AWS VPC Explained: Subnets, Route Tables, NAT Gateway & Secure Cloud Networking

Introduction

When building applications on AWS, one of the most important architectural components is networking.

In traditional infrastructure, organizations design private networks inside their data centers. In AWS, this capability is provided through Virtual Private Cloud (VPC).

Understanding VPC is critical for:

• Designing secure architectures
• Deploying scalable applications
• Passing AWS certification exams

In this article we will explore:

• What is VPC
• Subnets
• Route tables
• Internet Gateway
• NAT Gateway
• Security Groups vs NACL
• Real-world architecture

🌐 What is VPC?

Amazon VPC

A VPC (Virtual Private Cloud) is a logically isolated network inside AWS.

Think of it as your own private data center network in the cloud.

Inside a VPC you can control:

• IP address ranges
• Subnets
• Routing rules
• Security policies
• Internet access

Every resource like EC2 or RDS is launched inside a VPC.

🧱 CIDR Block

When creating a VPC, you define an IP range using CIDR notation.

Example:

10.0.0.0/16

This determines how many IP addresses are available in your network.

Example architecture:

• VPC → 10.0.0.0/16
• Subnet A → 10.0.1.0/24
• Subnet B → 10.0.2.0/24

This allows network segmentation.

🏢 Subnets

Subnets divide your VPC into smaller networks.

Each subnet belongs to one Availability Zone.

Two main types exist.

Public Subnet

Resources in this subnet can access the internet.

Examples:

• Load balancers
• Bastion hosts
• Public web servers

A subnet becomes public when it has a route to the Internet Gateway.

Private Subnet

Resources here are not directly accessible from the internet.

Examples:

• Databases
• Internal APIs
• Backend services

Private subnets improve security by isolating sensitive systems.

🌍 Internet Gateway

An Internet Gateway allows communication between the VPC and the internet.

Without it:

• Instances cannot access the internet
• Users cannot reach your application

Internet Gateway is attached at the VPC level.

Public subnets use route tables to send traffic to it.

📍 Route Tables

Route tables control where network traffic is directed.

Each route table contains rules.

Example:

DestinationTarget10.0.0.0/16Local0.0.0.0/0Internet Gateway

The rule 0.0.0.0/0 means all internet traffic.

Public subnet route tables send traffic to the Internet Gateway.

Private subnet route tables do not.

🔄 NAT Gateway

Instances in private subnets often need internet access for:

• Software updates
• API calls
• Package downloads

But they should not be accessible from outside.

Solution: NAT Gateway.

Flow:

Private EC2 → NAT Gateway → Internet

Inbound traffic from the internet is blocked.

This keeps backend services secure.

🔐 Security Groups vs NACL

This is a very common certification question.

Security Groups

Act as instance-level firewalls.

Features:

• Stateful
• Allow rules only
• Attached to EC2 instances

Example:

Allow:

• Port 80
• Port 443
• Port 22

Network ACL (NACL)

Acts at subnet level.

Features:

• Stateless
• Allow and Deny rules
• Evaluated in order

Certification Tip:

Security Groups are more commonly used than NACLs.

🏗 Real-World Architecture Example

Let’s design a simple three-tier architecture.

VPC Architecture:

Public Subnet:

• Application Load Balancer
• Bastion host

Private Subnet:

• EC2 application servers

Private Database Subnet:

• RDS database

Flow:

User → Load Balancer → EC2 → RDS

Security layers ensure databases remain private.

This is a very common production architecture.

📌 Key Takeaways

• VPC provides isolated networking in AWS
• Subnets divide the network into segments
• Internet Gateway allows internet connectivity
• Route tables control traffic routing
• NAT Gateway enables secure outbound internet access
• Security Groups protect instances
• NACL protects subnets

Understanding VPC is essential for designing secure AWS architectures.