AWS Networking Explained: VPC, Subnets, Route Tables, Internet Gateway and NAT Gateway
If you are learning AWS, Cloud, DevOps, or Microservices, understanding networking is essential.
AWS networking can initially look complicated because you encounter terms such as VPC, Subnet, Route Table, Internet Gateway, NAT Gateway, Availability Zone, and CIDR.
But these concepts become much easier when you first understand how they fit together.
This article explains the fundamentals of AWS VPC networking and walks through a practical network design using a VPC, public and private subnets, an Internet Gateway, a NAT Gateway, and route tables.
In simple terms: A VPC is your private network in AWS, subnets divide that network, route tables decide where traffic goes, an Internet Gateway provides internet connectivity for public resources, and a NAT Gateway allows resources in private subnets to make outbound internet connections.
The examples in this article are based on the uploaded AWS Networking Part 2 notes, which build a VPC using the CIDR 192.168.0.0/23.
1. AWS Networking vs Traditional Networking
Before jumping into AWS, let’s map traditional networking concepts to AWS terminology.
| Networking Concept | AWS Concept |
|---|---|
| Private Network | VPC |
| Smaller Network | Subnet |
| Routing Table | AWS Route Table |
| NAT | NAT Gateway |
| Internet Gateway | Internet Gateway |
| IP Range | CIDR |
| Physical/Logical Location | Availability Zone |
The notes explicitly make this connection between networking fundamentals and AWS networking concepts.
If you already understand network, router, NAT, CIDR, and routing tables, learning AWS networking becomes much easier.
2. What Is a VPC?
VPC stands for:
Virtual Private Cloud
A VPC is essentially a private network that you create inside AWS.
For example, we can create a VPC with:
192.168.0.0/23This CIDR block defines the IP address range available inside the VPC.
The notes describe a VPC as a private network block defined by a CIDR range and show the VPC existing within an AWS Region.
Conceptually:
AWS Region
│
└── VPC
└── 192.168.0.0/23When creating the VPC from the AWS console, you provide details such as:
- VPC name
- IPv4 CIDR block
- Other VPC settings
The example in the notes uses /23, providing 512 total IP addresses.
3. Understanding CIDR
CIDR stands for:
Classless Inter-Domain Routing
Consider:
192.168.0.0/23The /23 tells us how many bits belong to the network portion.
IPv4 contains 32 bits:
32 - 23 = 9So we have:
2⁹ = 512total IP addresses.
Therefore:
192.168.0.0/23provides:
512 IP addressesin the CIDR range.
The notes use this exact calculation before dividing the VPC into smaller subnets.
4. Why Do We Need Subnets?
A VPC can contain a large number of IP addresses.
Instead of putting everything into one large network, we can divide the VPC into smaller networks called subnets.
For example:
VPC
192.168.0.0/23
│
├── Subnet 1
├── Subnet 2
├── Subnet 3
└── Subnet 4The notes describe a subnet as a smaller network created by dividing a larger network.
This gives us better organization and allows us to separate resources based on their requirements.
For example:
Public Subnet
↓
Load Balancer / Public-facing resources
Private Subnet
↓
Application servers / Database5. Dividing a /23 VPC into /25 Subnets
Our VPC is:
192.168.0.0/23We want approximately 100 IP addresses per subnet.
Let’s calculate.
If we use:
/26then:
32 - 26 = 6Therefore:
2⁶ = 6464 addresses are not enough for approximately 100 hosts.
So we use:
/25Now:
32 - 25 = 7Therefore:
2⁷ = 128addresses.
The notes describe this calculation and divide the /23 VPC into four /25 subnets.
The resulting ranges are:
| Subnet | CIDR | IP Range | Total IPs |
|---|---|---|---|
| Subnet 1 | 192.168.0.0/25 |
192.168.0.0 - 192.168.0.127 |
128 |
| Subnet 2 | 192.168.0.128/25 |
192.168.0.128 - 192.168.0.255 |
128 |
| Subnet 3 | 192.168.1.0/25 |
192.168.1.0 - 192.168.1.127 |
128 |
| Subnet 4 | 192.168.1.128/25 |
192.168.1.128 - 192.168.1.255 |
128 |
This demonstrates an important AWS networking skill:
Choose your VPC CIDR carefully because your subnets must be created from the VPC’s available address range.
6. Availability Zones and Subnets
AWS Regions contain multiple Availability Zones (AZs).
