AWS Route Tables Explained: Public, Private, NAT & IGW

Simple explanation

A route table is a list where each row says: traffic going to destination X should be forwarded to next-hop Y.

Destination     Target
10.0.0.0/16     local           ← traffic to VPC addresses stays inside
0.0.0.0/0       igw-0abc1234    ← everything else goes to the internet

That second entry, 0.0.0.0/0 → igw, is what makes a subnet public. Change it to 0.0.0.0/0 → nat-gw and the subnet becomes private with outbound-only internet access. Remove the default route entirely and the subnet is isolated; traffic only flows within the VPC.

Every subnet uses exactly one route table. That route table is what determines the subnet’s relationship with the outside world.

How route tables work

When a packet leaves a resource in a subnet, the VPC router follows this sequence:

1. Look up the route table associated with that subnet.
2. Compare the packet’s destination IP against every route entry in the table.
3. Select the most specific matching route: the one with the longest prefix (highest slash number).
4. Forward the packet to that route’s target.

Example: a route table with two entries:

10.0.0.0/16     local
0.0.0.0/0       igw-0abc1234

Traffic to 10.0.3.5 matches the local route (more specific than /0) and stays inside the VPC. Traffic to 203.0.113.1 only matches 0.0.0.0/0 and routes out through the IGW.

If a route table also contains 10.0.5.0/24 → pcx-peering alongside 10.0.0.0/16 → local, traffic to 10.0.5.100 uses the /24 peering route because it is more specific. This is longest prefix matching. AWS always picks the route with the highest prefix length when multiple entries match the same destination.

Main route table vs custom route tables

When you create a VPC, AWS automatically creates a main route table. Every subnet without an explicit custom route table association falls back to this table.

How route tables make subnets public, private, or isolated

The presence, absence, and destination of the default route (0.0.0.0/0) is what defines a subnet’s network character.

• Public subnet: the route table has 0.0.0.0/0 → IGW. Resources can receive inbound connections from the internet, provided they also have a public IP or Elastic IP and their security group allows the inbound traffic.

• Private subnet: the route table has 0.0.0.0/0 → NAT Gateway. Resources can initiate outbound connections (package downloads, external API calls), but inbound connections from the internet cannot reach them. The NAT Gateway sits in a public subnet and handles the address translation.

• Isolated subnet: the route table has no default route at all. Resources can only communicate within the VPC. Used for databases and internal services that should never touch the internet, not even for outbound traffic.

Common route targets

The target in a route entry tells the VPC router where to forward matched traffic. These are the targets you will encounter most often:

• local: built-in and immutable. Routes all traffic within the VPC’s CIDR block to stay inside the VPC. Present in every route table and cannot be removed.
• Internet Gateway (igw-xxx): routes traffic to and from the public internet. Required in any public subnet’s route table. You must attach the IGW to the VPC first.
• NAT Gateway (nat-xxx): routes outbound internet traffic from private subnets through a managed NAT device that lives in a public subnet. Full details in NAT Gateway.
• VPC Peering Connection (pcx-xxx): routes traffic to a peered VPC’s CIDR range. Both sides of a VPC peering connection must have matching route entries pointing to each other’s CIDR.
• Transit Gateway (tgw-xxx): routes traffic through a central hub connecting multiple VPCs, VPN connections, and Direct Connect attachments. The primary tool for large-scale hybrid network architectures.
• Virtual Private Gateway (vgw-xxx): used for Site-to-Site VPN and Direct Connect connections. Routes can be added statically or propagated automatically via BGP.
• Gateway Endpoint: routes traffic to S3 or DynamoDB without leaving the AWS network, bypassing the NAT Gateway entirely. Reduces cost and eliminates internet exposure for those services.

Route tables vs security groups vs network ACLs

Route tables, security groups, and network ACLs are three separate controls that operate at different layers. Beginners frequently confuse them or assume that one makes the others unnecessary.

The practical takeaway: a route table can enable internet access for a subnet, but it cannot protect an instance from unauthorized traffic. Security groups are the primary instance-level defense. Network ACLs add a subnet-level layer on top, most useful when you need explicit deny rules such as blocking a known bad IP range.

When to use this

You need to review or modify route tables whenever you are:

• Creating a new subnet tier. Every new subnet needs a deliberate route table association. Skipping this means it inherits the main route table, which may not match your intent.
• Connecting subnets to the internet. Public-facing resources need a subnet with a 0.0.0.0/0 → IGW route. Private subnets that need outbound internet access need a 0.0.0.0/0 → NAT Gateway route.
• Routing between VPCs. VPC peering and Transit Gateway both require route entries pointing to the connection ID. Without them, peered VPCs cannot communicate even if the peering connection is active.
• Setting up hybrid connectivity. Site-to-Site VPN and Direct Connect traffic needs routes pointing to a Virtual Private Gateway or Transit Gateway. These can be added statically or enabled via BGP route propagation.
• Optimizing with gateway endpoints. S3 and DynamoDB traffic from private subnets can bypass NAT Gateway using a gateway endpoint, but only if you add the corresponding prefix list route to the relevant private route tables.
• Debugging connectivity failures. When an instance cannot reach a destination, the route table is one of the first places to check. See Troubleshooting Network Issues for a systematic approach.

3-tier architecture walkthrough

Most production VPCs use a three-tier pattern: a public web tier, a private application tier, and an isolated data tier. Here is how route tables map to that layout across three Availability Zones.

Each AZ in the private tier gets its own NAT Gateway and its own route table. If one AZ’s NAT Gateway fails, the private subnets in the other AZs keep their outbound internet access through their own local NAT Gateways. Sharing one NAT Gateway across all AZs is a common cost-cutting choice that creates a cross-AZ single point of failure.

CLI examples

# Public subnet route table
aws ec2 create-route-table \
  --vpc-id vpc-0123456789abcdef0 \
  --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=public-rt}]'

aws ec2 create-route \
  --route-table-id rtb-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id igw-0123456789abcdef0

aws ec2 associate-route-table \
  --route-table-id rtb-0123456789abcdef0 \
  --subnet-id subnet-public-0123456789abcdef0

# Private subnet route table (repeat per AZ with that AZ's NAT Gateway)
aws ec2 create-route-table \
  --vpc-id vpc-0123456789abcdef0 \
  --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=private-rt-1a}]'

aws ec2 create-route \
  --route-table-id rtb-private-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --nat-gateway-id nat-0123456789abcdef0

aws ec2 associate-route-table \
  --route-table-id rtb-private-0123456789abcdef0 \
  --subnet-id subnet-private-0123456789abcdef0

Terraform example

# Public route table: shared across all public subnets
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }

  tags = { Name = "public-rt" }
}

resource "aws_route_table_association" "public_1a" {
  subnet_id      = aws_subnet.public_1a.id
  route_table_id = aws_route_table.public.id
}

# Private route table: one per AZ for high availability
resource "aws_route_table" "private_1a" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.az1a.id
  }

  tags = { Name = "private-rt-1a" }
}

resource "aws_route_table_association" "private_1a" {
  subnet_id      = aws_subnet.private_1a.id
  route_table_id = aws_route_table.private_1a.id
}