intermediategeneral

How does VPC networking work — subnets, route tables, NAT gateways, and CIDR allocation?

⚡

Quick Answer

A VPC is an isolated virtual network defined by a CIDR block. It contains public subnets (with Internet Gateway routes) and private subnets (with NAT Gateway routes for outbound-only internet). Route tables control traffic flow, and CIDR allocation must be planned to avoid overlap with peered VPCs or on-premises networks.

Detailed Answer

A Virtual Private Cloud (VPC) is your isolated section of the AWS cloud — think of it as your own private office building within a massive shared complex. You control the floor plan (CIDR block), the rooms (subnets), the hallways between rooms (route tables), and the doors to the outside world (gateways).

CIDR allocation is the foundation. When you create a VPC, you assign a primary CIDR block, such as 10.0.0.0/16, which gives you 65,536 IP addresses. This is like choosing the size of your building lot before construction. The critical production consideration is planning for growth and peering. If your payments VPC uses 10.0.0.0/16 and your analytics VPC also uses 10.0.0.0/16, you cannot peer them because overlapping CIDR blocks create routing ambiguity. Many organizations adopt a structured allocation scheme: 10.0.0.0/16 for production, 10.1.0.0/16 for staging, 10.2.0.0/16 for development, and 172.16.0.0/12 reserved for on-premises connectivity via Direct Connect.

Subnets divide the VPC CIDR into smaller segments, each tied to a single Availability Zone. A /16 VPC might be split into /24 subnets, each with 251 usable IPs (AWS reserves 5 per subnet: network address, VPC router, DNS server, future use, and broadcast). Public subnets host resources that need direct internet access — load balancers, bastion hosts, NAT gateways. Private subnets host application servers, databases, and backend services that should never be directly reachable from the internet. The distinction between public and private is not a property of the subnet itself but entirely determined by the route table associated with it.

Route tables are the traffic control system. Every subnet must be associated with exactly one route table. A public subnet's route table has a route like 0.0.0.0/0 pointing to an Internet Gateway (IGW), which allows bidirectional internet traffic. A private subnet's route table has 0.0.0.0/0 pointing to a NAT Gateway, which allows outbound-only internet access. The local route (10.0.0.0/16 → local) is automatically present and enables intra-VPC communication. You can add more specific routes for VPC peering, Transit Gateway, VPN connections, or VPC endpoints.

NAT Gateways sit in a public subnet and enable private subnet resources to initiate outbound connections (pulling Docker images, downloading OS patches, calling external APIs) without exposing them to inbound internet traffic. Think of it as a one-way mirror: your servers can see out, but the internet cannot see in. NAT Gateways are managed, highly available within an AZ, and charged per hour plus per GB processed. A common production mistake is deploying only one NAT Gateway for the entire VPC — if that AZ goes down, all private subnets lose internet access. Best practice is one NAT Gateway per AZ with AZ-specific route tables.

The Internet Gateway is a horizontally scaled, redundant VPC component that performs network address translation for instances with public IPs. Unlike NAT Gateways, IGWs are free and have no bandwidth limits. They are attached at the VPC level but only affect subnets whose route tables direct 0.0.0.0/0 traffic to the IGW.

In production multi-account architectures, VPCs are connected via Transit Gateway, which acts as a central hub. This avoids the O(n^2) complexity of full-mesh VPC peering. Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level) add defense-in-depth. VPC Flow Logs capture metadata about all traffic for security analysis and troubleshooting.

# Create the production payments VPC with a /16 CIDR block aws ec2 create-vpc \ --cidr-block 10.0.0.0/16 \ --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=payments-vpc},{Key=Environment,Value=production}]' # --cidr-block: allocates 65536 IPs for the entire payments platform # --tag-specifications: names the VPC for console visibility and cost allocation # Create a public subnet in us-east-1a for load balancers and NAT gateways aws ec2 create-subnet \ --vpc-id vpc-0a1b2c3d4e5f67890 \ --cidr-block 10.0.1.0/24 \ --availability-zone us-east-1a \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=payments-public-us-east-1a},{Key=Tier,Value=public}]' # --vpc-id: references the payments VPC created above # --cidr-block: carves out 251 usable IPs from the VPC range for this subnet # --availability-zone: pins this subnet to a single AZ for fault isolation # Create a private subnet in us-east-1a for payment processing application servers aws ec2 create-subnet \ --vpc-id vpc-0a1b2c3d4e5f67890 \ --cidr-block 10.0.10.0/24 \ --availability-zone us-east-1a \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=payments-private-app-us-east-1a},{Key=Tier,Value=private}]' # --cidr-block: uses the 10.0.10.x range reserved for private application tier # Separated from public range (10.0.1.x) for clear network segmentation # Create an Internet Gateway and attach it to the payments VPC aws ec2 create-internet-gateway \ --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=payments-igw}]' # Creates the gateway that enables bidirectional internet access for public subnets aws ec2 attach-internet-gateway \ --internet-gateway-id igw-0abcdef1234567890 \ --vpc-id vpc-0a1b2c3d4e5f67890 # Attaches the IGW to the payments VPC — required before any public routing works # Allocate an Elastic IP for the NAT Gateway in us-east-1a aws ec2 allocate-address \ --domain vpc \ --tag-specifications 'ResourceType=elastic-ip,Tags=[{Key=Name,Value=payments-nat-eip-us-east-1a}]' # --domain vpc: allocates a static public IP that persists across NAT Gateway replacements # Create a NAT Gateway in the public subnet for private subnet outbound access aws ec2 create-nat-gateway \ --subnet-id subnet-0pub1a2b3c4d5e6f7 \ --allocation-id eipalloc-0a1b2c3d4e5f67890 \ --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=payments-nat-us-east-1a}]' # --subnet-id: places the NAT Gateway in the public subnet so it can reach the IGW # --allocation-id: assigns the stable Elastic IP to the NAT Gateway # Create a route table for private subnets and add the NAT Gateway route aws ec2 create-route-table \ --vpc-id vpc-0a1b2c3d4e5f67890 \ --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=payments-private-rt-us-east-1a}]' # Creates a dedicated route table for private subnets in this AZ aws ec2 create-route \ --route-table-id rtb-0priv1a2b3c4d5e6f \ --destination-cidr-block 0.0.0.0/0 \ --nat-gateway-id nat-0a1b2c3d4e5f67890 # --destination-cidr-block 0.0.0.0/0: default route for all non-VPC traffic # --nat-gateway-id: sends outbound internet traffic through the NAT Gateway # Associate the private route table with the private application subnet aws ec2 associate-route-table \ --route-table-id rtb-0priv1a2b3c4d5e6f \ --subnet-id subnet-0priv1a2b3c4d5e6f # Links this route table to the private subnet, making NAT the outbound path

How does VPC networking work — subnets, route tables, NAT gateways, and CIDR allocation?

More AWS questions