AWS VPC Deep Dive: Subnets, Route Tables, NAT Gateways, and VPC Peering Explained
A complete technical deep dive into Amazon VPC architecture covering CIDR blocks, public and private subnets, route tables, NAT gateways, security groups, NACLs, VPC peering, endpoints, and flow logs.
Amazon Virtual Private Cloud (VPC) is one of the most misunderstood services in AWS. Many beginners can launch an EC2 instance but cannot explain how the network actually works behind it. This article provides a complete technical deep dive into VPC architecture for engineers, architects, and anyone preparing for AWS certifications.
1. What is a VPC?
A VPC is a logically isolated virtual network within AWS. You define its IP address range using CIDR notation. Every resource you launch, such as EC2 instances, RDS databases, Lambda functions, and ECS tasks, runs inside a VPC.
When you create an AWS account, a default VPC is created in each region. This default VPC has a pre-configured CIDR block (usually 172.31.0.0/16), one public subnet per Availability Zone, an internet gateway, and a main route table. It is designed for quick starts but is not suitable for production workloads because it lacks network segmentation and security controls.
2. CIDR Blocks and IP Addressing
CIDR stands for Classless Inter-Domain Routing. It defines the range of IP addresses available in your VPC.
Example: 10.0.0.0/16
- The /16 means the first 16 bits are fixed.
- The remaining 16 bits are available for hosts.
- This gives 2^16 = 65,536 total IP addresses.
Subnetting Example:
If your VPC is 10.0.0.0/16, you can divide it into smaller subnets:
| Subnet Name | CIDR Block | Usable IPs |
|---|---|---|
| Public Subnet A | 10.0.1.0/24 | 251 |
| Public Subnet B | 10.0.2.0/24 | 251 |
| Private Subnet A | 10.0.11.0/24 | 251 |
| Private Subnet B | 10.0.12.0/24 | 251 |
| Database Subnet A | 10.0.21.0/24 | 251 |
| Database Subnet B | 10.0.22.0/24 | 251 |
Why 251 and not 256?
AWS reserves 5 IP addresses in every subnet:
- 10.0.1.0: Network address
- 10.0.1.1: Reserved for the VPC router
- 10.0.1.2: Reserved for DNS
- 10.0.1.3: Reserved for future use
- 10.0.1.255: Broadcast address
Important VPC CIDR rules:
- Minimum CIDR block size: /28 (16 addresses)
- Maximum CIDR block size: /16 (65,536 addresses)
- CIDR blocks cannot overlap with other VPCs if you plan to peer them.
- You can add secondary CIDR blocks to an existing VPC.
- You cannot change or delete the primary CIDR block after creation.
3. Subnets: Public vs Private
A subnet is a range of IP addresses within your VPC. Each subnet must reside entirely within one Availability Zone. You cannot span a subnet across multiple AZs.
3.1 Public Subnet
A public subnet is a subnet whose route table has a route to an Internet Gateway.
Resources in a public subnet can:
- Have public IP addresses
- Communicate directly with the internet
- Host load balancers, bastion hosts, and web servers
3.2 Private Subnet
A private subnet is a subnet whose route table does NOT have a route to an Internet Gateway.
Resources in a private subnet:
- Cannot be reached directly from the internet
- Use a NAT Gateway for outbound internet access
- Host databases, application servers, and internal services
Best practice: Place databases and application servers in private subnets. Place only load balancers and bastion hosts in public subnets.
4. Route Tables
A route table contains a set of rules, called routes, that determine where network traffic is directed.
Every subnet must be associated with exactly one route table. A route table can be associated with multiple subnets.
Example public subnet route table:
| Destination | Target | Meaning |
|---|---|---|
| 10.0.0.0/16 | local | Internal VPC traffic |
| 0.0.0.0/0 | igw-xxxxxxxx | All other traffic to Internet Gateway |
Example private subnet route table:
| Destination | Target | Meaning |
|---|---|---|
| 10.0.0.0/16 | local | Internal VPC traffic |
| 0.0.0.0/0 | nat-xxxxxxxx | All other traffic to NAT Gateway |
Example database subnet route table (no internet):
| Destination | Target | Meaning |
|---|---|---|
| 10.0.0.0/16 | local | Internal VPC traffic only |
5. Internet Gateway (IGW)
An Internet Gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet.
Key facts:
- One IGW per VPC
- Attached to the VPC, not to a subnet
- Performs NAT for instances with public IP addresses
- Does not have bandwidth constraints
- Free to use (you only pay for data transfer)
6. NAT Gateway
A NAT Gateway enables instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating connections to those instances.
Key facts:
- Created in a public subnet
- Requires an Elastic IP
- Charged per hour and per GB of data processed
- Managed by AWS (no patching required)
- For high availability, deploy one NAT Gateway per Availability Zone
NAT Gateway vs NAT Instance:
| Feature | NAT Gateway | NAT Instance |
|---|---|---|
| Management | AWS managed | Self managed |
| Availability | Highly available within AZ | Manual failover |
| Bandwidth | Up to 45 Gbps | Depends on instance type |
| Cost | Higher | Lower |
| Security Groups | Not supported | Supported |
| Bastion Host | Not supported | Supported |
NAT Instance is now considered legacy. Use NAT Gateway for production.
