AWS VPC Deep Dive Part 1: IGW, NAT Gateway, VPN, Peering, and Endpoints.
Explore AWS VPC networking, from CIDR, subnets, and Availability Zones to Internet Gateway, NAT Gateway, and route tables. Learn how Site-to-Site VPN, Client VPN, Direct Connect, VPC Peering, Transit Gateway, and VPC Endpoints enable secure connectivity and routing. Understand key concepts, traffic flows, and practical use cases to strengthen your AWS networking fundamentals for Cloud and DevOps engineering.
Series: AWS VPC (2 articles)
- 1AWS VPC Deep Dive Part 1: IGW, NAT Gateway, VPN, Peering, and Endpoints. This article
AWS VPC Networking Explained: From Subnets and Route Tables to VPN, Transit Gateway, and VPC Endpoints.
Networking is one of the most important concepts to understand when working with AWS, especially as a DevOps Engineer. Whether you are deploying an application on EC2, running containers on ECS or EKS, or connecting AWS to an on-premises data center, everything depends on how network connectivity is designed and managed.
In this article, we will break down the core AWS networking concepts with simple explanations, traffic flows, architecture examples, and real-world use cases.
What We Will Cover
- VPC Fundamentals: VPC, CIDR, subnets, and Availability Zones
- Internet Connectivity: Internet Gateway (IGW), NAT Gateway, and route tables
- Secure Connectivity: Site-to-Site VPN, Client VPN, and AWS Direct Connect
- VPC-to-VPC Communication: VPC Peering and Transit Gateway
- Private AWS Service Access: VPC Endpoints
1. Amazon VPC (Virtual Private Cloud)
Imagine you are building an application with three major components:
- Frontend (FE)
- Backend (BE)
- Database (DB)
You don't want your database exposed directly to the internet. You also don't want every server to communicate with every other server without restrictions.
You need a private network with controlled access. That's where VPC comes in.
VPC = Your private network in AWS.
An Amazon VPC is a logically isolated virtual network in AWS where you launch resources such as EC2 instances, load balancers, and other supported services.
We control:
- IP address ranges.
- Subnets.
- Routing.
- Network connectivity.
- Traffic filtering and access controls.
Without a network design, it would be difficult to control which resources can communicate, how they reach the internet, and how your AWS environment connects to your company network. A VPC gives you a foundation for designing that connectivity.
Important: A VPC is regional, meaning it belongs to one AWS Region. Its subnets are associated with individual Availability Zones within that Region.
Real-world example
Imagine an e-commerce application hosted on AWS.
- The frontend receives customer requests.
- The backend processes orders and payments.
- The database stores customer and order information.
You can design a VPC in which an internet-facing load balancer receives customer traffic, backend servers run in private subnets, and the database runs in private database subnets.
Customers can access the application without having direct network access to the database.
This separation improves security and gives you better control over network communication.
2. CIDR (Classless Inter-Domain Routing)
CIDR stands for Classless Inter-Domain Routing. It represents an IP address range using an IP address and a prefix length.
For example:
10.0.0.0/16→ 65,536 IPv4 addresses10.0.0.0/24→ 256 IPv4 addresses
The prefix length determines how many bits are used for the network portion of the address.
A smaller prefix length generally represents a larger address range, while a larger prefix length represents a smaller range.
Real-world example
Suppose you are creating an AWS VPC for a company and choose the CIDR block
10.0.0.0/16.You can divide this address range into smaller subnets for different purposes:
- Public subnets for load balancers.
- Private application subnets for backend servers.
- Private database subnets for databases.
Planning CIDR ranges carefully is important, especially when connecting multiple VPCs or an on-premises network. Overlapping IP address ranges can create routing problems and complicate connectivity.
3. Subnets and Availability Zones
A subnet is a smaller IP address range inside a VPC. It lets you organize resources into different network segments.
Each subnet belongs to exactly one Availability Zone (AZ). Creating subnets in multiple AZs improves resilience if one AZ experiences a failure.
Consider the following example architecture:
VPC:
10.0.0.0/16| Subnet | CIDR block | Purpose |
|---|---|---|
| Public Subnet A | 10.0.1.0/24 | Load balancer in AZ A |
| Public Subnet B | 10.0.2.0/24 | Load balancer in another AZ |
| Private App Subnet A | 10.0.11.0/24 | Application servers |
| Private App Subnet B | 10.0.12.0/24 | Application servers in another AZ |
| Private DB Subnet A | 10.0.21.0/24 | Database resources |
| Private DB Subnet B | 10.0.22.0/24 | Database resources in another AZ |
A subnet is public or private based primarily on its routing, not simply on its name or the type of server it contains.
A common misconception is that a server becomes public just because it has a public IP address. A public IP alone does not establish internet connectivity. The routes, Internet Gateway, addressing, and security controls must also permit the connection.
