How Route Tables, NAT Gateway, and Internet Gateway Work Together
AWS VPC networking becomes much easier to understand when you see how routing and gateways work as one system. Route tables decide where traffic should go, an Internet Gateway provides a path between a VPC and the internet, and a NAT Gateway allows private resources to make outbound internet connections without exposing them directly to the internet. Together, these components determine how resources in public and private subnets communicate beyond the VPC.
What Route Tables, NAT Gateway, and Internet Gateway Do
An AWS Route Table contains rules that determine the next destination for network traffic leaving a subnet. Every VPC route table includes a local route for communication within the VPC, while additional routes can direct traffic toward gateways, peering connections, endpoints, or other networking components.
An AWS Internet Gateway is attached to a VPC and provides a target for internet-routable traffic. A subnet becomes a public subnet when its associated route table contains a route to an Internet Gateway. For IPv4 internet traffic, the common default route is 0.0.0.0/0.
An AWS NAT Gateway provides Network Address Translation for resources that need outbound connectivity without accepting unsolicited inbound connections from the internet. A public NAT Gateway is placed in a public subnet and uses the VPC's Internet Gateway to reach the internet.
The key relationship is simple
Route table decides the path → NAT Gateway translates private IPv4 traffic when required → Internet Gateway provides internet connectivity.
How Public and Private Subnets Use Route Tables
The distinction between a public subnet and a private subnet is primarily based on routing.
A typical public subnet has a route such as:
0.0.0.0/0 → Internet Gateway
This tells AWS that IPv4 traffic destined outside the VPC should be sent to the Internet Gateway.
A typical private subnet instead has:
0.0.0.0/0 → NAT Gateway
The private instance therefore sends internet-bound traffic to the NAT Gateway rather than directly to the Internet Gateway. AWS documentation uses this pattern for private subnet internet access.
This is why simply placing an EC2 instance in a subnet does not determine whether it is public or private. The subnet's route table association is a critical part of that design.
How an Internet Gateway Enables Public Subnet Connectivity
Consider an EC2 instance in a public subnet with a public IPv4 address.
When the instance sends a request to an internet destination, the route table checks the destination. Because the destination does not match the VPC's local route, the 0.0.0.0/0 default route sends the traffic to the Internet Gateway.
For IPv4 communication, the Internet Gateway performs the necessary one-to-one address translation between the instance's private address and its public IPv4 address. The response can then return through the Internet Gateway to the instance.
This means public subnet internet access requires more than an Internet Gateway. The resource also needs appropriate addressing and routing. A public IP alone does not override a missing route to the Internet Gateway. AWS specifically notes that instances without a route to an Internet Gateway cannot communicate with the internet, even if they have public IP addresses.
How a NAT Gateway Provides Outbound Access for Private Subnets
Private instances generally use private IPv4 addresses and should not be directly reachable from the public internet.
Suppose an EC2 instance in a private subnet needs to download operating system updates. Its route table contains:
0.0.0.0/0 → NAT Gateway
The request first travels from the private instance to the NAT Gateway. The NAT Gateway translates the source address and sends the traffic onward. Because the NAT Gateway is located in a public subnet, its own route table sends internet-bound traffic to the Internet Gateway. The Internet Gateway then provides the connection to the external destination.
The return traffic follows the established NAT mapping back to the private instance. External systems therefore see the NAT Gateway's public address rather than the private instance's address.
This is the core of how NAT Gateway works. It provides outbound connectivity while preventing unsolicited inbound internet connections to the private instances.
How All Three Components Work Together
The following simplified architecture shows the relationship:
Private EC2
|
| 0.0.0.0/0
v
NAT Gateway
|
| 0.0.0.0/0
v
Internet Gateway
|
v
Internet
The NAT Gateway itself needs a path to the Internet Gateway. This is why placing a NAT Gateway in a private subnet would not provide the normal public-NAT architecture required for internet access. AWS recommends placing a public NAT Gateway in a public subnet and routing its traffic through the Internet Gateway.
Step-by-Step Traffic Flow
Imagine two EC2 instances accessing the internet.
Public subnet communication
The EC2 instance sends an internet-bound packet.
Its subnet route table matches
0.0.0.0/0.The route points to the Internet Gateway.
The Internet Gateway handles the public IPv4 translation and internet connectivity.
The destination responds.
The response returns through the Internet Gateway to the EC2 instance.
Private subnet outbound communication
The private EC2 instance sends an internet-bound packet.
Its route table matches
0.0.0.0/0.The route points to the NAT Gateway.
The NAT Gateway translates the source private IPv4 address.
