AWS network access depends on several settings working together: the VPC and subnet, the subnet’s route table, the route target, IP addressing, security group rules, and network ACL rules. A subnet is not internet-reachable just because it is named “public” or an internet gateway is attached to its VPC.
What is an AWS VPC?
An Amazon Virtual Private Cloud (VPC) is a logically isolated virtual network that you define in AWS. It has one or more IP address ranges, and you divide that space into smaller ranges called subnets. Each subnet belongs to one Availability Zone. If an architecture needs to keep operating through an Availability Zone failure, place resources in subnets in more than one zone.
![Computer Networking Bible: [3 in 1] The Complete Crash Course to Effectively Design, Implement and Manage Networks. Including Sections on Security, Performance and Scalability](https://m.media-amazon.com/images/I/41H4YJnxKgL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
A subnet normally has an IPv4 CIDR block; it can also use IPv6 if the VPC has an IPv6 range. An IPv6-only subnet provides instances with IPv6 but not IPv4, and requires instances on the Nitro System. See the Amazon VPC User Guide overview for the underlying VPC and subnet concepts.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do route tables work in AWS?
A route table maps a destination address range to a target, such as a gateway or connection. Each subnet uses one route table: a custom table explicitly associated with it, or the VPC’s main route table when no explicit association is made. Route tables include a local route for traffic within the VPC. When multiple routes match a destination, AWS selects the most specific matching route.
#1 Best Overall
IPv4 and IPv6 destinations are distinct. 0.0.0.0/0 is the catch-all IPv4 route; ::/0 is the catch-all IPv6 route. Configuring one does not configure the other.
The route target depends on the intended path. An internet gateway can provide a route to the internet; a NAT gateway can enable private-subnet outbound internet access; and peering or VPN connections can connect networks. VPC endpoints can provide private access to AWS services without an internet gateway or NAT device. See AWS documentation on subnet route tables.
What is the difference between a public and private subnet in AWS?
A subnet is public when its associated route table has a route to an internet gateway. Without that route, it is private. The subnet’s name, CIDR block, or the mere presence of an attached internet gateway does not determine whether it is public.
For an IPv4 instance to communicate with the internet through an internet gateway, it also needs a public IPv4 address or Elastic IP. An IPv6 instance needs IPv6 addressing and a route for the relevant IPv6 traffic. In both cases, security controls must allow the intended traffic.
A private subnet can still have outbound connectivity through a NAT device, or private access to AWS services through endpoints, without a direct internet-gateway route. The AWS internet gateway guide explains the address and routing requirements for internet connectivity.
What does an internet gateway do?
An internet gateway is a VPC component that enables communication between a VPC and the internet when it is attached to the VPC and used as a route target. For public IPv4 traffic, it performs one-to-one network address translation between an instance’s private IPv4 address and its public IPv4 address. It does not, by itself, make every instance reachable from the internet.
Rank #4
- Attach an internet gateway to the VPC.
- Associate the subnet with a route table that sends the relevant destination traffic to that gateway.
- Assign the instance the required public IPv4 address or IPv6 address.
- Allow the intended traffic in the instance’s security group and, if applicable, the subnet’s network ACL.
IPv6 addresses are globally unique and public by default, so configure filtering deliberately rather than assuming IPv6 is private. AWS’s internet gateway documentation covers gateway setup and connectivity prerequisites.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat is the difference between a security group and a network ACL?
Both control traffic, but they apply at different scopes and handle return traffic differently. A security group is attached to resources; a network ACL is associated with a subnet. AWS describes network ACLs as an additional security layer, not a replacement for security groups.
Best Value
| Control | Scope | Rules | Statefulness | Evaluation |
|---|---|---|---|---|
| Security group | Resource | Allow rules | Stateful: response traffic for an allowed connection is permitted automatically | Not an ordered allow/deny list |
| Network ACL (NACL) | Subnet | Allow and deny rules | Stateless: return traffic must be allowed separately | Numbered rules are evaluated from lowest to highest; the first matching rule applies |
Security group rules specify a protocol, port range, and source for inbound traffic or destination for outbound traffic. Limit administrative ports such as SSH and RDP to the address ranges that need access, rather than opening them broadly. With a NACL, check both inbound and outbound rules: allowing a request in does not automatically allow its response back out. See the AWS guides for security groups and network ACLs.
How to troubleshoot a connection that is not working
Check the network path in dependency order; a permissive rule cannot compensate for a missing route, and a route cannot compensate for a missing address or blocked traffic.
Quick Recap
- Confirm the resource is in the intended VPC and subnet.
- Check which route table the subnet uses, including whether it inherits the main route table, and find the most specific route matching the destination.
- Verify that the route’s target is attached and valid for the intended path.
- If internet access is intended, confirm the required public IPv4 or IPv6 address and corresponding route are present.
- Review the resource’s security group ingress and egress rules for the protocol, port, source, or destination.
- Review the subnet NACL’s numbered rules in both directions. For a failed response path, remember that NACLs are stateless and must permit return traffic separately.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