A common architecture is to create subnets across different Availability Zones.
For example:
AWS Region
│
└── VPC
│
├── Availability Zone 1a
│ └── Public Subnet
│
└── Availability Zone 1b
└── Private SubnetThe notes demonstrate this setup using:
AZ-1a
Public Subnet
192.168.0.0/25
AZ-1b
Private Subnet
192.168.0.128/25and place EC2 instances inside the subnets.
Using multiple Availability Zones is an important architectural pattern for improving availability and resilience.
7. Public Subnet vs Private Subnet
One of the most important AWS networking concepts is the difference between a public subnet and a private subnet.
Let’s understand the difference.
Public Subnet
A subnet is commonly considered public when its route table has a route to an Internet Gateway.
For example:
0.0.0.0/0 → Internet GatewayA resource in that subnet can communicate with the internet when it also has appropriate public addressing and security configuration.
The notes describe the public subnet route table using an Internet Gateway as its target.
8. Private Subnet
A private subnet does not have a direct route to the Internet Gateway.
Instead, resources in the private subnet can use a NAT Gateway for outbound internet access.
Conceptually:
Private Subnet
│
↓
NAT Gateway
│
↓
Internet Gateway
│
↓
InternetThe notes specifically show the private route table using:
0.0.0.0/0 → NAT Gatewaywhile the public route table uses an Internet Gateway.
9. Why Use Private Subnets?
Private subnets are useful for resources that shouldn’t be directly reachable from the public internet.
Typical examples include:
Private Subnet
│
├── Application EC2 instances
├── Database
└── Internal servicesThe notes specifically mention EC2 instances and databases as resources commonly kept in private subnets.
This gives us an architecture such as:
Internet
│
↓
Internet Gateway
│
↓
Public Subnet
│
┌────────┴────────┐
│ │
Load Balancer NAT Gateway
│
↓
Private Subnet
│
EC2 / Database10. What Is an Internet Gateway?
An Internet Gateway (IGW) provides a connection between a VPC and the internet.
The notes describe it as:
A gate between the VPC and the internet.
However, simply creating an Internet Gateway is not enough.
The network also needs appropriate routing and addressing.
The notes identify two requirements in their example:
- The subnet’s route table needs a route to the Internet Gateway.
- The host needs a public IP.
For example:
Destination Target
--------------------------------
192.168.0.0/23 local
0.0.0.0/0 Internet GatewayThe 0.0.0.0/0 route essentially means:
For destinations that don’t match a more specific route, send the traffic toward the Internet Gateway.
11. Creating an Internet Gateway
The basic process shown in the notes is:
Step 1
Go to:
VPC → Internet GatewaysStep 2
Choose:
Create Internet GatewayStep 3
Provide a name.
Step 4
Attach the Internet Gateway to your VPC.
The notes demonstrate creating the Internet Gateway and then attaching it to the previously created VPC.
Conceptually:
Internet Gateway
│
│ attach
↓
VPC12. What Is a Route Table?
A route table controls where network traffic is sent.
Think of it as a set of rules:
Destination → TargetFor example:
Destination Target
--------------------------------
192.168.0.0/23 local
0.0.0.0/0 Internet GatewayThe VPC created in the notes initially has a default/main route table containing the local VPC route.
13. Public Route Table
For our public subnet, we create a route table with:
Destination Target
--------------------------------
192.168.0.0/23 local
0.0.0.0/0 Internet GatewayThis tells AWS:
Traffic destined for the local VPC stays within the VPC, while other destinations use the Internet Gateway.
The notes demonstrate creating a public route table, adding the 0.0.0.0/0 route to the Internet Gateway, and associating the route table with the public subnet.
14. What Is a NAT Gateway?
Now let’s look at the private subnet.
Suppose an EC2 instance has:
Private IP:
192.168.0.150It needs to download updates from the internet.
We don’t want to give that EC2 instance a public IP just for outbound internet access.
This is where the NAT Gateway comes into the architecture.
NAT stands for:
Network Address Translation
The notes describe a NAT Gateway as a gateway between a private network and a public network. It replaces the private source IP with its own public IP for outbound communication and sends the traffic through the Internet Gateway.
