Internet Gateway and Route Table
Table of contents
Internet Gateway and Route Table — Where Public/Private Subnets Are Decided
Whether a subnet is "public" or "private" is decided by routing, not by labels. Once we understand how Internet Gateway (IGW), NAT Gateway, route tables, and VPC endpoints combine, the meaning of subnet design becomes clear.
1. About the building blocks
| Component | Role |
|---|---|
| Internet Gateway (IGW) | A horizontally scalable gateway that connects a VPC to the internet. Bidirectional. |
| NAT Gateway | Outbound-only NAT for private subnets. AWS managed. |
| NAT Instance | EC2-based NAT. Older · self-operated. |
| Route Table | Decides traffic destinations per subnet. |
| VPC Endpoint | A private path to AWS services (bypassing the internet). |
2. Internet Gateway
One per VPC. The IGW itself is not connected to subnets — when a route table's default route (0.0.0.0/0) points at the IGW, subnets associated with that route table become "public subnets."
There is one more requirement: the instance needs a public IP (or EIP) for inbound to work. Simply pointing the route table at the IGW does not let outside traffic in.
3. NAT Gateway · NAT Instance
Used when private-subnet instances need outbound (package downloads, external API calls). NAT does not allow inbound.
| Item | NAT Gateway | NAT Instance |
|---|---|---|
| Operations | AWS managed | Self-operated (EC2 + iptables) |
| Availability | Managed within an AZ | Single instance = SPOF |
| Throughput | Auto-scaling | Per instance spec |
| Cost | Hours + GB | EC2 hours + data |
NAT Gateway is the standard in production. NAT Instance is for cost optimization or experimentation.
4. Route Table
A route table is a collection of (destination, target) pairs.
| Destination | Target |
|---|---|
10.0.0.0/16 (VPC CIDR) |
local (auto, not deletable) |
0.0.0.0/0 |
igw-xxxx (public subnet) |
0.0.0.0/0 |
nat-xxxx (private subnet) |
pl-xxxx (S3 prefix list) |
vpce-xxxx (Gateway endpoint) |
The most specific route (longest prefix match) wins. 10.0.0.0/16 → local always exists, so traffic within the same VPC never crosses the internet.
5. The mechanics of public vs private
Public subnet
└── route table: 0.0.0.0/0 → IGW
Private subnet (with NAT)
└── route table: 0.0.0.0/0 → NAT Gateway (in public subnet)
Isolated subnet
└── route table: (no default route. same VPC only)
The NAT Gateway itself must reside in a public subnet (with an EIP attached, sending outbound through the IGW). Private subnet route tables then point their default route at that NAT's ID.
6. VPC Endpoint
A private path so traffic from the VPC to AWS services (S3 · DynamoDB · SQS · KMS) does not traverse the internet.
| Type | Notes |
|---|---|
| Gateway endpoint | S3 · DynamoDB only. Adds a prefix list to the route table. Free. |
| Interface endpoint (PrivateLink) | Most AWS services. Creates an ENI. Bills by hour and GB. |
Instead of routing private-subnet traffic to S3 through a NAT Gateway, a Gateway endpoint reduces both cost and latency.
7. Egress-only IGW (IPv6)
IPv6 has no NAT concept. To let private IPv6 send outbound only and block inbound, we use an Egress-only IGW. It is similar in meaning to IPv4's NAT Gateway, but the price and behavior differ.
8. Counterparts in other clouds
- GCP — Cloud NAT, Cloud Router, Routes. The model is similar.
- Azure — NAT Gateway, Route Tables, Service Endpoints · Private Endpoints.
The names differ, and the details differ too. Assuming the same abstraction leads to incidents.
9. Standard 3-tier VPC
VPC 10.0.0.0/16
├── Public subnets (×2 AZ): ALB, NAT Gateway
├── Private app subnets (×2 AZ): EC2/ECS/EKS
└── Private DB subnets (×2 AZ, isolated): RDS, ElastiCache
Three route tables:
| Subnet | Default route |
|---|---|
| Public | IGW |
| Private app | NAT Gateway (of that AZ) |
| Private DB | (none) |
Adding an S3 Gateway endpoint to the route table of the private app subnets reduces external egress costs.
NAT AZ distribution — A NAT Gateway is a single-AZ resource. If one AZ's NAT dies, private subnets in that AZ lose outbound. In production, place a NAT Gateway in every AZ and have each private subnet point at its own AZ's NAT.
10. Common pitfalls
No public IP — The route points at the IGW, but the instance has no public IP, so external reachability fails. Attach an EIP or enable auto-assign on the subnet.
NAT cost — Bills by both hours and processed GB. If private subnets receive a lot of large data from outside, costs accumulate. Mitigate with S3 endpoints, caching, and freezing dependencies at image-build time.
Route conflicts — Adding peering or transit gateway can send the default route to an unintended destination. Remember that the most specific prefix wins.
All private subnets through one NAT — A single AZ's NAT failure drags down other AZs. Per-AZ NAT is recommended.
Endpoint policy missing — If a Gateway endpoint policy is too broad, arbitrary buckets become reachable. Tighten with IAM and endpoint policies.
Closing thoughts
A single line in the route table changes the character of a subnet. NAT Gateway cost is one of the most discussed line items in production, so the standard pattern is to mitigate with S3 endpoints, image caches, and freezing at build time.
Next
- security-group
- ec2
VPC route tables · Internet Gateway · NAT Gateway · VPC Endpoints · Egress-only IGW · PrivateLink for reference.