Free tools Windows power users keep installed
One-click scans. No signup required.
To build an AWS VPC, create an address space, divide it into subnets, and configure route tables and gateways to control where traffic can go. A subnet is public only when its route table has a direct route to an internet gateway; private-subnet internet egress, if needed, usually requires a NAT gateway. The steps below follow AWS’s CLI tutorial, but example IDs and CIDRs must be replaced with values for your account and Region.
What a VPC is—and what it needs before it can carry traffic
Amazon Web Services describes a VPC as “A VPC is a virtual network that closely resembles a traditional network that you’d operate in your own data center.” It provides a network boundary and IP address space for AWS resources, but creating the VPC alone does not configure a usable network. Subnets, routes, gateways, and security rules determine how workloads communicate. AWS VPC User Guide
As an Amazon Associate I earn from qualifying purchases.
- VPC: the network container with a CIDR address range.
- Subnet: a smaller range inside the VPC, located in exactly one Availability Zone (AZ).
- Route table: destination-and-target rules that determine where subnet traffic is sent.
- Gateway: a connection point for traffic, such as an internet gateway for internet routing or a NAT gateway for private-subnet outbound IPv4 traffic.
Each subnet is associated with exactly one route table at a time. If you do not associate a different one explicitly, it uses the VPC’s main route table. A route table can be associated with multiple subnets. AWS: Subnet route tables
Public, private, and isolated subnets: what the routes mean
“Public” and “private” describe a subnet’s routing, not its name. A public subnet has a direct route to an attached internet gateway. A private subnet has no direct route to that gateway. A subnet without a route for general internet access is often described as isolated, although it may still have routes to other destinations within the VPC or to specific services.
#1 Best Overall
A common public IPv4 route table has a local route for communication within the VPC and a default route, 0.0.0.0/0, whose target is the VPC’s internet gateway. That route does not by itself make every instance reachable from the internet: a workload also needs suitable addressing and security configuration. AWS’s configuration guide explains the relationship between subnet routing and internet connectivity. AWS: VPC configuration options
Internet gateway, NAT gateway, or VPC endpoint?
| Option | Traffic path and purpose | Reachability and scope | Design and cost considerations |
|---|---|---|---|
| Internet gateway | Routes eligible VPC traffic between a subnet and the internet. | Used by a public subnet’s direct internet route; actual workload reachability also depends on addressing and security rules. | Must be attached to the VPC and referenced by the route table. The tutorial warns that created resources can incur charges; consult current AWS pricing for your Region. |
| NAT gateway | Lets instances in private subnets initiate outbound IPv4 connections to the internet. | Provides outbound access through NAT; internet hosts cannot initiate connections to those instances through that NAT path. | Billable. AWS recommends a NAT gateway in each active AZ for production availability, which adds cost compared with a single-AZ setup. |
| VPC endpoint | Provides a private connection to supported AWS services. | Service-specific; it is not a general route to the public internet. | Can avoid sending supported service traffic through an internet gateway or NAT device. Check the endpoint type and service coverage for the service you need. |
A VPC endpoint is worth considering when the destination is a supported AWS service rather than the general internet. AWS’s VPC User Guide describes endpoint connectivity. AWS VPC User Guide
Plan the network before creating resources
Choose a VPC CIDR and subnet CIDRs before running commands. The ranges must fit inside the VPC range and should not overlap with networks that need to communicate with it, such as connected VPCs or an on-premises network. Decide which AZs will host the subnets: each subnet belongs to one AZ. For a basic learning setup, create one public and one private subnet; a resilient design generally spans multiple AZs. AWS: Create a VPC
Prepare access as well: install and configure the AWS CLI, select a Region, and use credentials with the required VPC permissions. AWS’s getting-started tutorial assumes basic networking knowledge and suitable IAM access. Its sample CIDRs and resource IDs are examples, not values to copy blindly into an account. AWS: Getting started with Amazon VPC using the AWS CLI
How to create a VPC in AWS from scratch
The following is the build sequence in AWS’s CLI tutorial. Use the tutorial’s current commands and substitute your own Region, CIDR ranges, Availability Zones, and resource IDs wherever the examples require them. This overview is not a ready-to-run command script: later commands depend on IDs returned by earlier steps.
