{"id":4698,"date":"2026-08-28T01:07:24","date_gmt":"2026-08-28T04:07:24","guid":{"rendered":"https:\/\/tucumandevelopers.com\/index.php\/2026\/08\/28\/aws-vpc-networking-fundamentals-vpcs-subnets-cidr-route-tables-igw-and-nat-gateways\/"},"modified":"2026-08-28T01:07:24","modified_gmt":"2026-08-28T04:07:24","slug":"aws-vpc-networking-fundamentals-vpcs-subnets-cidr-route-tables-igw-and-nat-gateways","status":"publish","type":"post","link":"https:\/\/tucumandevelopers.com\/index.php\/2026\/08\/28\/aws-vpc-networking-fundamentals-vpcs-subnets-cidr-route-tables-igw-and-nat-gateways\/","title":{"rendered":"AWS VPC Networking Fundamentals: VPCs, Subnets, CIDR, Route Tables, IGW, and NAT Gateways"},"content":{"rendered":"
\n
<\/div>\n
\n

If you’ve provisioned a VPC from a Terraform module without fully internalising what each piece is doing, that’s fine \u2014 right up until something breaks. An instance that should be reachable isn’t. A private instance can’t pull a package update. And you’re left checking five different resources with no clear mental model of how they connect.<\/p>\n

This post builds that mental model from the ground up. Not just definitions \u2014 the why<\/em> behind each piece, so troubleshooting becomes deduction instead of guesswork.<\/p>\n

\n

<\/a> CIDR math you actually need <\/h2>\n

A CIDR block is IP address \/ prefix length<\/code>. The prefix length fixes the network portion; the remaining bits are your host space.<\/p>\n

Formula: 2^(32 - prefix) = total addresses<\/code>. AWS reserves 5 per subnet (network address, VPC router, DNS, reserved, broadcast).<\/p>\n

\n\n\n\n\n\n\n\n\n
CIDR<\/th>\nTotal addresses<\/th>\nUsable<\/th>\n<\/tr>\n<\/thead>\n
\/16<\/td>\n65,536<\/td>\n65,531<\/td>\n<\/tr>\n
\/20<\/td>\n4,096<\/td>\n4,091<\/td>\n<\/tr>\n
\/24<\/td>\n256<\/td>\n251<\/td>\n<\/tr>\n
\/28<\/td>\n16<\/td>\n11<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

To reverse-engineer a prefix from a required host count: round up to the next power of two, subtract the exponent from 32. Need 300 hosts? Next power of two is 512 (2\u2079), so prefix = 32 – 9 = \/23<\/code>. Run this before sizing any subnet that will host an autoscaling group or EKS node group.<\/p>\n

Start with \/16<\/code> for the VPC itself. VPC CIDR is difficult to resize after the fact \u2014 once you have subnets, peering connections, or Transit Gateway attachments built against it, renumbering becomes a migration project. \/16<\/code> costs nothing up front and avoids that corner.<\/p>\n

\n

<\/a> Subnet allocation: carving up the VPC <\/h2>\n

A practical three-AZ production layout from 10.0.0.0\/16<\/code>:<\/p>\n

\n\n\n\n\n\n\n\n\n
Tier<\/th>\nAZ-a<\/th>\nAZ-b<\/th>\nAZ-c<\/th>\nSize<\/th>\nTypical use<\/th>\n<\/tr>\n<\/thead>\n
Public<\/td>\n10.0.0.0\/24<\/td>\n10.0.1.0\/24<\/td>\n10.0.2.0\/24<\/td>\n\/24<\/td>\nALB, NAT gateway, bastion<\/td>\n<\/tr>\n
Private\/app<\/td>\n10.0.16.0\/20<\/td>\n10.0.32.0\/20<\/td>\n10.0.48.0\/20<\/td>\n\/20<\/td>\nEKS nodes, ECS, EC2<\/td>\n<\/tr>\n
Data<\/td>\n10.0.64.0\/24<\/td>\n10.0.65.0\/24<\/td>\n10.0.66.0\/24<\/td>\n\/24<\/td>\nRDS, ElastiCache<\/td>\n<\/tr>\n
Reserved<\/td>\n10.0.128.0\/17<\/td>\n<\/td>\n<\/td>\n\/17<\/td>\nFuture tiers, Transit Gateway, VPN<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

The jump from \/24<\/code> in the public tier to \/20<\/code> in the app tier is intentional. ALBs and NAT gateways consume very few IPs; the app tier is where consumption scales with autoscaling groups, rolling deployments, and pod density.<\/p>\n

For EKS specifically: with the VPC CNI, every pod can consume an ENI-backed IP. IP exhaustion is one of the most common EKS production incidents. \/20<\/code> per AZ for worker subnets is the standard starting point.<\/p>\n

The deliberate gaps between tiers (0\u20132, then 16\u201348, then 64\u201366) leave room to insert new tiers later without renumbering anything already deployed.<\/p>\n

