in the public subnet to allow private subnet resources to access the internet. Label: `NAT-GW`. --- **2. Subnets:** - **Public Subnet 1:** - **CIDR:** `10.0.1.0/24` - **Availability Zone:** `ap-southeast-2a` (or your preferred AWS region). - **Components:** - **Squid Proxy Server (Linux):** - **Label:** `Squid-Proxy` - **Security Group:** - Allows **HTTP (80)/HTTPS (443)** inbound from private subnet CIDR. - Allows **outbound** traffic to Splunk server (Port 8089) and the internet. - **Role:** Routes all web traffic from private subnet clients, logs traffic to Splunk. - **Jump Host Server (Linux):** - **Label:** `Jump-Host-Bastion` - **Security Group:** - Allows **SSH (22)** and **RDP (3389)** inbound from trusted admin IP ranges. - Allows outbound to private subnet (for administrative access). - **Role:** Bastion host for admins to access private instances via SSH/RDP. - **Splunk Server (Linux):** - **Label:** `Splunk-Monitoring` - **Security Group:** - Allows **TCP 9997** (Splunk forwarder) inbound from Squid and Windows clients. - Allows **SSH (22)** from Jump Host. - **Role:** Ingests proxy and client logs, generates real-time alerts for forbidden URLs. - **Private Mehr sehen