- Configure CLI access and Region. Install and configure the AWS CLI, choose the target Region, and confirm that your credentials have permission to create and manage the required VPC resources.
- Create the VPC. Choose a non-overlapping IPv4 CIDR and create the network container. Record the VPC ID returned by AWS; later resources must reference it.
- Create subnets. Create subnet ranges inside the VPC CIDR and select an AZ for each. For a basic layout, create a public subnet and a private subnet. Record each subnet ID.
- Create and attach an internet gateway. Create the gateway and attach it to the VPC. The attachment alone does not provide internet routing; a route table must point traffic to it.
- Set up public routing. Create or select a route table, add the local route (created for the VPC) and an IPv4 default route to the internet gateway, then associate that table with the public subnet.
- Set up private routing. Associate the private subnet with a route table that does not have a direct internet-gateway route. Add only the destinations the private workload requires.
- Add NAT egress only if required. If private instances need outbound IPv4 internet access, create a NAT gateway in a public subnet, wait until it is available, then add a default route from the private subnet’s route table to that NAT gateway.
- Configure workload security and test. Use security groups to allow only required traffic, launch a test workload, and check routes, associations, addressing, and security rules when connectivity does not work.
- Remove resources when finished. Tutorial resources can continue to incur costs. Delete resources you no longer need, following AWS’s cleanup sequence and dependency requirements.
For the exact AWS CLI command syntax and sequence, use the official AWS CLI getting-started tutorial. Commands use IDs generated in your own account; substituting another account’s sample identifiers will not work.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Do private subnets need a NAT gateway?
No. A NAT gateway is needed only when private-subnet resources require outbound IPv4 internet connectivity through that path. If a workload does not need general internet access, leave out that route and gateway. If it only needs access to supported AWS services, a VPC endpoint may provide a private route for those services instead.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteNAT gateways are billable, and AWS cautions that its tutorial resources may incur charges, especially NAT Gateway and EC2 charges. Pricing varies by Region and can change, so check AWS’s current pricing information or use the AWS Pricing Calculator before creating resources; the tutorial’s sample cost figures are not reliable as current estimates. For production, AWS recommends a NAT gateway in each active AZ. A single NAT gateway is a simpler learning layout, but routing other AZs through it creates an AZ dependency and is not the same availability design. AWS CLI tutorial and cost warning
Best Value
Single-AZ and multi-AZ layouts
| Layout | Resilience | Complexity | Cost considerations |
|---|---|---|---|
| One AZ, with one public and one private subnet | Workloads depend on that AZ; this is suitable for learning, not equivalent to a multi-AZ resilient design. | Fewer subnet and route associations to configure. | Can avoid duplicating NAT gateways across AZs, but a NAT gateway is still billable if used. |
| Multiple AZs, with subnets and a NAT gateway in each active AZ | Provides a design intended to avoid relying on one AZ for the NAT path. | Requires coordinating more subnets, route tables, and gateways. | More NAT gateways can increase costs; check current Region-specific pricing. |
Troubleshoot the traffic path, not just the instance
When a workload cannot connect, trace the route from the subnet outward and check each layer. A route is necessary but not sufficient for reachability.
- Confirm the subnet’s route-table association. Verify which table is associated with the subnet; if there is no explicit association, check the main table.
- Check the destination route and target. Public IPv4 internet traffic needs a default route to the attached internet gateway. Private-subnet outbound IPv4 internet traffic needs a route to an available NAT gateway if that is the chosen design.
- Check the gateway relationship. Confirm that the internet gateway is attached to the same VPC and that the route target is correct. For NAT, confirm the gateway is available and in a public subnet.
- Check workload addressing and security. Public routing does not automatically assign a public address or permit traffic. Review the workload’s addressing and security-group rules for the intended connection.
- Test direction and destination separately. A private instance’s ability to initiate an outbound connection through NAT does not mean an internet host can initiate a connection back through that NAT path. For AWS service traffic, verify that the service is supported by the selected VPC endpoint.
AWS’s route-table documentation details how subnet associations and route rules determine traffic paths. AWS: Subnet route tables
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