15. How NAT Gateway Works
Imagine an EC2 instance in a private subnet sends:
Source:
192.168.0.150
Destination:
8.8.8.8:443The traffic goes:
EC2
│
↓
Private Route Table
│
↓
NAT Gateway
│
↓
Internet Gateway
│
↓
InternetThe NAT Gateway translates the source information so the external destination can communicate with the public-facing side of the connection.
The notes illustrate a similar example using:
Private IP:
10.0.1.10
Public IP:
52.10.20.30and show the traffic going through the Internet Gateway toward the internet.
16. Why Is NAT Gateway Placed in a Public Subnet?
This is one of the most important points.
A NAT Gateway needs connectivity toward the Internet Gateway.
Therefore, in the architecture shown in the notes, the NAT Gateway is placed in the public subnet.
The architecture looks like:
Internet
│
↓
Internet Gateway
│
↓
Public Subnet
│
NAT Gateway
│
↓
Private Subnet
│
EC2The notes explicitly state that the NAT Gateway needs to communicate with the Internet Gateway and therefore should be placed in the public subnet.
17. Private Route Table
The private subnet needs its own route table.
For example:
Destination Target
--------------------------------
192.168.0.0/23 local
0.0.0.0/0 NAT GatewayThis means:
- Traffic within the VPC → stays local.
- Other destinations → go through the NAT Gateway.
The notes show this exact routing pattern and then associate the private route table with the private subnet.
18. Complete AWS Network Architecture
Now let’s put everything together.
AWS REGION
│
↓
┌───────────────────┐
│ VPC │
│ 192.168.0.0/23 │
└───────────────────┘
│
┌─────────────┴─────────────┐
│ │
↓ ↓
Availability Zone 1a Availability Zone 1b
│ │
↓ ↓
┌──────────────┐ ┌──────────────┐
│ Public │ │ Private │
│ Subnet │ │ Subnet │
│ /25 │ │ /25 │
└──────────────┘ └──────────────┘
│ │
│ ↓
│ EC2 Instance
│ │
│ ↓
│ Private Route
│ │
↓ ↓
NAT Gateway ←────────────────────┘
│
↓
Internet Gateway
│
↓
InternetThe final diagram in the uploaded notes shows the completed architecture with the VPC, Availability Zones, public and private subnets, public/private route tables, NAT Gateway, and Internet Gateway.
19. Complete Traffic Flow
Let’s follow an actual request.
Suppose an EC2 instance is running inside:
Private Subnet
192.168.0.128/25and wants to access:
https://google.comStep 1 — EC2 creates the request
EC2
192.168.0.150
│
↓
Destination: InternetStep 2 — Private Route Table
The route table contains:
0.0.0.0/0 → NAT GatewayTherefore, the packet goes to the NAT Gateway.
Step 3 — NAT Gateway
The NAT Gateway translates the private source information and uses its public-side connectivity.
Step 4 — Internet Gateway
The NAT Gateway sends the traffic toward the Internet Gateway.
Step 5 — Internet
The request reaches the external destination.
Step 6 — Response
The response comes back through the established NAT mapping.
The NAT Gateway knows which internal connection the response belongs to and forwards it to the private EC2 instance.
The notes explain this outbound flow and describe the NAT mapping behavior for responses.
20. Why Can’t a Private Subnet Directly Use the Internet Gateway?
This is a common interview question.
The important architectural distinction is:
Public Subnet
↓
Internet Gateway
↓
Internetwhereas:
Private Subnet
↓
NAT Gateway
↓
Internet Gateway
↓
InternetThe private subnet does not have a direct default route to the Internet Gateway in this design.
Instead, its default route points to the NAT Gateway.
The notes demonstrate exactly this difference between the public and private route tables.
21. Public Subnet Configuration
Our public subnet can use:
CIDR:
192.168.0.0/25Its route table:
Destination Target
--------------------------------
192.168.0.0/23 local
0.0.0.0/0 Internet GatewayFor instances that need public internet connectivity, the subnet can have auto-assign public IPv4 address enabled.
The notes show enabling this setting for the public subnet.
22. Private Subnet Configuration
Our private subnet can use:
CIDR:
192.168.0.128/25Its route table:
Destination Target
--------------------------------
192.168.0.0/23 local
0.0.0.0/0 NAT GatewayEC2 instances launched there don’t need a public IPv4 address simply to reach the internet for outbound traffic through the NAT Gateway.
The notes specifically point out that public IPv4 addressing is not needed for EC2 instances in the private subnet in this design.
23. Why Separate Public and Private Subnets?
The separation gives us better control over our architecture.
