AWS VPC Networking Fundamentals: VPCs, Subnets, CIDR, Route Tables, IGW, and NAT Gateways
If you've provisioned a VPC from a Terraform module without fully internalising what each piece is doing, that's fine — right up until something breaks. An instance that should be reachable isn't. A private instance can't pull a package update. And you're left checking five different resources with no clear mental model of how they connect. This post builds that mental model from the ground up.…
Understanding AWS VPC networking fundamentals is crucial for effective cloud infrastructure management. This article breaks down the key components, providing a clear mental model to troubleshoot issues and optimize resource allocation.
1. CIDR Blocks and IP Address Calculation:
A CIDR block is represented as IP address / prefix length. The prefix length determines the network portion, while the remaining bits form the host space. To calculate the total number of addresses, use the formula 2^(32 - prefix). For example, a /20 prefix yields 4,096 total addresses, with 4,091 usable for hosts. This calculation helps in planning subnet sizes based on the required host count.
2. Subnet Sizing and Best Practices:
- Start with a /16 CIDR for the entire VPC. Resizing a VPC CIDR after the fact is impractical due to existing subnets, peering connections, or Transit Gateway attachments.
- For production environments, a practical three-AZ layout can be implemented using the following subnets:
- Public: /24 CIDR blocks per AZ (10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24)
- Private/App: /20 CIDR blocks per AZ (10.0.16.0/20, 10.0.32.0/20, 10.0.48.0/20)
- Data: /24 CIDR blocks per AZ (10.0.64.0/24, 10.0.65.0/24, 10.0.66.0/24)
- Reserved: /17 CIDR block (10.0.128.0/17)
- This layout ensures proper separation of concerns and allows for future expansion without renumbering.
3. Route Tables and Subnet Functionality:
Subnets become public or private based on their route table configuration, not inherent properties. The route table is a list of destination → target rules evaluated by the most specific match. Every subnet is connected to the VPC by default through an implicit local route for the full VPC CIDR.
- Public Subnet Route Table:
- Targets internet gateway for outbound internet access
- Allows communication between subnets within the VPC
- Internet Gateway (IGW):
- Horizontally scaled, redundant, and AZ-agnostic
- Handles 1:1 NAT between public and private IPs
- Serves as a route table target
- Route Table Association:
- Binds a subnet to a specific route table
- Enables routing decisions based on the rules defined in the route table
4. Outbound Connectivity with NAT Gateways:
- NAT gateways are used exclusively for outbound internet access from private subnets.
- They live in a specific subnet within a specific AZ and perform source NAT for private instances.
- NAT gateways incur hourly and per-GB costs, making them a cost-effective solution when NAT is required.
- For optimal reliability, it is recommended to have one NAT gateway per AZ, with each private subnet routing to the NAT gateway in its own AZ. This pattern ensures high availability and prevents a single point of failure.
5. Cost Optimization and Best Practices:
- Avoid routing traffic to S3 and DynamoDB through NAT gateways. Using VPC Gateway Endpoints eliminates the need for NAT and reduces costs to zero.
- Understanding the specific requirements and traffic patterns helps in making informed decisions about NAT gateway placement and usage.
By grasping these fundamental concepts of AWS VPC networking, you can effectively troubleshoot issues, optimize resource allocation, and design scalable and reliable architectures. The key takeaway is to have a clear understanding of CIDR blocks, subnet sizing, route tables, and the role of IGWs and NAT gateways in enabling communication within and outside the VPC.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
