Contents
AWS understand · networking · 20
Route Tables and Internet Gateway
A hand-drawn animated video with a voice and subtitles. Every fact in it comes from the official AWS documentation (listed at the end).
- A route table is a list of rules called routes. Each route = a destination (where traffic wants to go) + a target (the way to send it).
- Every route table has a local route for traffic inside the VPC. AWS adds it by default.
- Each subnet uses one route table at a time. If you do not pick one, it uses the main route table. One table can serve many subnets.
- An internet gateway lets a VPC talk to the internet. Only one can be attached to a VPC at a time.
- A route
0.0.0.0/0→ internet gateway makes a subnet public. The server also needs a public IP or an Elastic IP. - When routes overlap, the most specific route wins (longest prefix match).
Video file: aws-understand/06-networking/20-route-tables-and-internet-gateway/video.mp4
The ideas
01The picture, part by part
| AWS word | In the picture | What AWS docs say |
|---|---|---|
VPC | Gated society | A virtual network dedicated to your AWS account. |
| Subnet | A building | A range of IP addresses in your VPC. |
| Route table | Direction board at the building's exit | Contains a set of rules, called routes, that determine where network traffic from your subnet or gateway is directed. |
| Internet gateway | The society's main gate | A VPC component that allows communication between your VPC and the internet. |
| EC2 instance | A flat | Needs a public IPv4 address or Elastic IP address to talk to the internet over IPv4. |
Source: how-it-works.html, VPC_Route_Tables.html, VPC_Internet_Gateway.html
02Routes and the local route
| Part | Meaning (AWS docs) | Example |
|---|---|---|
| Destination | The range of IP addresses where you want traffic to go. | 0.0.0.0/0 (all IPv4 addresses) |
| Target | The gateway, network interface, or connection through which to send the traffic. | igw-id (an internet gateway) |
| Local route | A default route for communication within the VPC. Added by default to all route tables. | 10.0.0.0/16 → local |
AWS docs: "Your VPC has an implicit router, and you use route tables to control where network traffic is directed." Traffic is routed to targets based on its destination IP address.
Source: RouteTables.html, subnet-route-tables.html, VPC_Route_Tables.html
03Main vs custom route tables
| Rule | Answer |
|---|---|
| Does every VPC get a main route table? | Yes, automatically. |
| Can you delete the main route table? | No. |
| What is in it for a new nondefault VPC? | Only a local route (by default). |
| A subnet with no explicit table uses... | The main route table (implicit association). |
| Can a subnet use two route tables at once? | No, one at a time. |
| Can one route table serve many subnets? | Yes. |
| Can you delete a custom route table? | Only if it has no associations. |
Source: subnet-route-tables.html ("Main route table", "Custom route tables"), how-it-works.html
04The internet gateway
| Fact | AWS docs |
|---|---|
| What it is | A horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet. |
| Limits on traffic | It does not cause availability risks or bandwidth constraints on your network traffic. |
| How many per VPC | You can attach only 1 internet gateway to a VPC at a time. |
| Price | No charge for the internet gateway; data transfer charges apply for EC2 instances that use it. |
| NAT for IPv4 | It provides one-to-one NAT: the reply address of outgoing traffic is set to the instance's public IPv4 or Elastic IP address, and incoming traffic is translated back to the private IPv4 address. |
Source: VPC_Internet_Gateway.html, amazon-vpc-limits.html ("Gateways")
05What makes a subnet public
| Subnet | Route to an internet gateway? | Can its instances reach the internet? |
|---|---|---|
| Public subnet | Yes (for example 0.0.0.0/0 → igw-id) | Yes, if the instance has a public IP or Elastic IP |
| Private subnet | No | No, even if the instances have public IP addresses |
An Elastic IP address is a static (fixed) public IPv4 address. It is allocated to your AWS account and is yours until you release it.
Source: VPC_Internet_Gateway.html ("Routing configuration", "Internet gateway diagram"), EC2 elastic-ip-addresses-eip.html
06Most specific route wins
| Destination | Target | Which traffic uses it |
|---|---|---|
10.0.0.0/16 | local | Traffic inside the VPC |
172.31.0.0/16 | pcx-11223344556677889 | Traffic to 172.31.0.0/16: more specific than 0.0.0.0/0, so it wins |
0.0.0.0/0 | igw-12345678901234567 | All other traffic |
AWS docs: "In general, we direct traffic using the most specific route that matches the traffic. This is known as the longest prefix match." A peering connection (pcx-) is a networking connection between two VPCs.
Source: route-tables-priority.html, route-table-options.html ("Routing to a VPC peering connection")
07Internet access checklist
| Step | What to do |
|---|---|
| 1 | Create an internet gateway. |
| 2 | Attach it to the VPC. |
| 3 | In the subnet's route table, add destination 0.0.0.0/0 with the internet gateway as target. |
| Then | The EC2 instance needs a public IPv4 (or IPv6) address, and its security group must allow the traffic. |
The default VPC already has an attached internet gateway and a route in its main route table that sends all traffic to it.
Source: working-with-igw.html, how-it-works.html ("Default and nondefault VPCs")
Reference
—Sources
| What | Where (official AWS docs) |
|---|---|
| Configure route tables | vpc/latest/userguide/VPC_Route_Tables.html |
| Route table concepts | vpc/latest/userguide/RouteTables.html |
| Subnet route tables (local, main, custom, association) | vpc/latest/userguide/subnet-route-tables.html |
| Route priority, longest prefix match | vpc/latest/userguide/route-tables-priority.html |
| Example routing options | vpc/latest/userguide/route-table-options.html |
| Internet gateway | vpc/latest/userguide/VPC_Internet_Gateway.html |
| Add internet access to a subnet | vpc/latest/userguide/working-with-igw.html |
| How Amazon VPC works | vpc/latest/userguide/how-it-works.html |
| Amazon VPC quotas (one internet gateway per VPC) | vpc/latest/userguide/amazon-vpc-limits.html |
| Elastic IP addresses | AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html |