VPC Routing, Internet Gateway & NAT Gateway

Every route answers destination → target

A VPC route table is a set of rules that determines where network traffic is directed. Every route has a destination—usually a CIDR block or prefix list—and a target such as the local VPC router, an internet gateway, NAT gateway, VPC peering connection, transit gateway or VPN connection. A subnet is associated with one route table at a time; if no explicit association exists, it uses the VPC's main route table.

AWS generally selects the most specific matching destination using longest-prefix match. For example, a /32 route is more specific than a /24 covering the same address, and a /24 is more specific than the default IPv4 route 0.0.0.0/0. This is a real routing algorithm worth understanding: adding a default route does not override a more specific local or private destination simply because the default route was created later.

Internet gateway: direct public internet path

An internet gateway attaches to a VPC and provides a route target for communication between VPC resources and the internet. In the common IPv4 public-subnet pattern, the subnet route table sends 0.0.0.0/0 to the internet gateway and the instance or interface has a public IPv4 address or Elastic IP. Security groups and network ACLs must also permit the traffic. The route is necessary, but it is not by itself sufficient for internet reachability.

This is why exam scenarios should be read layer by layer. If an EC2 instance has a public IP but the subnet lacks the internet-gateway route, traffic does not have the required path. If the route exists but a security control blocks the relevant protocol and port, the path exists but authorization still fails. Network troubleshooting becomes much faster when routing, addressing and security are evaluated separately.

NAT gateway: outbound IPv4 without direct inbound exposure

A common private-subnet design sends internet-bound IPv4 traffic to a public NAT gateway. The NAT gateway is placed in a public subnet, uses an Elastic IP, and its public subnet routes to the internet gateway. Private instances send their default route to the NAT gateway, which translates source addresses for outbound connections. Return traffic is mapped back to the originating private resource, while unsolicited inbound internet connections are not initiated through that NAT path.

NAT gateways are managed and scale differently from self-managed NAT instances. They also add cost dimensions such as gateway runtime and data processing, so architectures should not send traffic through NAT merely because it is familiar. For supported AWS services, a VPC endpoint may provide a private path that avoids NAT for that service; IPv6 designs use different egress mechanisms and should not assume an IPv4 NAT pattern applies unchanged.

• Public subnet: commonly 0.0.0.0/0 → internet gateway, plus public addressing on resources that need direct IPv4 internet access.
• Private outbound IPv4: commonly private subnet 0.0.0.0/0 → NAT gateway; public NAT gateway subnet 0.0.0.0/0 → internet gateway.
• Isolated subnet: no default internet route; only explicitly routed private/service destinations remain reachable.
• Routes establish paths; security groups and NACLs still decide which traffic is allowed.