Likewise, a private subnet doesn't automatically mean that every resource in it is secure. You must configure appropriate access controls.
Public subnet
- Has a route to an Internet Gateway.
- Can host an internet-facing load balancer.
- Resources still need appropriate public IP addressing and security rules for direct IPv4 internet access.
Private subnet
- Has no direct route to the Internet Gateway for ordinary internet access.
- Can host application servers and databases.
- May use a NAT Gateway for outbound IPv4 internet access.
Real-world example
Suppose a company deploys a web application that must be accessible to customers worldwide.
The load balancer can be placed in public subnets across two Availability Zones. The application servers can run in private subnets, while the database resides in private database subnets.
If one Availability Zone experiences a failure, the resources in the other Availability Zone can continue serving traffic, provided the application and its dependencies are configured for high availability.
This architecture helps separate public access from internal application and database communication.
4. Internet Gateway (IGW)
An Internet Gateway is a VPC component that enables communication between the VPC and the internet.
In simple terms, it provides a connection between your AWS network and the outside world.
An Internet Gateway is attached to a VPC and enables internet connectivity for appropriately addressed resources when routing and security controls permit it.
For an IPv4 EC2 instance to receive direct internet traffic, the usual requirements include:
- An Internet Gateway attached to the VPC.
- A subnet route table with an appropriate route to that Internet Gateway.
- A public IPv4 address or Elastic IP for the instance, or another supported public addressing arrangement.
- Security group and network ACL rules that permit the traffic.
- An application that is listening on the required port.
How does an IGW work?
Suppose an EC2 instance has:
- Public IPv4 address:
203.0.113.10 - Private IPv4 address:
10.0.1.10
These addresses are illustrative.
When an internet client connects to the public address, the Internet Gateway handles the necessary mapping between the public IPv4 address and the instance's private IPv4 address as traffic enters or leaves the VPC.
The instance communicates using its private address inside the VPC.
Real-world example
Imagine hosting a public website on an EC2 instance.
A user enters the website's public address in their browser. The request reaches the AWS network through the Internet Gateway, and the applicable routes and security controls determine whether the traffic can reach the instance.
In a production architecture, an internet-facing Application Load Balancer is often used instead of exposing application instances directly.
The load balancer receives incoming requests and forwards them to application servers in private subnets.
Remember: An Internet Gateway enables internet connectivity, but it does not automatically make every resource in a VPC publicly accessible.
5. NAT Gateway
A NAT Gateway allows resources in a private subnet to initiate connections to external destinations, such as the public internet, without allowing unsolicited inbound internet connections to those private resources.
Imagine your private application server needs to download operating system updates or pull a container image from Docker Hub. A NAT Gateway can help here.
How does traffic flow through a NAT Gateway?
Suppose an EC2 instance has the private IP address
10.0.11.10.The traffic flow is as follows:
- The EC2 instance requests an update from an external server.
- Its subnet route table sends the unmatched IPv4 destination to the NAT Gateway.
- The NAT Gateway translates the source address to its public IPv4 address.
- The NAT Gateway sends the request through the Internet Gateway.
- The external server sends its response to the NAT Gateway's public address.
- The NAT Gateway maps the response back to the private instance and forwards it.
Public NAT Gateway
- Provides outbound connectivity to the internet or other networks.
- Can provide internet access through an Internet Gateway.
- Is commonly used to provide internet access to resources in private subnets.
Private NAT Gateway
- Provides outbound connectivity to other private networks.
- Cannot provide internet access through an Internet Gateway directly.
Real-world example
Imagine you are running backend services on EC2 instances in private subnets.
These instances should not accept direct inbound connections from the public internet. However, they still need to download security patches, install software packages, or retrieve container images from public registries.
A public NAT Gateway in a public subnet can provide the required outbound IPv4 connectivity while the application instances remain in private subnets.
Important: A NAT Gateway is not a replacement for security groups or network ACLs. It provides network address translation and connectivity; your overall network security still depends on appropriate routing and access controls.
6. Route Tables
A route table is a collection of rules that decides where network traffic should be sent based on its destination IP address.
Each route has essentially two parts:
- Destination: Which IP address range the rule matches, such as
10.0.0.0/16or0.0.0.0/0. - Target: Where the traffic should go.
The target can be an Internet Gateway, NAT Gateway, VPC peering connection, VPN gateway, Transit Gateway, or another supported target.
What does 0.0.0.0/0 mean?
0.0.0.0/0 is a special CIDR notation that represents all IPv4 addresses.For example:
0.0.0.0/0 → Internet GatewayThis means that IPv4 traffic whose destination isn't matched by a more specific route is directed toward the Internet Gateway.
The most specific matching route generally takes precedence.
Local route
When a VPC is created, its route table includes a local route for communication within the VPC's CIDR range.