The NAT Gateway's public subnet route table sends the traffic to the Internet Gateway.
The Internet Gateway provides internet connectivity.
The response returns through the Internet Gateway and NAT Gateway.
The NAT Gateway translates the traffic back to the private instance.
The important difference is that public resources use the Internet Gateway directly, while private IPv4 resources normally reach the Internet Gateway through a NAT Gateway.
Route Table, NAT Gateway, and Internet Gateway Comparison
Component | Primary role | Typical location | Internet path |
AWS Route Table | Determines where traffic is routed | Associated with subnets | Points traffic to the appropriate target |
AWS Internet Gateway | Connects a VPC to the internet | Attached to VPC | Direct path for public subnet traffic |
AWS NAT Gateway | Provides outbound IPv4 connectivity for private resources | Public subnet | Private subnet → NAT Gateway → Internet Gateway |
Common Configuration Mistakes
One common mistake is adding a NAT Gateway but forgetting to update the private subnet's route table. Without 0.0.0.0/0 → NAT Gateway, the private instance has no default route for internet-bound IPv4 traffic.
Another mistake is placing a NAT Gateway in a subnet that is not properly configured as public. Its subnet needs a route to the Internet Gateway for the standard public NAT architecture.
A third mistake is assuming that assigning a public IP automatically makes an instance reachable. Routing, public addressing, and security controls all matter.
It is also important to remember that 0.0.0.0/0 represents all IPv4 destinations that are not matched by a more specific route. IPv6 uses ::/0 separately.
Practical AWS Architecture Takeaway
A common production architecture separates internet-facing and internal workloads. Public subnets can contain components that genuinely need direct internet connectivity, while application servers and other internal resources can remain in private subnets.
For private IPv4 workloads that need outbound internet access, the typical route is:
Private subnet → NAT Gateway → public subnet route table → Internet Gateway → Internet
For public IPv4 workloads, it is:
Public subnet → public subnet route table → Internet Gateway → Internet
Understanding this route table traffic flow is more important than memorizing individual AWS networking components. Once you know which route table is associated with each subnet and where its default route points, the behavior of the VPC becomes much easier to predict and troubleshoot.
Conclusion
Route Tables, NAT Gateway, and Internet Gateway are most useful when understood as parts of one routing system. Route tables make the decision, NAT Gateway provides address translation for private IPv4 resources, and the Internet Gateway connects the VPC to the internet. Public subnets normally route directly to the Internet Gateway, while private subnets use a NAT Gateway for controlled outbound connectivity.
That relationship forms the foundation of many AWS VPC networking architectures and is essential knowledge for designing, troubleshooting, and securing cloud networks.
FAQs
Can a private subnet route directly to an Internet Gateway?
No. A private subnet typically routes internet-bound traffic to a NAT Gateway. The NAT Gateway then uses a route through the Internet Gateway to reach the internet.
Why does a NAT Gateway need an Internet Gateway?
A NAT Gateway needs a path to the internet. Its public subnet normally has a 0.0.0.0/0 route pointing to the Internet Gateway.
Does a NAT Gateway allow inbound internet traffic?
No. NAT Gateway is primarily used for outbound connections initiated by private resources. Unsolicited inbound connections cannot directly reach private instances through the NAT Gateway.
What happens if a private subnet has no default route?
The private resources will not have a route for internet-bound traffic. For typical IPv4 internet access, the route table needs 0.0.0.0/0 pointing to a NAT Gateway.
Can different subnets use different route tables?
Yes. Public and private subnets commonly use different route tables. Public subnets can route to an Internet Gateway, while private subnets can route internet-bound traffic to a NAT Gateway.
Does a public IP automatically provide internet access?
No. The resource also needs an appropriate route through an Internet Gateway. Security Groups and Network ACLs can additionally affect whether traffic is permitted.
What is the difference between NAT Gateway and Internet Gateway?
An Internet Gateway provides VPC connectivity to the internet, while a NAT Gateway translates private IPv4 addresses and provides outbound internet access for resources in private subnets.
How do you troubleshoot private subnet internet access?
Check the private subnet route table, NAT Gateway, NAT Gateway subnet's route to the Internet Gateway, Security Groups, and Network ACLs. A missing route at any point can break connectivity.
The founder of Network Kings, is a renowned Network Engineer with over 12 years of experience at top IT companies like TCS, Aricent, Apple, and Juniper Networks. Starting his journey through a YouTube channel in 2013, he has inspired thousands of students worldwide to build successful careers in networking and IT. His passion for teaching and simplifying complex technologies makes him one of the most admired mentors in the industry.