7. Security Groups vs Network ACLs
This is a common exam topic. Both are used for security, but they work differently.
| Feature | Security Group | Network ACL |
|---|---|---|
| Level | Instance level | Subnet level |
| State | Stateful | Stateless |
| Rules | Allow only | Allow and Deny |
| Evaluation | All rules evaluated | Rules evaluated in order |
| Default | Deny all inbound, allow all outbound | Allow all inbound and outbound |
| Applies to | ENI, EC2, RDS, Lambda | Subnet |
Stateful means if you allow inbound traffic, the outbound response is automatically allowed. Stateless means you must explicitly allow both inbound and outbound traffic.
Best practice: Use Security Groups as your primary security mechanism. Use NACLs as an additional layer of defense.
8. VPC Peering
VPC Peering connects two VPCs so they can communicate using private IP addresses.
Key facts:
- Works across accounts and regions (Inter-Region Peering)
- CIDR blocks must not overlap
- Peering is not transitive. If A peers with B, and B peers with C, A cannot talk to C through B.
- You must update route tables in both VPCs
- Security Groups can reference peered VPCs
When to use VPC Peering:
- Connecting two VPCs in the same account
- Connecting VPCs across different AWS accounts
- Simple point-to-point connectivity
When NOT to use VPC Peering:
- When you need transitive routing (use Transit Gateway instead)
- When you have many VPCs (peering becomes complex)
9. VPC Endpoints
VPC Endpoints allow you to privately connect your VPC to supported AWS services without requiring an Internet Gateway, NAT Gateway, or VPN.
Two types:
Gateway Endpoints: Used for S3 and DynamoDB. Free to use.
Interface Endpoints: Used for most other AWS services. Powered by AWS PrivateLink. Charged per hour and per GB.
Why use VPC Endpoints:
- Keeps traffic within the AWS network
- Improves security
- Reduces NAT Gateway costs
- Required for compliance in some industries
10. VPC Flow Logs
VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC.
You can publish flow logs to:
- Amazon CloudWatch Logs
- Amazon S3
- Amazon Kinesis Data Firehose
What you can do with flow logs:
- Troubleshoot connectivity issues
- Detect anomalous traffic
- Monitor for security threats
- Audit network usage
11. Real-World Architecture Example
A typical three-tier architecture in a VPC looks like this:
Public Subnet (AZ-A and AZ-B):
- Application Load Balancer
- Bastion Host
- NAT Gateway
Private Subnet (AZ-A and AZ-B):
- EC2 application servers
- Auto Scaling group
Private Subnet (AZ-A and AZ-B, separate CIDR):
- RDS database (Multi-AZ)
- ElastiCache cluster
Route Tables:
- Public route table: 0.0.0.0/0 to IGW
- Private route table: 0.0.0.0/0 to NAT Gateway
Security Groups:
- ALB SG: allow 80 and 443 from 0.0.0.0/0
- App SG: allow 8080 from ALB SG only
- DB SG: allow 3306 from App SG only
This architecture is highly available, secure, and follows AWS best practices.
12. Common VPC Mistakes
- Overlapping CIDR blocks: Prevents VPC peering. Plan your IP ranges carefully.
- Putting databases in public subnets: A major security risk.
- Using the default VPC for production: It is not designed for it.
- Forgetting to update route tables after peering: Peering will not work.
- Using one NAT Gateway for multiple AZs: Creates a single point of failure.
- Not enabling Flow Logs: You lose visibility into your network.
- Opening Security Groups to 0.0.0.0/0 on all ports: Opens your resources to the world.
- Forgetting to delete unused Elastic IPs: You are charged for unattached EIPs.
13. VPC Limits to Know
| Resource | Default Limit |
|---|---|
| VPCs per region | 5 |
| Subnets per VPC | 200 |
| Internet Gateways per region | 5 |
| NAT Gateways per AZ | 5 |
| Route tables per VPC | 200 |
| Security Groups per VPC | 2,500 |
| Rules per Security Group | 60 inbound, 60 outbound |
| Network ACLs per VPC | 200 |
| VPC Peering connections per VPC | 125 |
| Flow Logs per VPC | 2 |
These limits can be increased by contacting AWS Support.
14. Final Summary
VPC is the networking foundation of AWS. Understanding CIDR blocks, subnets, route tables, Internet Gateways, NAT Gateways, Security Groups, NACLs, peering, endpoints, and flow logs is essential for any cloud engineer or architect.
The key takeaway is this: design your VPC carefully from the start. Changing it later is difficult and risky. Plan your CIDR blocks, separate public and private resources, and always follow the principle of least privilege.
Mastering VPC is the difference between being someone who uses AWS and someone who understands AWS.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article