This allows resources in the VPC to communicate with other resources in the VPC, subject to security controls and other networking requirements.
Main route table
A VPC automatically has a main route table. Subnets without an explicit association with another route table use the main route table.
You can create custom route tables to give different subnets different routing behavior. Each subnet is associated with one route table at a time.
Real-world example
Consider a VPC with public and private subnets.
The public subnet's route table may contain:
| Destination | Target |
|---|---|
| 10.0.0.0/16 | Local |
| 0.0.0.0/0 | Internet Gateway |
The private application subnet's route table may contain:
| Destination | Target |
|---|---|
| 10.0.0.0/16 | Local |
| 0.0.0.0/0 | NAT Gateway |
The first table allows traffic destined for the internet to be directed to the Internet Gateway. The second directs unmatched IPv4 traffic to the NAT Gateway.
This separation allows public and private subnets to follow different connectivity paths.
Key takeaway: Route tables determine where traffic goes. Security groups and network ACLs help determine which traffic is allowed.
7. VPN (Virtual Private Network)
A VPN creates a logically private, encrypted connection across an underlying network. In AWS networking, VPNs are often used to connect a company's on-premises network to a VPC or to allow a user's device to access private resources.
Consider the following network ranges:
- Office network:
192.168.1.0/24 - AWS VPC:
10.0.0.0/16
Your developers need to access private EC2 instances in AWS without exposing those instances to the public internet.
A VPN can provide the encrypted network path.
There are two important VPN concepts to understand in AWS.
7.1 Site-to-Site VPN
A Site-to-Site VPN connects office networks to AWS. It usually uses IPsec.
A site-to-site VPN links entire local area networks (LANs) together over the public internet using an encrypted tunnel.
In AWS, it is a managed cloud networking service that establishes a secure, encrypted IPsec connection between your on-premises network, such as a data center or branch office, and your AWS environment over the public internet.
Real-world example
Imagine a company has its employee management application running in an on-premises data center, while a reporting application runs on EC2 in AWS.
The company needs these environments to communicate privately.
A Site-to-Site VPN can connect the on-premises network to the AWS VPC so that authorized systems can communicate over the encrypted connection, subject to routing and security configurations.
7.2 AWS Client VPN
Client VPN lets individual users, such as developers working remotely, establish a VPN connection from their computers to AWS or connected networks.
AWS Client VPN uses OpenVPN-based connectivity.
Important configuration considerations include:
- User authentication.
- Endpoint configuration.
- Authorization rules.
- Routes.
Real-world example
Imagine a DevOps engineer working remotely needs to access an internal application or a private EC2 instance for troubleshooting.
Instead of exposing the instance's management port to the public internet, the engineer can connect through an appropriately configured Client VPN and access authorized private resources.
Remember the difference:
- Site-to-Site VPN connects networks.
- Client VPN connects individual users or devices to authorized networks.
8. AWS Direct Connect
Imagine a large company has an office or data center with hundreds of servers. It wants to connect its on-premises network to AWS.
One option is to use a VPN over the internet. But the company may want a more consistent network path, predictable performance characteristics, and private connectivity.
AWS Direct Connect establishes a dedicated network connection between your premises and AWS through a Direct Connect location.
Real-world example
Imagine a financial services company regularly transfers large volumes of data from its on-premises data center to AWS for analytics and reporting.
The company needs predictable network performance and a dedicated connection between its infrastructure and AWS.
AWS Direct Connect can provide that dedicated network path.
Unlike a Site-to-Site VPN that typically uses an encrypted tunnel over the public internet, Direct Connect uses a dedicated network connection. Direct Connect does not automatically encrypt all traffic, so additional encryption may be required depending on security requirements.
Important: Direct Connect is not automatically a replacement for VPN. Some organizations use both, including VPN as an additional or backup connectivity option.
9. VPC Peering
VPC Peering allows two VPCs to communicate privately using their private IP addresses.
VPC Peering does not automatically provide encryption at the application layer. If your requirements call for end-to-end encryption, use suitable protocols such as TLS or an appropriate VPN architecture.
VPC Peering is non-transitive
This is an important concept.
Suppose:
- VPC A is peered with VPC B.
- VPC B is peered with VPC C.
VPC A still cannot communicate with VPC C through VPC B using those peering connections alone.
In other words, VPC Peering does not automatically provide transitive routing.
Steps to configure VPC Peering
- Create a peering connection request from one VPC to the other.
- Accept the request, if required.
- Add a route in the production-side route table for the development VPC CIDR, targeting the peering connection.
- Add a route in the development-side route table for the production VPC CIDR, targeting the same peering connection.
- Configure security groups and network ACLs appropriately.
- Test connectivity using the correct private IP address and application port.
