Route Tables, Internet Gateways & NAT

In one line

Route tables decide where packets go; an internet gateway gives public subnets two-way internet access, and a NAT gateway gives private subnets outbound-only access so they can download updates without being reachable from outside.

0/4 · 0%

Think of it like this

An office with a reception desk. The INTERNET GATEWAY is the building's main door — people can enter and leave. A NAT GATEWAY is the mailroom: employees in the back offices can send letters out and get replies, but nobody outside can address a letter directly to a back office.

Key ideas

01
Every subnet is associated with one ROUTE TABLE. Every route table has an implicit local route for the VPC's CIDR, so everything inside the VPC can reach everything else (subject to security groups/NACLs). Additional routes are matched by LONGEST PREFIX — a /24 route beats 0.0.0.0/0.
02
An INTERNET GATEWAY (IGW) is attached to the VPC; public route tables send 0.0.0.0/0 → igw-.... It performs 1:1 translation between an instance's private IP and its public/Elastic IP — so an instance with no public IP in a public subnet still can't reach the internet.
03
A NAT GATEWAY lives in a PUBLIC subnet with an Elastic IP; private route tables send 0.0.0.0/0 → nat-.... Private instances can then initiate outbound connections (package installs, calling Stripe) while remaining unreachable inbound.
04
NAT gateways are per-AZ. For resilience, run ONE PER AZ and point each AZ's private route table at its own NAT — otherwise an AZ failure takes out internet access for all AZs, and you also pay cross-AZ data charges.
05
NAT gateways charge per hour AND per GB processed — often a surprisingly large line on the bill. Traffic to S3 and DynamoDB, and pulls from ECR, should instead go through VPC endpoints (Topic 3.3), which keep it off the NAT entirely.

Code & diagrams

routing.shbash

# Internet gateway for the VPC
IGW=$(aws ec2 create-internet-gateway --query InternetGateway.InternetGatewayId --output text)
aws ec2 attach-internet-gateway --internet-gateway-id $IGW --vpc-id $VPC

# Public route table: default route → IGW
PUB_RT=$(aws ec2 create-route-table --vpc-id $VPC --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id $PUB_RT --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW
aws ec2 associate-route-table --route-table-id $PUB_RT --subnet-id $PUBLIC_A

# NAT gateway in the public subnet of AZ a
EIP=$(aws ec2 allocate-address --domain vpc --query AllocationId --output text)
NAT_A=$(aws ec2 create-nat-gateway --subnet-id $PUBLIC_A --allocation-id $EIP \
  --query NatGateway.NatGatewayId --output text)

# Private route table for AZ a: default route → that AZ's NAT
PRIV_RT_A=$(aws ec2 create-route-table --vpc-id $VPC --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id $PRIV_RT_A --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT_A
aws ec2 associate-route-table --route-table-id $PRIV_RT_A --subnet-id $APP_A

OutboundPathsdiagram

Rendering diagram…

Explain it without notes

Why can't you just put a NAT gateway in a private subnet?

An instance in a private subnet times out on dnf update. Walk through what you'd check.

Practice

A route table has 10.0.0.0/16 → local, 10.1.0.0/16 → pcx-123, and 0.0.0.0/0 → nat-abc. Where does a packet to 10.1.4.20 go? To 52.95.1.1?

Your NAT gateway bill is large and VPC Flow Logs show most NAT traffic goes to S3. What's the fix?

Trade-offs

↔
One NAT gateway per AZ is resilient and avoids cross-AZ traffic charges but multiplies the fixed hourly cost; a single shared NAT is cheaper for dev environments but makes one AZ a single point of failure for all outbound traffic.

Done when you can

I can explain longest-prefix route matching.
I know the difference between an internet gateway and a NAT gateway.
I deploy one NAT gateway per AZ for production.
I can debug a private instance that can't reach the internet.