Ctrl K
Course outline

3.3

Internet Gateway and Route Tables

How a packet leaves a subnet: route lookup, longest prefix match, what makes a subnet public, and the classic misconfigurations.

24 min Reading + animations

Tip: tap or hover any dotted-underlined term to see what it means.

By the end of this lesson you will be able to

  • Explain what the VPC router does and how a route table decides where each packet goes.
  • Apply the longest prefix match rule to any route table, including tricky overlaps.
  • Describe the internet gateway: what it is, its limits, and the address translation it performs.
  • State exactly what makes a subnet public, and why the instance also needs a public address.
  • Troubleshoot “my instance has no internet” with a fixed checklist, for public and private subnets.

#Every packet goes to the VPC router first

Inside a VPC there is no box you install called “the router”. Instead, every subnet has an implicit VPC router, a managed function that AWS runs for you. Its address is the subnet’s base + 1 (for 10.0.0.0/24 that is 10.0.0.1, one of the five reserved addresses from lesson 3.2), and every instance uses it as its default gateway.

Whenever an instance sends a packet to an address outside its own subnet, the packet goes to the VPC router. The router looks at the destination address and consults one thing: the route table associated with the source subnet.

#Route tables

A route table is a list of rules. Each route has two parts:

  • Destination: a CIDR block (10.1.0.0/16, 0.0.0.0/0…), meaning “packets going to addresses in this range…”
  • Target: where to send them: the local VPC, an internet gateway (igw-…), a NAT gateway (nat-…), a VPN gateway (vgw-…), a peering connection (pcx-…), a transit gateway (tgw-…), a VPC endpoint (vpce-…), or a network interface (eni-…).

How route tables attach to subnets:

RuleDetail
Main route tableCreated with the VPC. Any subnet you do not explicitly associate uses it.
Custom route tablesYou create as many as you need, for example one for public subnets and one per AZ for private subnets.
One table per subnetA subnet is associated with exactly one route table at a time.
Many subnets per tableOne route table can serve many subnets.
The local routeEvery route table contains VPC CIDR → local. It is added automatically and cannot be deleted, so every subnet in a VPC can always reach every other subnet (firewalls permitting).

#Longest prefix match

A destination address often matches several routes. 0.0.0.0/0 matches everything, after all. The rule that decides is simple and absolute:

The route with the longest prefix (the most specific match) wins. The order of routes in the table does not matter.

How the VPC router picks a path

One instance, four destinations. For each packet the router finds every route that matches and uses the most specific one.

Scenario

VPC10.0.0.0/16
App subnet10.0.10.0/24
Data subnet10.0.20.0/24
Peer VPC10.1.0.0/16
Office192.168.0.0/16
App server10.0.10.10
Database10.0.20.5
VPC router
Internet gateway
Internet198.51.100.7
Peering
Service10.1.3.4
VPN gateway
File server192.168.5.9
→ 10.0.20.5

Route table of the app subnet

DestinationTarget
10.0.0.0/16local
10.1.0.0/16pcx-0b2c (peering)
192.168.0.0/16vgw-0a1b (VPN)
0.0.0.0/0igw-0f9e
Step 1 of 3
1

The app server sends to the database at 10.0.20.5. Every packet leaving an instance goes first to the VPC router at the subnet’s base + 1 (10.0.10.1).

Points from the animation:

  • 10.0.20.5 matches both 10.0.0.0/16 and 0.0.0.0/0; /16 wins, so VPC-internal traffic always stays local.
  • More specific routes override broader ones, which is how you send one range through a VPN or peering connection while everything else goes to the internet.
  • The same rule is dangerous: a single overly specific route pointing at the wrong target quietly diverts just that traffic.

#The internet gateway

An internet gateway (IGW) is the door between a VPC and the public internet.

PropertyDetail
Managed and highly availableAWS runs it redundantly across the Region; it is not a single box that can fail.
Scales horizontallyNo bandwidth limit of its own and no capacity to choose.
Created separatelyYou create an IGW and then attach it to a VPC.
One-to-oneA VPC can have at most one IGW attached, and an IGW can attach to only one VPC.
FreeThe gateway itself costs nothing; you pay for data transferred out to the internet.
Address translationIt performs one-to-one NAT between each instance’s private IPv4 address and its public IPv4 address.

