mrvitej.in

Archive · AWS

VPC Basics: Subnets, Routes and NAT

The network you launch EC2 into, and how public and private subnets differ.

1 min read

  • Amazon VPC
  • Internet Gateway
  • NAT Gateway
  • Region ap-south-1

A VPC is your private network in AWS. A typical layout spans two Availability Zones with public and private subnets.

flowchart TB
  I[Internet] --> IGW[Internet gateway]
  IGW --> PUB[Public subnet<br/>load balancer and NAT]
  PUB --> NAT[NAT gateway]
  NAT --> PRIV[Private subnet<br/>app and database servers]
  • A subnet is public when its route table sends 0.0.0.0/0 to an internet gateway.
  • A private subnet sends that route to a NAT gateway, so servers can fetch updates but cannot be reached from the internet.
  • Security groups act on instances (stateful). Network ACLs act on subnets (stateless) and are rarely changed.

Plan CIDR blocks early. A /16 VPC such as 10.0.0.0/16 with /24 subnets leaves room to grow, and ranges must not overlap if you later peer VPCs or connect an office VPN.

A NAT gateway costs money per hour plus per GB, so in development use a small NAT instance or share one NAT across subnets.