System design · Level 0: Basics · Module B3 of 6

Networks in plain terms: addresses, ports, layers, DNS and proxies

Every arrow you draw between two boxes is a network: messages broken into packets, addressed, routed across many machines and reassembled. You don't need to be a network engineer for system design, but you do need the basic vocabulary: what an IP address and a port are, what the layers do, how a name becomes an address, and what sits in between (routers, NAT, firewalls, proxies). Module 06 goes deep on TCP, UDP and HTTP; this module is the ground floor.

1. The idea

Sending a letter to a big company. You look the company up in a phone book to find its street address (DNS → IP address). On the envelope you add the department (the port), because one building has many departments. Your letter goes into an envelope, which the post office puts into a sorting bag, which goes into a lorry (layers, each wrapping the one inside). Sorting offices pass it along, each only deciding the next hop (routers). The company's mailroom receives everything at one street address and hands letters to the right desk (NAT, or a reverse proxy).

Term	What it means	Example
IP address	The address of a machine's network interface. IPv4 has 4 numbers; IPv6 is longer and has far more addresses.	`203.0.113.10`, `2001:db8::1`
Public vs private address	Public addresses are reachable on the internet; private ones (like 10.x.x.x and 192.168.x.x) work only inside a network.	Your laptop at home is 192.168.1.20
Port	A number (0–65535) that picks which program on the machine gets the message.	443 for HTTPS, 5432 for PostgreSQL
Packet	A small chunk of data with addresses on it. Big messages are split into many packets.	About 1,500 bytes on most networks
Protocol	An agreed set of rules for a conversation.	IP, TCP, UDP, HTTP, DNS
TCP and UDP	TCP delivers bytes reliably and in order; UDP sends independent packets with no guarantees, but faster.	Web pages use TCP (or QUIC over UDP); video calls use UDP
DNS	The internet's phone book: turns names into IP addresses.	`shop.example.com` → `203.0.113.10`
Router	Forwards packets one hop closer to their destination.	Your home router, the internet's backbone routers
NAT	Network address translation: lets many private machines share one public address.	Every device in your home appears as one address
Firewall	Allows or blocks traffic by address, port and direction.	"Only port 443 from the internet; port 5432 only from the app servers"
Forward vs reverse proxy	A forward proxy acts for clients going out; a reverse proxy sits in front of servers and receives traffic for them.	An office web filter (forward); Nginx in front of your app (reverse)

Networking is organised in layers. Each one solves one problem and relies on the one below:

Layer	Its job	Addresses it uses	Examples
Application	What the conversation means	Names, URLs	HTTP, DNS, gRPC, SMTP
Transport	Which program, and how reliably	Ports	TCP, UDP (QUIC builds on UDP)
Internet	Which machine, across many networks	IP addresses	IPv4, IPv6
Link	The next hop on this cable or radio	MAC addresses	Ethernet, Wi-Fi

You'll also hear the seven-layer OSI model. In interviews only three of its numbers matter: layer 7 (application, such as HTTP), layer 4 (transport, TCP and UDP) and layer 3 (IP). "An L4 load balancer" sees addresses and ports; "an L7 load balancer" understands HTTP (Module 08).

2. How it works

Envelopes inside envelopes

When your browser sends a request, each layer wraps the data from the layer above with its own header, like putting a letter into successively bigger envelopes. The receiver opens them in reverse order. Press Play.

From a name to an address: DNS

Your computer asks a resolver (run by your internet provider, or a public one), which asks a chain of servers on your behalf and remembers the answer for as long as its TTL (time to live) allows.

Sharing one address: NAT

Most devices have private addresses. The router rewrites the source address and port on the way out, remembers the mapping, and rewrites the reply on the way back. That's also why a server on the internet can't start a connection to your laptop.

Forward and reverse proxies

3. Try it yourself

Take a URL apart

Type or pick a URL. Each part is used by a different layer or system, and one part never leaves your browser.

What kind of address is this?

Type an IP address (IPv4 or IPv6) to see whether it can be reached from the internet.

4. Trade-offs

TCP vs UDP

TCP gives reliable, ordered bytes at the cost of a handshake and waiting for lost packets. UDP is immediate and lossy; apps that prefer a late packet to be dropped (live video, games) use it, and QUIC builds reliability on top of it. Details in Module 06.

Short vs long DNS TTLs

Short TTLs let you move traffic quickly (failover, migrations), but every client asks again more often. Long TTLs are cheap and fast, but a change takes that long to reach everyone.

