VPC basics: CIDR, subnets and gateways

Why a private network?

When you run servers and databases in the cloud, you decide which of them the internet may reach. A web server must be reachable; a database with customer data must not be. A VPC (Virtual Private Cloud) is an isolated network that belongs to your account in one region. You choose its address range, cut it into smaller networks called subnets, and decide where traffic may flow.

CIDR blocks

CIDR (Classless Inter-Domain Routing) notation writes a range of IP addresses as a start address and a prefix length. 10.0.0.0/16 means the first 16 bits are fixed, so the range is 10.0.0.0 to 10.0.255.255, which is 65,536 addresses. A larger prefix means a smaller network: a /24 has 256 addresses and a /28 has 16. In AWS a VPC block can be from /16 (largest) to /28 (smallest). Use private ranges from RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and pick one that does not overlap your office network or other VPCs you may connect later.

Subnets and the 5 reserved addresses

A subnet is a slice of the VPC range that lives in exactly one Availability Zone (AZ). To survive the loss of a zone, you create matching subnets in at least two AZs. AWS reserves 5 addresses in every subnet: the first four and the last one. In 10.0.1.0/24 those are 10.0.1.0 (network address), 10.0.1.1 (VPC router), 10.0.1.2 (Amazon DNS), 10.0.1.3 (reserved for future use) and 10.0.1.255 (the last address). So a /24 gives 256 minus 5, which is 251 usable addresses, and a /28 gives only 11.

Route tables, Internet Gateway and NAT gateway

A route table is a list of rules that says where traffic for each destination goes. Every route table has a "local" route for the VPC range, so all subnets can talk to each other. Each subnet is associated with one route table.

• Internet Gateway (IGW): attached to the VPC, it connects the VPC to the internet in both directions. A subnet is public if its route table has 0.0.0.0/0 pointing to the IGW. An instance there also needs a public IP to be reachable.
• NAT gateway: lives in a public subnet with an Elastic IP. Private subnets send 0.0.0.0/0 to it, so their instances can download updates or call payment APIs, but nobody on the internet can start a connection to them. It is charged per hour and per GB processed, so check the pricing page and watch the bill.

A standard two-AZ design

Most production apps use three tiers of subnets, repeated in two (or three) AZs: public subnets for the load balancer and NAT gateways, private app subnets for the EC2 instances or containers, and private database subnets with no internet route.

aws ec2 create-vpc --cidr-block 10.0.0.0/16
aws ec2 create-subnet --vpc-id vpc-0abc --cidr-block 10.0.0.0/24 --availability-zone ap-south-1a
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway --internet-gateway-id igw-0abc --vpc-id vpc-0abc
aws ec2 create-route --route-table-id rtb-0pub --destination-cidr-block 0.0.0.0/0 --gateway-id igw-0abc
aws ec2 associate-route-table --route-table-id rtb-0pub --subnet-id subnet-0pub1
aws ec2 create-nat-gateway --subnet-id subnet-0pub1 --allocation-id eipalloc-0abc
aws ec2 create-route --route-table-id rtb-0priv --destination-cidr-block 0.0.0.0/0 --nat-gateway-id nat-0abc

The default VPC

Every region in a new account has a default VPC (172.31.0.0/16) with a public subnet in each AZ and an Internet Gateway, and instances there get public IPs automatically. It is handy for quick tests, but for real workloads create your own VPC with private subnets.