The engineering behind the experience
Route a packet. Inspect a translation. Ship a release. Explore the decisions that turn infrastructure into a dependable digital experience.
Beginner mode follows what happens and why it matters. Switch to Technical mode for addresses, headers, connection state, and protocol details.
All addresses, headers, logs, timings and metrics below are illustrative. Nothing sends real packets or changes production.
DEVICE → CLOUD SERVER → DATABASE → DEVICE
Follow a device through NAT and the Internet to a cloud application server. Watch the server query its private database, build a response, and return it to the correct device.
Choose where the application server and database run. Database access stays private in every layout.
Drag to pan · arrow keys pan when the diagram is focused · + / − to zoom · select a packet to inspect
Only the selected TCP/443 connections are shown. A highlighted row matches the visible exchange.
| Device | Inside source | Translated public source | Remote endpoint | State |
|---|---|---|---|---|
| No active mappings. Send a request to create one. | ||||
Laptop A and Mobile B both start at port 51514. Watch PAT assign them different public ports.
Outbound connection tracking allows valid replies without inbound port forwarding. Port forwarding is a separate explicit inbound rule. Carrier-grade NAT may add another translation at the ISP and prevent ordinary inbound hosting. IPv6 commonly uses globally routable addressing without NAT, but still needs a correctly configured firewall. This model uses simplified endpoint-dependent reply matching and a 30-second demo idle lifetime; real NAT policies, timeouts and TCP closing states vary.
Public-looking addresses are reserved documentation ranges: 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24. They are not live Internet destinations.
FRAMES ≠ PACKETS ≠ HTTP MESSAGES
Choose a captured illustrative packet or step through the network journey. Only its endpoints can read TLS-protected HTTP content.
SELECTED PACKET / SEGMENT
Send a request in Network & NAT, then select a packet on its path.
Link-layer MAC addresses apply to the shown hop. Routers replace link headers across routed links. A logical request/response may span many packets.
ENCAPSULATION / DECAPSULATION
Choose a layer to compare its purpose.
Readable HTTP/1.1 examples. HTTP/2 uses binary framing; HTTP/3 uses QUIC over UDP. The NAT demo selects HTTPS over TCP.
PUBLIC EDGE. PRIVATE SERVICES.
Profiles show different components rather than adding every cloud service to every design. Select a node to inspect its responsibilities and failure modes.
The gateway public IP, public edge IP, proxy peer and private origin IP are different addresses.
CF-Connecting-IP, X-Forwarded-For, X-Forwarded-Proto and standardized Forwarded describe the original client or scheme only when supplied through a correctly configured trusted proxy chain. Untrusted callers can forge these headers. Network peer IP is not the same thing as a validated forwarded visitor address.
A reverse proxy often terminates one TLS connection and creates another to the origin. With Cloudflare Tunnel the connector establishes the tunnel outbound; requests and replies use that established bidirectional transport. The connector-to-application hop must be secured separately as the deployment requires.
Safe scenarios change the diagram, response outcome, audit event and simulated monitoring.
COMMIT → CONFIDENCE → RELEASE
Pass the checks, approve a promotion, and compare how deployment strategies preserve—or interrupt—serving capacity.
V1 SERVING
Run the pipeline to move a synthetic commit through review, tests, build, staging and approval.
Shared live database · preserved across application releases
CAPACITY & SAFETY
Blue/green needs capacity for both versions. Rolling updates need enough healthy replicas and suitable rollout limits. A single-instance stop/start has a service gap. Backward-compatible migrations and connection draining matter in every overlapping release.
A successful HTTP health check is a gate, not a guarantee against every functional defect. Rollback needs a retained compatible version; it does not reverse new database records.
GitHub Actions or Azure DevOps can orchestrate CI/CD. Docker packages immutable images. Terraform and other infrastructure-as-code tools version infrastructure changes. A secrets manager supplies runtime credentials. New Relic-style APM, traces and centralized logs help investigate performance. These are educational examples—not claims of installed integrations.
All dashboard values and logs are simulated; they react to the selected security event, pipeline and incident.
INCIDENT RESPONSE
Trigger a synthetic outage or slowdown, then investigate, identify the cause, apply a correction and verify recovery.
No events yet. This is not a live production log.
Three architectures. Three clear boundaries.
Explore a separate high-level diagram for each cloud model. These are illustrative designs, not a map of Dhruvexa production infrastructure. Select a component to learn what it does.
Provider-managed infrastructure. Private application data.
A public-cloud provider operates the resource pool. Public cloud does not mean every service has a public IP: application targets and databases can stay private.
Elastic capacity · managed services · usage-based operation
A dedicated cloud environment for one organization.
A private-cloud control plane provisions a dedicated pool of compute, network and storage resources. This is more than placing a single server behind a private IP. Access can be internal or through explicitly protected ingress.
Controlled capacity · dedicated resources · organization-operated policies
Public-cloud applications. Connected private-cloud services.
Distinct public and private cloud environments are joined by configured connectivity. In this example the app runs in public cloud and queries a private-cloud database. Routing, latency, identity and firewall policies must work across both environments.
Workload placement · controlled data location · connected operations
Thoughtful engineering. Visible value.
Build secure, scalable, and reliable digital solutions with Dhruvexa.
Discuss your architecture