That last row matters. An instance’s operating system only ever has its private address; run ip addr on a Linux instance with a public IP and you will not find the public one. The internet gateway holds the mapping and rewrites addresses as packets pass through:

Through the internet gateway, and the ways it breaks

A web server in a public subnet. Watch the internet gateway swap private and public addresses, then break each link in the chain.

Scenario

Route 0.0.0.0/0 → IGW, public IP 203.0.113.25, rules allow HTTP.

VPC10.0.0.0/16
Public subnet10.0.0.0/24
Web server10.0.0.10
VPC router
Internet gateway
Visitor198.51.100.20
HTTP

Packet coming in

Source IP

198.51.100.20

Destination IP

203.0.113.25

Step 1 of 3
1

A visitor opens http://203.0.113.25. On the internet the packet is addressed to the server’s public IP.

#What makes a subnet public

A subnet is public when its route table has a route 0.0.0.0/0 → igw-…. A subnet without that route is private. That is the whole definition.

For an individual instance to actually talk to the internet, two more things must hold:

  1. It needs a public IPv4 address or an Elastic IP (lesson 3.6). Subnets have an “auto-assign public IPv4 address” setting that controls whether new instances get one automatically.
  2. The security group and network ACL must allow the traffic (lesson 3.5).

Self-checkQuestion

A subnet’s route table contains 10.0.0.0/16 → local and 0.0.0.0/0 → igw-123. An instance in it has a public IP. What is true?

#Troubleshooting checklist

When an instance cannot reach the internet (or the internet cannot reach it), walk this list in order. The exam uses it constantly.

Instance in a public subnet:

  1. Public address: does the instance have a public IPv4 address or an Elastic IP?
  2. Internet gateway: is an IGW attached to the VPC?
  3. Route table: does the subnet’s route table send 0.0.0.0/0 to that IGW (and is the route active, not blackhole)?
  4. Security group: does it allow the traffic (inbound rule for the port; outbound is open by default)?
  5. Network ACL: does it allow the traffic in both directions, including the return traffic on ephemeral ports?

Instance in a private subnet:

  1. NAT gateway: is there a NAT gateway in a public subnet (whose own route table points to the IGW)?
  2. Route table: does the private subnet’s route table send 0.0.0.0/0 to that NAT gateway?
  3. Then the same security group and network ACL checks.

#Try it yourself

Turn a fresh subnet into a public one with the CLI (replace the IDs with yours from lesson 3.2):

IGW=$(aws ec2 create-internet-gateway --query InternetGateway.InternetGatewayId --output text)
aws ec2 attach-internet-gateway --internet-gateway-id $IGW --vpc-id $VPC

RT=$(aws ec2 create-route-table --vpc-id $VPC --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id $RT --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW
aws ec2 associate-route-table --route-table-id $RT --subnet-id $SUBNET

# New instances in this subnet get a public IPv4 automatically
aws ec2 modify-subnet-attribute --subnet-id $SUBNET --map-public-ip-on-launch

# Look at the result: note the local route you never created, and the State column
aws ec2 describe-route-tables --route-table-ids $RT \
  --query "RouteTables[].Routes[].[DestinationCidrBlock,GatewayId,State]" --output table

VPC Reachability Analyzer (in the VPC console) can trace a path between two resources hop by hop and tell you which route, security group or network ACL blocks it, which is the checklist above, automated.

#Summary

Key takeaways

  • Every subnet has an implicit VPC router at base + 1. Traffic leaving a subnet is routed by that subnet’s route table.
  • A route is destination CIDR → target (local, igw, nat, vgw, pcx, tgw, vpce, eni). Each subnet uses exactly one route table; unassociated subnets use the main route table.
  • The local route (VPC CIDR → local) is in every table and cannot be deleted.
  • Longest prefix match decides: the most specific matching route wins; table order is irrelevant.
  • An internet gateway: managed, highly available, no bandwidth limit, free, one per VPC, and it does one-to-one NAT between private and public IPv4. The instance itself only knows its private IP.
  • Public subnet = route 0.0.0.0/0 → IGW. The instance also needs a public IP or Elastic IP, and both firewalls must allow the traffic.
  • Private subnets get outbound internet through a NAT gateway in a public subnet, never directly from the IGW.