\n

<\/a> Route tables: the actual decision maker <\/h2>\n

A subnet is “public” or “private” because of its route table \u2014 not any inherent property of the subnet itself. The table is a list of destination \u2192 target<\/code> rules evaluated by most specific match<\/strong>.<\/p>\n

Every route table gets an implicit local<\/code> route for the full VPC CIDR \u2014 this can’t be removed, and it’s what lets every subnet reach every other subnet inside the VPC by default.<\/p>\n

A public subnet route table in Terraform: <\/p>\n

\n
resource<\/span> \"aws_route_table\"<\/span> \"public\"<\/span> {<\/span> vpc_id<\/span> =<\/span> aws_vpc<\/span>.<\/span>main<\/span>.<\/span>id<\/span> tags<\/span> =<\/span> {<\/span> Name<\/span> =<\/span> \"rtb-public\"<\/span>,<\/span> Tier<\/span> =<\/span> \"public\"<\/span> }<\/span> }<\/span> resource<\/span> \"aws_route\"<\/span> \"public_internet\"<\/span> {<\/span> route_table_id<\/span> =<\/span> aws_route_table<\/span>.<\/span>public<\/span>.<\/span>id<\/span> destination_cidr_block<\/span> =<\/span> \"0.0.0.0\/0\"<\/span> gateway_id<\/span> =<\/span> aws_internet_gateway<\/span>.<\/span>main<\/span>.<\/span>id<\/span> }<\/span> resource<\/span> \"aws_route_table_association\"<\/span> \"public_a\"<\/span> {<\/span> subnet_id<\/span> =<\/span> aws_subnet<\/span>.<\/span>public_az_a<\/span>.<\/span>id<\/span> route_table_id<\/span> =<\/span> aws_route_table<\/span>.<\/span>public<\/span>.<\/span>id<\/span> }<\/span> <\/code><\/pre>\n
\n<\/p><\/div>\n<\/p><\/div>\n
Creating the route table does nothing on its own \u2014 the association step is what binds it to a subnet and makes routing take effect.<\/p>\n
\n
  <\/a> Internet Gateway and the three conditions for inbound access <\/h2>\n
An IGW is horizontally scaled, redundant, and AZ-agnostic \u2014 one per VPC, no capacity to configure. It does two things: 1:1 NAT between public and private IPs (the public IP mapping lives at the IGW, not on the instance \u2014 which is why ip addr<\/code> on an EC2 instance never shows its public IP), and serves as a route table target.<\/p>\n
All three of these must be true simultaneously for inbound internet access to work:<\/p>\n
    \n
  1. The instance has a public or Elastic IP on its ENI.<\/li>\n
  2. The subnet’s route table has 0.0.0.0\/0 \u2192 IGW<\/code>.<\/li>\n
  3. Both the security group and the NACL allow the inbound traffic on that port.<\/li>\n<\/ol>\n
    Any one missing produces the same symptom: a silent timeout with no obvious pointer to the actual cause. This is where most “why can’t I reach my instance” tickets originate.<\/p>\n
    \n
      <\/a> NAT Gateway: outbound only <\/h2>\n
    A NAT gateway lives in a specific subnet in a specific AZ, performs source NAT for private instances, and has real hourly and per-GB cost. The packet walk for a private instance at 10.0.2.15<\/code> requesting a public registry:<\/p>\n
      \n
    1. Private subnet route table: 0.0.0.0\/0 \u2192 nat-0abc...<\/code> <\/li>\n
    2. NAT gateway rewrites source to its own Elastic IP + ephemeral port<\/li>\n
    3. NAT gateway’s public subnet route table: 0.0.0.0\/0 \u2192 IGW<\/code> <\/li>\n
    4. IGW performs its own separate 1:1 NAT translation<\/li>\n<\/ol>\n
      Two distinct NAT translations \u2014 easy to collapse into one mental step, but they’re separate resources doing separate jobs.<\/p>\n
      Why it lives in the public subnet:<\/strong> the NAT gateway needs its own route to the IGW, so it must sit in a subnet whose route table already points to the IGW. The private subnet’s route table then points 0.0.0.0\/0<\/code> at the NAT gateway. Two different route tables, two different subnets, one resource bridging them.<\/p>\n
      HA pattern:<\/strong> one NAT gateway per AZ, each AZ’s private subnet routing to the NAT gateway in its own AZ. One NAT gateway for the whole VPC is cheaper but creates a single point of failure \u2014 if that AZ has an outage, every private subnet in every other AZ loses outbound internet access.<\/p>\n
      Cost trap worth auditing:<\/strong> traffic to S3 and DynamoDB from private subnets doesn’t need to go through NAT at all if you use VPC Gateway Endpoints. Routing S3 traffic through NAT is billed per GB with no benefit over a free Gateway Endpoint.<\/p>\n
      \n
        <\/a> Read the Full Article <\/h2>\n
      The summary covers the core mental model. The full article goes deeper on:<\/p>\n