--- cuppy_hub: aws cuppy_path: reference/vpc/routing-and-gateways.md cuppy_section: docs cuppy_doc: D9J7-MV61 cuppy_doc_uuid: 1574d427-d9c3-4bf0-963d-df2beb5da10e cuppy_permalink: https://cuppy.io/aws/d/D9J7-MV61 cuppy_version: 4 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/aws/docs/reference/vpc/routing-and-gateways cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: acd24ab38c384a59562659f1e996d594931b729b6678fcdd2e9d315d15ec176c # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Routes, internet gateways, NAT gateways and Block Public Access **A subnet reaches the internet through the route its route table gives `0.0.0.0/0`: an internet gateway (the resource then needs a public IP) or a NAT gateway (outbound only).** VPC Block Public Access, when on, overrides both. ## Route tables - Each subnet is associated with one route table. One table can serve many subnets. - The **most specific** matching route wins. Reachability Analyzer reports a route shadowed this way as `MORE_SPECIFIC_ROUTE`, or as `HIGHER_PRIORITY_ROUTE` when the CIDR is identical. - The local route covers the VPC CIDR only (`VPC_LOCAL_ROUTE_CIDR_RESTRICTION`). - A route to a deleted target becomes unusable: `BAD_STATE_ROUTE` (blackhole, UNVERIFIED term). - Fixed limits: 100 propagated routes per table. Non-propagated routes per table can be raised to at most 1,000, at a possible cost to performance. ## Internet gateway - One per VPC at a time. Traffic passes only for interfaces with a public IPv4 or Elastic IP (`IGW_PUBLIC_IP_ASSOCIATION_FOR_EGRESS`). - Outbound traffic to private (RFC 1918) or shared (RFC 6598) destination addresses is dropped. - IPv6 outbound-only: an **egress-only internet gateway**, also one per VPC. - **Every public IPv4 address is billed hourly** (since 2024-02-01), whether attached or idle, across services. This includes Elastic IPs and the public IPs of instances, RDS and EKS nodes. Public IP Insights (free, in VPC IPAM) shows where they are. Private subnets behind a NAT gateway, or IPv6 with an egress-only internet gateway, avoid one public IP per resource. Prices are on the VPC pricing page. ## NAT gateways | | Zonal, public (default) | Zonal, private | Regional | |---|---|---|---| | Placement | A **public** subnet in one AZ | A subnet | The VPC: no subnet | | Elastic IP | Required at creation | Not allowed | Automatic, or manual per AZ | | Reaches | Internet via the IGW; other VPCs or on-premises via TGW/VGW | Other VPCs and on-premises via TGW/VGW only. Routed to an IGW, the traffic is dropped | Internet via its own auto-created route table (route to the IGW); TGW supported | | AZ coverage | One AZ: deploy one per AZ | One AZ | Expands into AZs with network interfaces, within up to 60 min | | IPs | Up to 8 (quota) | — | Up to 32 per AZ | | Create | `create-nat-gateway --subnet-id … --allocation-id …` | `… --connectivity-type private` (UNVERIFIED flag) | `create-nat-gateway --vpc-id … --availability-mode regional` | Common to all NAT gateways: - Connections must start **inside** the VPC. Only traffic from network interfaces in the same VPC is translated, not traffic arriving over peering, VPN or Direct Connect (`NGW_REQUIRES_SOURCE_IN_VPC`). - Protocols: TCP, UDP and ICMP only. No IP fragmentation for TCP or ICMP. No IPsec (use NAT-T over UDP). - **Idle timeout: 350 seconds.** After that, the gateway returns RST to the inside host. Use TCP keepalive below 350 s for long-lived idle connections. - **55,000 concurrent connections per IP address to one destination** (destination IP, port and protocol). Add IPs, spread clients across gateways, and watch `IdleTimeoutCount` and port-allocation errors (`ErrorPortAllocation` metric: UNVERIFIED name in the collected sources). - A NAT gateway does not answer ping. Test from an instance behind it. - `Failed` gateways are shown for about an hour, then deleted. - IPv6 to IPv4 is possible through DNS64/NAT64. ### Converting zonal to regional Either create the regional gateway, repoint routes and delete the zonal ones (new IPs), or delete the zonal ones first and reuse their Elastic IPs. Both reset existing connections, so do it in a maintenance window. A regional NAT gateway not yet in the traffic's AZ shows as `REGIONAL_NGW_ROUTE_AZ_RESTRICTION` in Reachability Analyzer. ## VPC Block Public Access (BPA) An account setting **per Region** that blocks internet traffic regardless of routes, security groups or public IPs. | Mode | Effect | |---|---| | Bidirectional | Blocks all traffic to and from internet gateways and egress-only internet gateways | | Ingress-only | Blocks inbound internet traffic; NAT gateways and egress-only internet gateways still work outbound | **Exclusions** exempt a VPC or subnet. A Bidirectional exclusion allows everything. An Egress-only exclusion allows outbound traffic only, and applies only when BPA is in Bidirectional mode. The number of exclusions per account per Region is an adjustable quota. A blocked path appears as `VPC_BLOCK_PUBLIC_ACCESS_ENABLED`. **Symptom:** a correctly built public subnet, with an internet gateway route, a public IP and open security groups, is unreachable. Check BPA before anything else. ## Quotas Internet gateways, NAT gateways per AZ, Elastic IPs per Region, IPs per NAT gateway and route tables per VPC are adjustable. Read them in Service Quotas. The errors you get when you hit them are in `reference/vpc/errors.md`. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.