Cloud Networking
Intermediate 15 min read Cloud Networking

Route Tables and Gateways

Routing rules and the gateways that execute them

Route tables decide which direction packets flow; gateways decide where they leave. Internet Gateways, NAT, VPN, Transit Gateway and endpoints each serve a distinct purpose.

route tableinternet gatewayNAT gatewaytransit gatewayendpointdefault route
Prerequisites: Subnets and CIDR Planning
Before we start

What you will learn

  • Read and design route tables
  • Choose the right gateway per job
  • Understand egress protection (NAT) and private connectivity (endpoints)
In 60 seconds

Route tables are destination→next-hop lists; gateways are the next hops. Internet Gateway opens a public path, NAT gives one-way egress, Transit Gateway stitches many VPCs, and VPC endpoints reach cloud services without leaving the network.

Introduction

What is this?

Each subnet has a route table: longest-prefix matching picks the entry (local VPC CIDR internally; 0.0.0.0/0 to a gateway). Gateways: Internet Gateway (AWS) / public gateway (Azure) give inbound+outbound; NAT gateway gives outbound-only; VPN gateway/Cloud VPN and Transit Gateway/VNet hub route hybrid and multi-VPC traffic; VPC endpoints/PrivateLink reach cloud services privately.

Motivation

Why do you need it?

  • Route tables execute your architecture — get the default route wrong and nothing works.
  • NAT vs IGW decides whether a private workload ever gets inbound exposure.
  • Transit Gateway vs direct peering trades scale and complexity at the network layer.
  • Endpoints keep high-volume traffic off public paths and cut egress.
Think about it

Mental model

Imagine

A road map and its bridges

Think of

Route tables and gateways

Destination signs (route tables) send cars down streets; bridges (gateways) cross rivers. An Internet Gateway is the highway junction everywhere; NAT is a one-way toll bridge; the Transit Gateway is the central interchange connecting districts.

Mechanics

How it works

  • Route table: each entry is 'destination CIDR → target (local/IGW/NAT/peering/endpoint)'.
  • Longest-prefix match decides which entry wins when ranges overlap.
  • Internet Gateway is a plain path for public-facing resources; route 0.0.0.0/0 to it.
  • NAT gateway sits in a public subnet, sources outbound traffic, and refuses unsolicited inbound.
  • Transit Gateway centralizes VPC peering and VPN attachments in one hub.
  • VPC endpoints reach cloud APIs via private IPs (gateway-type for S3/DynamoDB).

Route table to gateway flow.

Subnet route table
Public subnet
NAT gateway
Transit gateway
Endpoints
Real world

In production

  • Public ALB subnets route via IGW; app subnets egress via NAT; DB subnets have no default route at all.
  • A multi-account org attaches 40 VPCs to a Transit Gateway for shared inspection.
  • A data platform adds an S3 gateway endpoint to cut NAT traffic and egress.
Guidelines

Best practices

  • Think 'least egress': only the routes needed, to the minimal target.
  • Keep one NAT gateway per AZ with a route on each subnet (NAT is AZ-scoped).
  • Name routes and gateways by function; a dangling default route is invisible until an outage.
  • Use endpoints for high-volume S3/DynamoDB access.
Watch out

Common mistakes

  • Routing private subnets to IGW 'so they have internet' — they now have inbound too.
  • Single NAT gateway in one AZ = region-wide dependency on one point.
  • Forgetting the local route when peering.
  • Egress via NAT for services that have endpoints — cost and latency both worse.
Root cause analysis

Common issues

Error
Instance has a public IP but can't be reached
Root cause

Route table sends 0.0.0.0/0 to NAT instead of IGW, or a security layer blocks

Fix

Point the public subnet's default route at the Internet Gateway and verify SG/NSG.

Error
NAT gateway cost spikes
Root cause

High egress volumes routed through NAT when endpoints exist

Fix

Add gateway/interface endpoints and route that traffic privately.

Error
Cross-VPC traffic black-holes
Root cause

Peering route missing on one or both route tables

Fix

Add destination peer-CIDR → peering next-hop in every involved route table.

When things break

Debugging tips

  • Reachability analyzer / IP flow verify names the blocking route or rule.
  • Check the subnet's ASSOCIATED route table, not the VPC's main one.
  • A public IP with a private-only route = no internet, whichever way you spin it.
  • Beware endpoint scope: gateway endpoints only work from subnets with an associated endpoint route.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

Which gateway gives private instances one-way internet egress?

2

A gateway-type VPC endpoint for S3 is free and keeps traffic off the public internet.

Go deeper

Official documentation

AWS — Route tables
docs
AWS — NAT gateways
docs
AWS — VPC endpoints
docs