How VPC Components Work Together (Subnet, IGW, NAT, Route Tables)

In AWS networking, it is common to configure all required components—subnets, gateways, and route tables—yet still encounter connectivity issues.

In most cases, the problem is not with individual components, but with a lack of understanding of how these components interact with each other.

This article explains how key VPC components—subnets, route tables, Internet Gateway, and NAT Gateway—work together to control traffic flow within an AWS environment.

1. Virtual Private Cloud (VPC) Overview
A Virtual Private Cloud (VPC) is a logically isolated network within AWS where resources such as EC2 instances are deployed.

It provides full control over:

• IP address ranges
• Subnet configuration
• Routing
• Network connectivity

All networking components discussed in this article operate within the context of a VPC.

2. Subnets and Their Role
A subnet is a subdivision of a VPC’s IP address range. It allows you to organize resources based on access requirements.

Subnets are generally categorized as:

Public Subnet
A subnet is considered public if its associated route table allows outbound traffic to the internet via an Internet Gateway.

Private Subnet
A subnet is considered private if it does not have direct internet access through an Internet Gateway.

It is important to note that:

• The classification of a subnet as public or private is determined by its route table configuration, not by the subnet itself.

3. Route Tables: Controlling Traffic Flow
A route table defines how network traffic is directed within a VPC.

Each subnet must be associated with a route table, which contains rules (routes) specifying where traffic should be sent.

Typical routes include:

• Local route → Enables communication within the VPC
• 0.0.0.0/0 → Internet Gateway → Enables internet access
• 0.0.0.0/0 → NAT Gateway → Enables outbound internet access for private subnets

Route tables are the central decision point for determining traffic flow.

4. Internet Gateway (IGW)
An Internet Gateway is a VPC component that enables communication between resources in the VPC and the internet.

Key characteristics:

• It must be attached to the VPC
• It allows both inbound and outbound traffic
• It works in conjunction with route tables

For a subnet to allow internet access, its route table must include:

0.0.0.0/0 → IGW

Without this route, resources cannot communicate with the internet, even if an IGW is attached.

5. NAT Gateway
A NAT Gateway is used to allow instances in a private subnet to initiate outbound connections to the internet while preventing inbound connections.

Key points:

• Deployed in a public subnet
• Associated with an Elastic IP address
• Used by private subnet route tables

Example route in a private subnet:

0.0.0.0/0 → NAT Gateway

This ensures:

• Outbound internet access is allowed
• Direct inbound access from the internet is blocked

6. End-to-End Traffic Flow
Understanding how these components work together is best illustrated through traffic flow scenarios.

Scenario 1: Internet Access to a Public Instance

1. A user sends a request from the internet
2. The request reaches the Internet Gateway
3. The route table directs traffic to the public subnet
4. The EC2 instance processes the request and responds

This works because:

• The VPC has an attached IGW
• The subnet route table includes a route to the IGW

Scenario 2: Private Instance Accessing the Internet

1. The private instance initiates an outbound request
2. The route table directs traffic to the NAT Gateway
3. The NAT Gateway forwards the request via the Internet Gateway
4. The response is returned through the NAT Gateway

This allows outbound communication while maintaining isolation.

Scenario 3: Internet Access to a Private Instance

This scenario fails by design.

Reasons:

• No direct route exists from the Internet Gateway to the private subnet
• NAT Gateway does not allow inbound traffic initiation

This behavior ensures that private resources remain secure.

7. Common Configuration Issues
In practical environments, connectivity problems often arise due to:

• Missing route to Internet Gateway in public subnet
• NAT Gateway configured but not referenced in route tables
• Incorrect subnet association with route tables
• Misinterpretation of subnet types based on naming rather than routing

Careful validation of routing configuration is essential during troubleshooting.

Conclusion
In AWS networking, individual components such as subnets, gateways, and route tables are relatively simple to understand. However, effective architecture design and troubleshooting require a clear understanding of how these components interact.

A practical approach is to always think in terms of traffic flow:

• Where is the traffic originating?
• What route does it follow?
• Is the destination reachable based on routing configuration?

This perspective simplifies both design and debugging of VPC-based architectures and is essential for building secure and reliable systems in AWS.