Real-world example
Imagine a company has two VPCs:
- Production VPC:
10.0.0.0/16 - Development VPC:
10.1.0.0/16
The development team needs to access a shared internal service hosted in the production VPC.
VPC Peering can establish private connectivity between these VPCs. After the peering connection is established, the required routes and security rules must be configured on both sides.
However, if the company later adds many more VPCs, managing separate peering connections and routes can become increasingly complex.
That is where Transit Gateway becomes useful.
10. AWS Transit Gateway (TGW)
Transit Gateway acts as a central network hub connecting multiple VPCs and networks.
It can route traffic between attached networks when routing is configured.
VPC Peering can connect two VPCs, but as the number of VPCs increases, managing individual connections and routes becomes complicated.
For example, a company may have:
- Production VPC
- Development VPC
- Testing VPC
- Monitoring VPC
- Security VPC
Transit Gateway helps solve this problem by acting as a central networking hub.
How does Transit Gateway work?
Suppose an application in the Production VPC needs to communicate with a monitoring server in the Testing VPC.
The traffic flow is as follows:
- The production server sends traffic to the monitoring server's private IP address.
- The production subnet's route table directs that destination range to the Transit Gateway.
- The Transit Gateway checks its own route table.
- It forwards traffic to the Testing VPC attachment.
- The Testing VPC's routes and security controls allow the connection.
What is an attachment?
An attachment connects a network to the Transit Gateway.
Examples include:
- A VPC attachment.
- A Site-to-Site VPN attachment.
- A Direct Connect gateway integration through a Transit Gateway attachment.
- Other supported network attachments, depending on the configuration.
Transit Gateway route tables
A Transit Gateway can have its own route tables. These determine which attachment should receive traffic destined for a particular network.
Real-world example
Imagine a company operates separate AWS environments for production, development, testing, and monitoring.
The monitoring team needs to collect metrics from authorized resources across multiple VPCs.
Instead of creating and maintaining numerous individual peering connections, the company can attach its VPCs to a Transit Gateway and configure routes to control communication between them.
This provides a centralized approach to network connectivity and routing.
Key takeaway: VPC Peering is useful for connecting individual VPCs, while Transit Gateway is particularly useful when managing connectivity across many VPCs and networks.
11. VPC Endpoints
Imagine your private EC2 instance needs to access an AWS service such as Amazon S3.
Without a VPC Endpoint, the traffic might go through a NAT Gateway and an Internet Gateway, depending on your architecture.
But what if you want your private resources to access supported AWS services without requiring an Internet Gateway or NAT Gateway for that traffic?
That's where VPC Endpoints help.
A VPC Endpoint provides a private connection between your VPC and a supported AWS service or endpoint service.
For example, you want an EC2 instance to download files from Amazon S3.
The instance can access S3 through the endpoint, provided its routing, DNS, and authorization configuration are correct.
A VPC Endpoint does not automatically grant permission to access an AWS service. It provides connectivity; IAM policies and service-specific policies determine what the caller is allowed to do.
Real-world example
Imagine a company stores application backups, logs, and deployment artifacts in Amazon S3.
Its application servers run in private subnets and should not require general internet access just to communicate with S3.
The company can configure an appropriate VPC Endpoint so that traffic to S3 follows the private endpoint path.
This can reduce the need for NAT Gateway connectivity for that specific traffic and help keep service access within the intended network architecture.
Why are VPC Endpoints useful?
- They enable private connectivity to supported AWS services.
- They can reduce the need for NAT Gateway or Internet Gateway connectivity for the relevant traffic.
- They help organizations design more controlled network architectures.
- They work alongside IAM and service-specific policies to manage access.
The exact endpoint type and configuration depend on the AWS service being accessed.
13. Final Summary
Let's quickly revise the major AWS networking concepts covered in this article.
| Component | Primary purpose |
|---|---|
| VPC | Provides a logically isolated virtual network in AWS |
| CIDR | Defines an IP address range |
| Subnet | Divides a VPC into smaller network segments |
| Internet Gateway | Enables internet connectivity for appropriately configured VPC resources |
| NAT Gateway | Enables outbound connectivity for private resources without allowing unsolicited inbound internet connections |
| Route Table | Determines where network traffic should be directed |
| Site-to-Site VPN | Connects an on-premises network to AWS over an encrypted VPN connection |
| Client VPN | Provides VPN connectivity for individual users |
| Direct Connect | Provides a dedicated network connection between premises and AWS |
| VPC Peering | Connects two VPCs privately |
| Transit Gateway | Acts as a central hub for connecting multiple VPCs and networks |
| VPC Endpoint | Provides private connectivity to supported AWS services or endpoint services |
Series: AWS VPC (2 articles)
- 1AWS VPC Deep Dive Part 1: IGW, NAT Gateway, VPN, Peering, and Endpoints. This article
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article