AWS VPC Subnet Configuration and Private Subnet NAT Patterns

Subnets define the addressable boundaries inside an Amazon VPC and determine how AWS resources can reach each other and the internet. A subnet is a range of IP addresses in a VPC and resources such as EC2 instances can be launched into specific subnets. The design choices made at subnet creation, from Availability Zone placement to IP addressing mode and routing, directly shape resiliency, security posture and connectivity costs. The reference patterns for public and private subnets with NAT gateways illustrate how these decisions are applied in multi-AZ architectures that separate inbound traffic handling from outbound internet access.

Subnet Fundamentals

Each subnet must reside entirely within one Availability Zone and cannot span zones. Placing AWS resources in separate Availability Zones protects applications from the failure of a single Availability Zone. Because a subnet is bound to one zone, network planning must allocate CIDR space per zone rather than across zones.

When an instance is launched in a subnet, the primary network interface for example eth0 is created for the instance in that subnet. Regardless of the subnet attribute, the auto-assign IP setting can still be overridden for a specific instance during launch. After a subnet is created, the following settings can be modified:

• Auto-assign IP settings enables configuration to automatically request a public IPv4 or IPv6 address for a new network interface in this subnet
• Resource-based Name settings enables specification of the hostname type for EC2 instances in this subnet and configuration of how DNS A and AAAA record queries are handled

For more information on hostname types, see Amazon EC2 instance hostname types in the Amazon EC2 User Guide.

IP Address Range Options

When a subnet is created, its IP address range is specified depending on VPC configuration.

• IPv4 only – The subnet has an IPv4 CIDR block but does not have an IPv6 CIDR block. Resources in an IPv4-only subnet must communicate over IPv4
• Dual stack – The subnet has both an IPv4 CIDR block and an IPv6 CIDR block. The VPC must have both an IPv4 CIDR block and an IPv6 CIDR block. Resources in a dual-stack subnet can communicate over IPv4 and IPv6
• IPv6 only – The subnet has an IPv6 CIDR block but does not have an IPv4 CIDR block. The VPC must have an IPv6 CIDR block

The choice of addressing mode affects route table entries and gateway selection. IPv4-only route tables include only IPv4 routes. Dual-stack route tables include both IPv4 and IPv6 routes.

Security Boundaries and Controls

To protect AWS resources, private subnets are recommended. Use a bastion host or NAT device to provide internet access to resources such as EC2 instances in a private subnet.

AWS provides features to increase security for resources in a VPC:

• Security groups allow inbound and outbound traffic for associated resources such as EC2 instances
• Network ACLs allow or deny inbound and outbound traffic at the subnet level

In most cases security groups can meet needs. Network ACLs can be used for an additional layer of security. For more information see Compare security groups and network ACLs.

By design each subnet must be associated with a network ACL. Every subnet created is automatically associated with the default network ACL for the VPC. The default network ACL allows all inbound and outbound traffic. The default network ACL can be updated, or custom network ACLs can be created and associated with subnets. For more information see Control subnet traffic with network access control lists.

Flow logs can be created on a VPC or subnet to capture the traffic that flows to and from the network interfaces in the VPC or subnet.

Subnet Types and Routing

Each subnet must be associated with a route table which specifies the allowed routes for outbound traffic leaving the subnet.

Examples of subnet types include:

• Public subnet – The subnet has a direct route to an internet gateway. Resources in a public subnet can access the public internet
• Private subnet – The subnet does not have a direct route to an internet gateway. Resources in a private subnet require a NAT device to access the public internet
• VPN-only subnet – The subnet has a route to a Site-to-Site VPN connection through a virtual private gateway. The subnet does not have a route to an internet gateway
• Isolated subnet – The subnet has no routes to destinations outside its VPC. Resources in an isolated subnet can only access or be accessed by other resources in the same VPC
• EVS subnet – This type of subnet is created using Amazon EVS. For more information see VLAN subnet in the Amazon EVS User Guide

A typical diagram shows a VPC with subnets in two Availability Zones and an internet gateway. Each Availability Zone has a public subnet and a private subnet.

Console Provisioning Workflow

The documented procedure creates a VPC with a public subnet and a private subnet in two Availability Zones and a NAT gateway in each Availability Zone.

To create the VPC:

• Open the Amazon VPC console at https://console.aws.amazon.com/vpc/
• On the dashboard choose Create VPC
• For Resources to create choose VPC and more

Configure the VPC:

• For Name tag auto-generation enter a name for the VPC
• For IPv4 CIDR block keep the default suggestion or enter the CIDR block required by the application or network
• If the application communicates by using IPv6 addresses choose IPv6 CIDR block Amazon-provided IPv6 CIDR block

Configure the subnets:

• For Number of Availability Zones choose 2 so that instances can be launched in multiple Availability Zones to improve resiliency
• For Number of public subnets choose 2
• For Number of private subnets choose 2
• Keep the default CIDR block for the public subnet or expand Customize subnet CIDR blocks and enter a CIDR block

Reference Architecture with NAT and Load Balancing

Each public subnet contains a NAT gateway and a load balancer node. Servers run in the private subnets, are launched and terminated by using an Auto Scaling group and receive traffic from the load balancer. Servers can connect to the internet by using the NAT gateway. Servers can connect to Amazon S3 by using a gateway VPC endpoint.

When this VPC is created using the Amazon VPC console, a route table is created for the public subnets with local routes and routes to the internet gateway. A route table is also created for the private subnets with local routes and routes to the NAT gateway, egress-only internet gateway and gateway VPC endpoint.

Public subnet route table example with IPv4 and IPv6:

Private subnet route table example with IPv4 and IPv6:

If IPv4-only subnets are created, the route table includes only IPv4 routes. The last route sends traffic destined for Amazon S3 to the gateway VPC endpoint.

Private subnet route table IPv4-only variant:

Security Group Example

The following is an example of rules that might be created for the security group associated with servers. The security group must allow traffic from the load balancer over the listener port and protocol. It must also allow health check traffic.

Conclusion

Subnet design in AWS is a deliberate combination of IP addressing mode, Availability Zone placement, routing and security controls. The requirement that each subnet resides entirely within one Availability Zone enforces zone isolation and drives the multi-AZ pattern of paired public and private subnets. IPv4-only, dual-stack and IPv6-only options determine whether route tables must carry IPv4 only or both IPv4 and IPv6 entries, with public subnets using an internet gateway route and private subnets relying on NAT gateways and optionally an egress-only internet gateway for IPv6.

The operational workflow of creating a VPC with two public and two private subnets across two Availability Zones, each public subnet hosting a NAT gateway and load balancer node and each private subnet hosting auto-scaled servers, provides a resilient, secure baseline. Servers remain unreachable from the internet directly, egress via NAT gateways is controlled, and S3 access is offloaded to a gateway VPC endpoint. Combined with security groups for instance-level filtering, network ACLs for subnet-level filtering and flow logs for observability, the subnet layer delivers the isolation and connectivity properties required for production workloads.

Sources

1. Configure subnets
2. VPC example private subnets NAT