AWS Builder Center

Builder Center

Securing Your AWS VPC: Route Tables, Security Groups, and Network ACLs Explained.

Securing Your AWS VPC: Route Tables, Security Groups, and Network ACLs Explained.

What We Built in This Project We expanded on our previous AWS setup by introducing: Route Tables: To manage where traffic is directed. Security Groups: To control traffic into and out of our EC2 instance. Network ACLs (NACLs): An extra layer of security at the subnet level.

Cherif Fall

Traffic Flow and Routing with Route Tables

After building our VPC, subnet, and internet gateway, the next step was to control how traffic flows in and out of our network.

What is a Route Table?

In AWS, a Route Table is like a map for your network. It tells your resources (like EC2 instances) where to go when trying to connect to other networks,
We looked at the default routes:
  • 172.31.0.0/16 → local: Allows internal communication within the VPC.
  • 0.0.0.0/0 → Internet Gateway: This lets your subnet connect to the internet.
We also created a custom route so our VPC knew to send outbound internet traffic through our Internet Gateway.

Adding Security Groups

Security Groups are like virtual firewalls for your EC2 instances. They check:
  • IP address (Where is the request coming from?)
  • Protocol (e.g., TCP, UDP)
  • Port Number (e.g., 22 for SSH, 80 for HTTP, 443 for HTTPS)

Rules We Set:

  • Inbound: Allowed SSH from my IP only.
  • Outbound: By default, AWS allows all outbound traffic (which we kept).
This helps ensure that your instance only talks to the internet when and how you allow it.

Network ACLs (NACLs)

Think of NACLs as bouncers at the subnet level — another layer of protection.
  • We didn’t create a new one, because AWS provides a default NACL, which is perfectly fine for this beginner project.
  • The default NACL allows all inbound and outbound traffic, similar to a basic open gate for learning purposes.

Why This Project Matters

If you’re learning AWS and cloud networking, setting this up manually:
  • Builds muscle memory.
  • Helps you understand traffic flow.
  • Strengthens your cloud security knowledge.
You’re not just watching — you’re doing. That’s the power of hands-on learning.

Final Setup Overview

Here’s what we ended up with:
  • AWS Region
  • VPC
  • Public Subnet
  • Security Group
  • Internet Gateway
  • Route Table
  • Network ACL
  • EC2 Instance (inside the public subnet, accessible via the internet)
And yes — we can access our EC2 instance successfully through SSH using the rules and routes we defined.
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article