beginnerintermediateadvanced

AWS · Networking Core Model

AWS Networking — Core Model

A VPC starts as an empty CIDR boundary — everything else is built on top, piece by piece

Isolated by defaulta VPC is its own network until you open it up
The route table decidespublic vs private is routing, not a label
A fixed set of piecessubnets, route tables, gateways, endpoints
Plan CIDR ranges to not collidepeering needs it later, even if not today

1.A VPC is your own isolated virtual network

A VPC is a private network you define inside AWS, isolated from every other customer's VPC by default. You choose its IP range, then everything else — subnets, routing, gateways — is built inside that boundary.

Key features

A VPC is scoped to one Region, spanning all its Availability Zones
You specify the VPC's IPv4 CIDR range (and optionally an IPv6 range) at creation
An account gets a default VPC per Region, pre-configured with public subnets and an internet gateway
A custom (nondefault) VPC starts with nothing but the IP range — no subnets, no gateway
Isolation is the default: nothing outside the VPC can reach in unless you explicitly allow it

What lives inside a VPC boundary

VPC — 10.0.0.0/16

Public subnet

has a path to the internet

Private subnet

no direct internet path

Route table

decides where traffic goes

Command

bash

aws ec2 create-vpc --cidr-block 10.0.0.0/16

A VPC is an isolated IP range you control end to end — a default VPC comes pre-wired for internet access, a custom VPC starts as an empty boundary you build up piece by piece.

2.VPC vocabulary: the pieces that make up a network

A VPC is built from a small, fixed set of pieces that each do one job: subnets carve up the IP range, route tables decide where traffic goes, gateways connect to the outside, and security groups/NACLs filter what is allowed through.

Key features

CIDR range: the block of IP addresses the VPC (or a subnet within it) owns
Subnet: a slice of the VPC's CIDR range, tied to one Availability Zone
Route table: rules that decide where traffic from a subnet is sent next
Internet gateway / NAT gateway: the two ways traffic reaches the public internet
VPC endpoint: a private path to an AWS service that never touches the public internet

The VPC component vocabulary and what each one controls

The VPC component vocabulary and what each one controls
Component	Controls
CIDR block	The IP address range owned by the VPC or a subnet
Subnet	A slice of that range, scoped to one Availability Zone
Route table	Where traffic from a subnet is sent next
Internet gateway	A path between the VPC and the public internet
NAT gateway	Outbound-only internet access for private-subnet resources
Security group	Stateful, instance-level allow rules
Network ACL	Stateless, subnet-level allow/deny rules
VPC endpoint	A private path to an AWS service, no internet gateway needed
DHCP option set	DNS servers and domain name handed to instances at boot

One subnet, wired public: three pieces working together

Subnet

10.0.1.0/24

eu-west-1a

Route table

0.0.0.0/0 → igw

default route

Association

makes the subnet public

all three pieces required together

Command

text

VPC (CIDR) → Subnets (per-AZ slices) → Route tables → Gateways / Endpoints
                                       ↘ Security groups + NACLs (filtering)

Subnets carve up the CIDR range, route tables decide where traffic goes, gateways connect outward, and security groups/NACLs filter what is let through — each piece does exactly one job.

3.What makes a subnet public vs private

"Public" and "private" are not a subnet setting — they describe whether that subnet's route table sends traffic to an internet gateway. A subnet with that route is public; one without it is private, regardless of what it is named.

Key features

A subnet has no "public" or "private" flag — only a route table decides
Public: the subnet's route table has a route to an internet gateway
Private: no such route — often routes outbound via a NAT gateway instead
A default VPC provisions its subnets as public, with the route already in place
A newly created VPC has no gateway or routes at all until you add them

What decides public vs private

What decides public vs private
Subnet has...	Result
A route to an internet gateway (0.0.0.0/0 → igw-...)	Public — bidirectional internet reachable, with a public IP
A route to a NAT gateway (0.0.0.0/0 → nat-...)	Private — outbound internet only, no inbound path
No default route at all	Private — no internet path in either direction

Same VPC, two different route tables

Public subnet

Route table sends 0.0.0.0/0 to the internet gateway
Instances with a public IP are reachable from the internet
Typical home for load balancers and NAT gateways

Private subnet

No route to an internet gateway
Outbound-only internet via a NAT gateway, if configured
Typical home for application servers and databases

Command

text

Public  = route table has 0.0.0.0/0 → internet gateway
Private = no such route (or routes outbound only, via NAT gateway)

Public vs private is decided entirely by the subnet's route table — a route to an internet gateway makes it public, no such route (or a NAT gateway route) makes it private, regardless of its name.

4.Designing non-overlapping CIDR ranges

Two VPCs with overlapping IP ranges cannot be connected later (via peering or a Transit Gateway) without re-addressing one of them — planning distinct ranges up front avoids a much more painful fix afterward.

Key features

VPC peering and Transit Gateway both require non-overlapping CIDR ranges
Overlap is only a problem once two networks need to connect — isolated VPCs can overlap freely
Re-addressing an existing VPC is far more disruptive than planning ranges up front
A common pattern: allocate distinct /16s per environment or account from one larger plan
RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are typically shared out this way

Command

text

prod:    10.0.0.0/16
staging: 10.1.0.0/16
dev:     10.2.0.0/16   # distinct /16s, safe to peer any pair later

Overlapping CIDR ranges only become a problem once two networks need to connect — plan distinct ranges from one shared allocation up front, because re-addressing later is far more disruptive.

Spotted a mistake on this page? Tell us.

Read Sheet