Routes, gateways and NAT

Both of Sam’s problems are about routing: where traffic is allowed to go, and which way it takes to get there.

Every subnet has a route table: a list of rules. Each rule says traffic for these addresses goes to this target.

The VPC lesson showed the one line that makes a subnet public. This lesson is about everything else in the table.

The local route

Every route table starts with a route for the VPC’s own range, with the target local. You can’t delete it or change its target. It’s why every server in a VPC can reach every other one, whatever else the table says. (Whether they’re allowed to talk is a job for security groups.)

The most specific route wins

A packet often matches more than one route. 0.0.0.0/0 matches every address. 10.0.0.0/16 matches only the VPC. The rule is: the most specific match wins — the route with the longest prefix, the biggest number after the slash.

This is why you can add a special route without breaking the general one.

Which table does a subnet use?

Each subnet is associated with exactly one route table. Every VPC comes with a main route table, and any subnet you don’t associate explicitly uses it.

The internet gateway: two-way, one per VPC

An internet gateway is the VPC’s door to the internet. There is one per VPC, it scales by itself, and it costs nothing. Traffic flows both ways through it — but only for servers that also have a public IP address. A server with only a private address can’t use it, even if the route is there.

The NAT gateway: one-way, out only

Private servers still need to reach out: to download updates, to call a payment provider. A NAT gateway gives them a way out without a way in.

It sits in a public subnet. Private subnets send 0.0.0.0/0 to it. It swaps each server’s private address for its own public one, sends the request on through the internet gateway, and passes the reply back. Nothing on the internet can start a connection to the servers behind it.

One per zone, or one for all? Production puts a NAT gateway in each zone, and each zone’s private subnets route to their own. Lose a zone, and the other zone still has its way out. A test environment often shares one NAT gateway to halve the cost, accepting that losing that zone cuts everyone off. AWS has also recently added a regional mode that spreads a NAT gateway across zones for you; this lesson uses the long-standing zonal kind, which is what you’ll meet in most existing setups.

VPC endpoints: reaching AWS without the internet

S3, Secrets Manager, ECR and the other AWS services live outside your VPC, on public addresses. A VPC endpoint gives your subnets a private path to one of them instead.

A prefix list is a named, AWS-maintained list of a service’s address ranges, shown as an ID starting pl-. You’ll see it as the destination of the endpoint’s route.

Below is one subnet with one API server, and its route table. It starts with only the local route. Add and remove routes, and send the three kinds of traffic each time. Watch the label on the subnet change.

What to notice: nothing about the server changed — only the table. The same server is public, private or isolated depending on one route, and S3 traffic switches to the endpoint the moment its more specific route exists.

Costs money — about $1.20 a day while the NAT gateway and its Elastic IP exist, in us-east-1 — delete them after. Finished within an hour, this lab costs around 10 cents.

You’ll build a public subnet with a NAT gateway, a private subnet that uses it, and an S3 gateway endpoint, then prove a private server can reach out. About 40 minutes. Region: N. Virginia (us-east-1).

1. Create the VPC and two subnets

   AWSIn the AWS console: VPC→Your VPCs→Create VPC

   Field	Enter
   Resources to create	VPC only
   Name tag	quickcart-vpc
   IPv4 CIDR block	IPv4 CIDR manual input
   IPv4 CIDR	10.0.0.0/16
   IPv6 CIDR block	No IPv6 CIDR block
   Tenancy	Default

   Choose Create VPC. Then:

   AWSIn the AWS console: VPC→Subnets→Create subnet

   Choose quickcart-vpc, and add two subnets:

   Subnet name	Availability Zone	IPv4 subnet CIDR block
   quickcart-public-a	us-east-1a	10.0.1.0/24
   quickcart-app-a	us-east-1a	10.0.11.0/24

   Choose Create subnet.

   You should see

   Two subnets. Both use the main route table, which has only the local route: both are isolated for now.

2. Make the public subnet public

   AWSIn the AWS console: VPC→Internet gateways→Create internet gateway

   Field	Enter
   Name tag	quickcart-igw

   Choose Create internet gateway, then Actions → Attach to VPC, pick quickcart-vpc, and choose Attach internet gateway.

   AWSIn the AWS console: VPC→Route tables→Create route table

   Field	Enter
   Name	quickcart-rt-public
   VPC	quickcart-vpc

   Choose Create route table. On Routes, choose Edit routes → Add route:

   Destination	Target
   0.0.0.0/0	Internet Gateway, then quickcart-igw

   Choose Save changes. On Subnet associations, choose Edit subnet associations, tick quickcart-public-a, and choose Save associations.

   You should see

   quickcart-rt-public with two routes, 10.0.0.0/16 → local and 0.0.0.0/0 → igw-…, and one associated subnet.

