AWS Internet Gateway and NAT Gateways for Public and Private Subnets in VPC

 Excellent — this is a very important AWS networking topic 👏

Let’s break it down step-by-step, covering:

• how public and private subnets work,

• how Internet Gateway (IGW) and NAT Gateway (NGW) fit into the picture,

• and how traffic flows between them.

---

🏗️ 1. VPC (Virtual Private Cloud) Recap

A VPC is your own private, isolated network in AWS.
You define:

• IP range (e.g. 10.0.0.0/16)

• Subnets (smaller slices of that range)

• Route tables (traffic rules)

• Gateways (for internet or private connectivity)

Everything — EC2, RDS, Load Balancer, etc. — lives inside the VPC.

---

🌍 2. Public Subnet

A Public Subnet is a subnet that has:

1. A route to the Internet Gateway (IGW) in its route table.

2. Instances with public IPs or Elastic IPs.

Result:
Instances in this subnet can send and receive traffic directly from the Internet.

Example:

• Web servers

• Bastion hosts

• NAT gateways

Route Table Example (Public Subnet):

Destination	Target
10.0.0.0/16	local
0.0.0.0/0	igw-xxxxxx

---

🔒 3. Private Subnet

A Private Subnet has no direct route to the Internet Gateway.
It cannot be reached directly from outside the VPC.

Instead, if resources inside need to access the Internet (for updates, APIs, etc.), they go through a NAT Gateway in a Public Subnet.

Example:

• Application servers

• Databases

• Internal microservices

Route Table Example (Private Subnet):

Destination	Target
10.0.0.0/16	local
0.0.0.0/0	nat-xxxxxx

---

🌐 4. Internet Gateway (IGW)

The Internet Gateway is what connects your VPC to the public Internet.
It acts as a bridge that allows:

• Outbound traffic from public instances to the Internet.

• Inbound traffic (e.g. users accessing your public web servers).

Key facts:

• One IGW per VPC (at most).

• Must be attached to your VPC.

• Only works with instances that have:

  • Public IP (or Elastic IP)

  • Subnet route to IGW

Command analogy:

IGW = door between your VPC and the Internet.

---

🛡️ 5. NAT Gateway (Network Address Translation Gateway)

The NAT Gateway allows private subnet instances to initiate outbound connections to the Internet —
but prevents inbound connections from the Internet.

Use Case:
You want your backend servers (in private subnets) to:

• Download software updates

• Call external APIs

• Send telemetry data

—but not be reachable from outside.

How it works:

• Deployed inside a Public Subnet

• Has an Elastic IP

• The private subnet route table sends Internet-bound traffic (0.0.0.0/0) to this NAT Gateway

---

🔁 6. How Traffic Flows

Let’s visualize two cases:

---

🌍 Public Subnet (with Internet Gateway)

User → Internet → IGW → Public Subnet → EC2 (Web Server)

• Inbound traffic from Internet to EC2 works.

• Outbound (e.g. software update) works too.

---

🔒 Private Subnet (with NAT Gateway)

EC2 (App Server in Private Subnet)
   │
   └──► Route (0.0.0.0/0) → NAT Gateway (in Public Subnet)
                                │
                                ▼
                            Internet Gateway → Internet

• Outbound works (e.g., to fetch updates).

• Inbound does not work (Internet cannot initiate a connection back).

---

📊 7. Architecture Diagram (Text Form)

                   ┌──────────────────────────┐
                   │        Internet          │
                   └───────────┬──────────────┘
                               │
                        ┌──────▼──────┐
                        │ Internet    │
                        │  Gateway    │
                        └──────┬──────┘
                               │
                 ┌─────────────┴──────────────┐
                 │         VPC (10.0.0.0/16)  │
                 │                            │
                 │   ┌────────────────────┐   │
                 │   │ Public Subnet      │   │
                 │   │ (10.0.1.0/24)      │   │
                 │   │ Route → IGW        │   │
                 │   │ [NAT Gateway]      │   │
                 │   │ [Web Server]       │   │
                 │   └────────────────────┘   │
                 │             │               │
                 │   ┌────────────────────┐    │
                 │   │ Private Subnet     │    │
                 │   │ (10.0.2.0/24)      │    │
                 │   │ Route → NAT Gateway│    │
                 │   │ [App / DB Server]  │    │
                 │   └────────────────────┘    │
                 │                            │
                 └────────────────────────────┘

---

⚡ 8. Summary Table

Component	Purpose	Located In	Connects To	Allows Inbound?	Allows Outbound?
VPC	Isolated network	—	—	—	—
Public Subnet	Hosts Internet-facing resources	VPC	IGW	✅	✅
Private Subnet	Internal resources	VPC	NAT Gateway	❌	✅
Internet Gateway (IGW)	Connects VPC ↔ Internet	VPC level	Public Subnets	✅	✅
NAT Gateway (NGW)	Outbound Internet for private subnets	Public Subnet	IGW	❌	✅

---

Would you like me to generate a visual diagram (image) showing this complete flow (VPC, Public/Private Subnets, IGW, NAT Gateway, EC2 instances, and traffic arrows)? It’ll make this concept instantly clear.