For example:
INTERNET
│
↓
Internet Gateway
│
↓
┌────────────────┐
│ Public Subnet │
│ │
│ Load Balancer │
│ NAT Gateway │
└───────┬────────┘
│
↓
┌────────────────┐
│ Private Subnet │
│ │
│ Application │
│ Servers │
│ Database │
└────────────────┘The public-facing components can communicate through the Internet Gateway, while private application and database resources can remain without direct inbound internet routing.
24. AWS Networking: The Big Picture
At this point, we can summarize the entire architecture.
VPC
Defines the overall private network.
192.168.0.0/23Subnet
Divides the VPC into smaller networks.
192.168.0.0/25
192.168.0.128/25Availability Zone
Provides the AWS infrastructure location in which the subnet exists.
Route Table
Determines where traffic goes.
Destination → TargetInternet Gateway
Provides internet connectivity for appropriately configured public resources.
NAT Gateway
Allows resources in private subnets to initiate outbound internet communication without requiring them to have public IP addresses.
25. Final Architecture
Here is the complete architecture from the notes:
AWS REGION
│
│
┌─────────────────────┐
│ VPC │
│ 192.168.0.0/23 │
└──────────┬──────────┘
│
┌──────────────┴──────────────┐
│ │
▼ ▼
AZ-1a AZ-1b
│ │
▼ ▼
┌────────────────┐ ┌────────────────┐
│ PUBLIC SUBNET │ │ PRIVATE SUBNET │
│ 192.168.0.0/25 │ │192.168.0.128/25│
└───────┬────────┘ └────────┬───────┘
│ │
│ │
Public Route Private Route
Table Table
│ │
│ 0.0.0.0/0
│ │
│ ▼
│ NAT Gateway
│ │
└──────────────┐ │
│ │
▼ │
Internet Gateway ◄─────┘
│
▼
INTERNETThe completed network diagram in the source material shows this same overall relationship between the VPC, subnets, route tables, NAT Gateway and Internet Gateway.
26. Important AWS Networking Interview Questions
Once you understand this architecture, you should be able to answer questions such as:
What is a VPC?
A logically isolated private network in AWS where you can define IP ranges, subnets, routing and connectivity.
What is a subnet?
A smaller IP network created inside a VPC.
What is CIDR?
A notation used to define an IP network range, such as:
192.168.0.0/23What is an Internet Gateway?
A VPC component that provides connectivity between the VPC and the internet for appropriately configured resources.
What is a NAT Gateway?
A managed AWS networking component that allows resources in private subnets to initiate outbound internet connections without requiring public IP addresses on those resources.
Why is NAT Gateway placed in a public subnet?
Because the NAT Gateway needs a path to the Internet Gateway for internet-bound traffic. The source notes demonstrate this architecture.
What is a Route Table?
A collection of routing rules that determines where network traffic should be sent.
Public Subnet vs Private Subnet?
A public subnet has a route toward an Internet Gateway, while a private subnet in this architecture uses a NAT Gateway for outbound internet access.
Conclusion
AWS networking becomes much easier once you stop looking at VPC, Subnet, Route Table, NAT Gateway and Internet Gateway as isolated AWS services.
Think of them as parts of one network:
VPC
│
├── Subnets
│ │
│ ├── Public Subnet
│ │ ↓
│ │ Internet Gateway
│ │
│ └── Private Subnet
│ ↓
│ NAT Gateway
│ ↓
│ Internet Gateway
│ ↓
│ Internet
│
└── Route TablesThe key idea to remember is:
VPC defines the network, subnets divide it, route tables control traffic, an Internet Gateway provides internet connectivity for public resources, and a NAT Gateway provides outbound internet access for resources in private subnets.
Once you understand this architecture, you have the foundation needed to move on to more advanced AWS topics such as EC2 networking, Load Balancers, Auto Scaling, VPC Peering, Transit Gateway, Security Groups, Network ACLs, and multi-tier application architecture.
Suggested SEO title
AWS Networking Explained: VPC, Subnets, Route Tables, Internet Gateway & NAT Gateway
Suggested URL slug
aws-networking-vpc-subnet-route-table-nat-gateway
Suggested meta description
Learn AWS networking from scratch with a practical explanation of VPC, CIDR, subnets, Availability Zones, route tables, Internet Gateway, NAT Gateway, public and private subnets.