3. Create the NAT gateway in the public subnet

   AWSIn the AWS console: VPC→NAT gateways→Create NAT gateway

   Field	Enter
   Name	quickcart-nat-a
   Availability mode (if the form shows it)	Zonal
   Subnet	quickcart-public-a — the public one
   Connectivity type	Public
   Elastic IP allocation ID	Choose Allocate Elastic IP

   Choose Create NAT gateway. The clock on its cost starts now.

   You should see

   State: Pending, changing to Available after a minute or two. The details show a Primary public IPv4 address: the Elastic IP the internet will see.

4. Route the private subnet through the NAT gateway

   AWSIn the AWS console: VPC→Route tables→Create route table

   Field	Enter
   Name	quickcart-rt-app
   VPC	quickcart-vpc

   Choose Create route table. On Routes, choose Edit routes → Add route:

   Destination	Target
   0.0.0.0/0	NAT Gateway, then quickcart-nat-a

   Save, then on Subnet associations associate quickcart-app-a.

   You should see

   quickcart-rt-app with 10.0.0.0/16 → local and 0.0.0.0/0 → nat-…. The app subnet is now private: out only.

5. Add the S3 gateway endpoint

   AWSIn the AWS console: VPC→Endpoints→Create endpoint

   Field	Enter
   Name tag	quickcart-s3
   Type (or Service category)	AWS services
   Services	Search s3, and choose com.amazonaws.us-east-1.s3 with type Gateway
   VPC	quickcart-vpc
   Route tables	Tick quickcart-rt-app
   Policy	Full access

   Choose Create endpoint.

   You should see

   Open quickcart-rt-app again. It now has a third route: destination pl-… (S3’s prefix list), target vpce-…. You never typed it — creating the endpoint added it. From now on S3 traffic from the app subnet skips the NAT gateway.

6. Launch a test server in the private subnet

   This server has no public address and no way to log in. It will check the internet as it boots and write the answer to its system log.

   AWSIn the AWS console: EC2→Instances→Launch instances

   Field	Enter
   Name	quickcart-route-test
   Application and OS Images	Amazon Linux 2023 — the default
   Instance type	t3.micro
   Key pair	Proceed without a key pair
   Network settings	Choose Edit
   VPC	quickcart-vpc
   Subnet	quickcart-app-a
   Auto-assign public IP	Disable
   Firewall (security groups)	Create security group, and untick Allow SSH traffic from. Nothing needs to connect in

   Open Advanced details. In User data, paste this script:

   user dataCopy

   #!/bin/bash
   if curl --silent --max-time 10 --output /dev/null https://example.com; then
     echo "QUICKCART CHECK: the internet is reachable"
   else
     echo "QUICKCART CHECK: the internet is NOT reachable"
   fi

   Part	What it means
   #!/bin/bash	run this script with bash. User data runs once, as root, on first boot
   if … then … else … fi	run the first echo if the command succeeds, the second if it fails
   curl	fetch a web address
   --silent	don’t print a progress bar
   --max-time 10	give up after 10 seconds instead of hanging
   --output /dev/null	throw the page away; only success or failure matters
   https://example.com	a public test site; any public HTTPS address would do
   echo "QUICKCART CHECK: …"	print a line that’s easy to spot in the log

   Choose Launch instance.

7. Read the answer in the system log

   Wait until the instance shows Running and its status checks have passed — a few minutes.

   AWSIn the AWS console: EC2→Instances→quickcart-route-test→Actions→Monitor and troubleshoot→Get system log

   Scroll near the end, or use your browser’s find, for QUICKCART CHECK.

   Among the boot messages

   QUICKCART CHECK: the internet is reachable

   The log can take a few minutes to fill in; if the line isn’t there, wait and choose Get system log again. The lines around it will differ from anyone else’s.

   You should see

   A server with no public address reached the internet: out through quickcart-nat-a, through quickcart-igw, and back. Nothing on the internet can reach it.

8. Clean-up step: Clean up

   Do these in order. Each one frees what the next one needs.

   1. Terminate the test server.

   AWSIn the AWS console: EC2→Instances→quickcart-route-test→Instance state→Terminate (delete) instance

   2. Delete the endpoint.

   AWSIn the AWS console: VPC→Endpoints→quickcart-s3→Actions→Delete VPC endpoints

   Type delete and confirm.

   3. Delete the NAT gateway, and wait.

   AWSIn the AWS console: VPC→NAT gateways→quickcart-nat-a→Actions→Delete NAT gateway

   Type delete and confirm. Refresh until State is Deleted. It takes a few minutes.

   4. Release the Elastic IP. This is the step people forget.

   AWSIn the AWS console: VPC→Elastic IPs→Actions→Release Elastic IP addresses

   Tick the address the NAT gateway used, then choose Release.

   5. Delete the VPC.

   AWSIn the AWS console: VPC→Your VPCs→quickcart-vpc→Actions→Delete VPC

   Type delete and choose Delete. If it complains that something is still in use, the instance is still terminating; wait a minute and try again.

   You should see

   No NAT gateways except the deleted one, no Elastic IPs in the list, no running instance, and no quickcart-vpc. Nothing is left billing.