A proxy in the middle

A reverse proxy adds a hop and one more thing to run, and gives you one place for HTTPS, routing, caching, rate limiting and hiding your servers. Almost every production system has one.

Private networks and NAT

Putting databases and app servers on private addresses keeps them unreachable from the internet; they reach out through a NAT gateway when they need to. The cost is some setup and an extra component for outbound traffic.

5. In real systems

Ports you'll see in designs:

Port	Used by	Port	Used by
22	SSH (remote login)	5432	PostgreSQL
53	DNS	3306	MySQL
80	HTTP	6379	Redis
443	HTTPS (and HTTP/3 over UDP)	9092	Kafka

A typical cloud network (a VPC) has public subnets holding only the load balancer, and private subnets for app servers and databases. Firewall rules (security groups) say exactly who may talk to whom: the internet reaches port 443 on the load balancer; only the load balancer reaches the app servers; only app servers reach the database's port. Outbound calls from private subnets go through a NAT gateway.

Say it in the interview

Two-sentence answers

"IP address vs port?" The IP address picks the machine; the port picks the program on it. A connection is identified by both ends' addresses and ports.
"What does DNS do, and what's a TTL?" It turns names into addresses through a chain of servers, and resolvers cache the answer for its TTL. Short TTLs allow fast failover; long ones reduce lookups.
"Forward vs reverse proxy?" A forward proxy represents clients going out; a reverse proxy represents servers, receiving traffic for them. Load balancers and API gateways are reverse proxies.

Red flags interviewers notice

A database with a public address "for convenience".
Expecting a DNS change to take effect instantly everywhere.
Mixing up layer 4 and layer 7 when choosing a load balancer.

6. Remember it

Memory hook: "Name, address, door, conversation"DNS turns the name into an address; IP gets you to the building; the port is the door; the protocol is the conversation you have inside.

How this hook works: what "Name, address, door, conversation" means

What the slogan means, phrase by phrase

"Name": A domain name, which people remember: shop.example.com.
"address": The IP address DNS returns; routers use it to deliver packets.
"door": The port: which program on that machine gets the packets.
"conversation": The protocols: TCP or UDP for delivery, then HTTP (or another) for meaning.

Why this picture fits: it follows the layers from the top down, in the order a connection actually happens.

The story → the concept

Letter to a company	Network
Phone book	DNS
Street address	IP address
Department	Port
Envelopes inside envelopes	Layers and headers
Sorting offices	Routers
Company mailroom	NAT and reverse proxies

7. Common mistakes

Exposing internal servicesDatabases, caches and admin tools belong on private addresses behind firewall rules, never directly on the internet.

Assuming the network is reliable and instantPackets get lost, delayed and reordered. Every network call needs a timeout and a plan for failure (Module 24).

Forgetting DNS cachingAfter a change, clients keep using the old address until their cached answer expires; some ignore TTLs entirely. Plan migrations with overlap.

Trusting the client's IP addressBehind proxies and NAT, many users share one address and the address you see may be the proxy's. Use the forwarded header from your own proxy, carefully.

8. Design exercise (20 minutes)

Draw the network (10 min). For a web app with a load balancer, three app servers, PostgreSQL and Redis, draw the public and private subnets and write every firewall rule: source, destination, port.
Trace a request (5 min). List every layer and lookup that happens when a phone opens https://api.example.com/feed for the first time.
Plan a move (5 min). You must move the API to new servers with new IP addresses without downtime. Which TTL would you set beforehand, and when?

9. Self-check quiz

What does a port number decide?

The IP address picks the machine; the port picks the program.

Which of these addresses is private?

10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are the private ranges.

You changed a DNS record. Why do some users still reach the old server?

Caching makes DNS fast and changes slow.

Nginx receives all internet traffic and forwards it to your app servers. What is it acting as?

It represents the servers to the outside world.

A load balancer that only looks at IP addresses and ports works at which layer?

Ports belong to the transport layer; reading HTTP paths would be layer 7.

10. Go deeper

Resource	Time	Why
How the web works (MDN)	10 min	A plain-language overview for beginners.
What happens when you update your DNS? (Julia Evans)	15 min	Resolvers, caches and TTLs, with clear diagrams.
Proxy servers and tunneling (MDN)	10 min	Forward and reverse proxies, and the headers they add.
RFC 1918	10 min	The short standard that defines private IPv4 ranges.
High Performance Browser Networking (Ilya Grigorik)	Chapters 1–3	Latency, bandwidth, TCP and UDP from the ground up.