Route Tables and the Internet Gateway

A web server in Inkwell's public subnet sends two packets: one to the database next door, one to a payment provider on the internet. Nothing about the packets says "inside" or "outside". A small table attached to the subnet makes that decision for every packet, many times a second.

The rule

Most specific route wins; local is always there.

A route table is a list of rules, each with a destination (a CIDR block) and a target (where to send matching traffic). Every subnet is associated with exactly one route table; a subnet you do not associate explicitly uses the VPC's main route table. One route table can serve many subnets.

Inkwell's public route table:

• The local route covers the whole VPC. AWS adds it to every route table automatically and it cannot be deleted, so subnets in a VPC can always reach each other (security groups still decide what is allowed).
• 0.0.0.0/0 means "any IPv4 address". Here it points to the internet gateway.

An internet gateway is the VPC's door to the internet. You create it, attach it to the VPC (one per VPC), and route to it. AWS runs it as a highly available, horizontally scaled service, so it is not a bottleneck and is not tied to one zone. The gateway also translates between an instance's private address and its public IPv4 address.

When a packet matches several routes, the one with the longest prefix, the biggest number after the slash, wins.

The shortcut

For each packet: list every route whose block contains the destination, then pick the biggest slash.

The trap: creating an internet gateway and attaching it, then wondering why nothing reaches the internet. Attaching is not enough; a subnet's route table needs the 0.0.0.0/0 route pointing to it.

Drills

Answer fast — trust the rule.

Remember

• Most specific route wins; the local route is always there.
• Shortcut: list the matching routes, pick the biggest slash.
• Trap: an attached internet gateway does nothing until a route points to it.