A Practical Tour of AWS Networking: VPCs, Subnets, Gateways, and More

A Practical Tour of AWS Networking: VPCs, Subnets, Gateways, and MoreIf youre new to AWS, networking is one of the first — and most confusing — topics youll run into. There are subnets, gateways, route tables, security groups, NACLs... and its not always obvious how they fit together. This article walks through the core building blocks of AWS networking, piece by piece, so you can build a clear mental model of how traffic actually flows in and out of your cloud environment.The Foundation: VPC (Virtual Private Cloud)Think of aVPCas your own private data center in the cloud. Its an isolated network environment where you control the IP address ranges, subnets, route tables, and gateways.A few key things to know about VPCs:Connections into a VPC can be secured using VPN protocols.Within a VPC, you createsubnets, which can be designated as public or private.Multiple VPCs can talk to each other throughVPC peering.Everything else in this article — subnets, gateways, NAT, security groups — existsinsideorarounda VPC.Subnets: Public vs. PrivateA VPC is carved up into subnets, and each subnet falls into one of two categories:Public Subnets (DMZ)— reachable from the internetPrivate Subnets— isolated from direct internet accessWhether a subnet is public or private isnt an inherent property — its determined by its route table (more on that below). A subnet is public specifically because its route table sends internet-bound traffic to an Internet Gateway.VPC Endpoints: Reaching AWS Services Without the InternetNormally, if a resource inside your VPC wants to talk to a service like S3 or Lambda, that traffic would need to leave your VPC.VPC Endpointslet you connect directly to AWS services without routing traffic over the public internet — keeping traffic inside the AWS network and reducing exposure.Security Groups: Instance-Level FirewallsSecurity Groupsare one of the most commonly used — and misunderstood — controls in AWS networking. A few important clarifications:Security groups arenotfor user or IAM management — thats a separate concern entirely.They work like a firewall attached to an EC2 instance.They only supportallowrules — anything not explicitly allowed is implicitly denied.Rules can be defined separately forinbound (ingress)andoutbound (egress)traffic.Security groups apply at theinstance level, not the subnet level.That last point matters: two instances in the same subnet can have completely different security group rules.Network ACLs (NACLs): Subnet-Level FirewallsWhile security groups protect instances,Network Access Control Lists (NACLs)protect subnets. Key differences from security groups:Applied at thesubnetlevel, not the instance level.Support bothallow and denyrules.Rules are evaluated in order —first match wins.Because NACLs operate at a different layer than security groups, theyre often used together: NACLs as a coarse-grained subnet perimeter, and security groups as fine-grained, per-instance rules.Route Tables: The Traffic DirectorARoute Tabledefines the rules AWS uses to decide where network traffic gets sent. Each route table is associated with a VPC and specific subnets within it.In a typical setup, youll see at least two entries:Alocal routethat routes traffic within the VPC.A route forinternet access, typically pointing to an Internet Gateway (for public subnets) or a NAT device (for private subnets).NAT: Letting Private Resources Reach the InternetPrivate subnets, by definition, arent directly reachable from the internet — but their instances often still need outbound access (thinkyum update, hitting an external database,wgetcalls, OS patching). Thats whereNetwork Address Translation (NAT)comes in.NAT interconnects private and public networks.AnElastic IPis attached to the NAT device on its public-facing side.Its strictlyone-way: instances in a private subnet can reach the internet through NAT, but the internet cannot initiate connections back into your private resources through it.NAT can be implemented as a self-managedNAT instanceor as a managedAWS NAT Gateway.NAT gateways operate within a single Availability Zone, so for high availability youll want oneper AZ.Heres how the traffic flow looks in practice:Internet Gateway: The Front DoorAnInternet Gateway (IGW)is the logical connection between a VPC and the public internet. A few things worth remembering:Its a logical construct, not a physical appliance.Without an IGW, nothing in your VPC is reachable from the internet (unless traffic arrives via a corporate network, VPN, or Direct Connect).An IGW enables traffic inbothdirections — but only if a route table entry points the subnet at it.This is exactly what makes a subnet public: a route table entry sending traffic to the IGW.To see how NAT and IGW relate to each other architecturally:VPN Connections: Bridging to On-PremisesWhen you need a secure connection between your AWS VPC and an on-premises network, AWS provides VPN gateways for exactly that:AWS supports gateways that connect a VPC to local, on-premises networks.These gateways are, effectively, VPN endpoints.TheVirtual Private Gateway (VPG)lives on the AWS side, in the cloud.TheCustomer Gateway (CGW)lives on the customers side, in their own network.Transit Gateway: Simplifying Complex Network TopologiesAs your AWS footprint grows — more VPCs, more accounts, more VPN connections — managing point-to-point connections between everything becomes unwieldy.Transit Gatewaysolves this by acting as a central hub:Centralizes regional network management.Connects to multiple VPCs at once.Can be peered across multiple AWS accounts.Supports multiple VPN connections simultaneously.Supports multiple AWS Direct Connect gateways simultaneously.Putting It All TogetherOnce you understand each piece individually, they combine into a coherent architecture: VPCs contain public and private subnets, route tables direct traffic to IGWs or NAT gateways depending on subnet type, security groups and NACLs layer defense at the instance and subnet level, and Transit Gateway or VPN connections extend the network beyond a single VPC.Heres what a typical AWS VPC network architecture looks like when all of these components come together:Wrapping UpAWS networking can feel overwhelming at first because so many components interact: VPCs, subnets, route tables, gateways, NAT, security groups, and NACLs. But once you see how each piece routes or filters traffic — and how they layer together — the whole picture becomes much clearer. Start with the VPC as your container, understand how route tables decide where traffic goes, and layer security controls (NACLs at the subnet level, security groups at the instance level) on top. From there, the rest — NAT, IGW, VPN, Transit Gateway — are just different ways of extending that network to the outside world.