Routes, internet gateways, NAT gateways and Block Public Access
How traffic leaves a subnet — route tables and route priority, internet gateways and public IPs, zonal and regional NAT gateways (public and private), connection limits and timeouts, and the account-level VPC Block Public Access switch that overrides all of them.
markdownreferencev4D9J7-MV61stage: referencetrust: officialservice: vpcinterface: anyroute tablemost specific routemain route tableinternet gatewaypublic subnetpublic IPNAT gatewayzonal NAT gatewayregional NAT gatewayprivate NAT gatewayElastic IP350 second idle timeout55000 connectionsErrorPortAllocationegress-only internet gatewayVPC Block Public AccessBPA exclusions
A subnet reaches the internet through the route its route table gives 0.0.0.0/0: an internet gateway (the resource then needs a public IP) or a NAT gateway (outbound only). VPC Block Public Access, when on, overrides both.
Route tables
- Each subnet is associated with one route table. One table can serve many subnets.
- The most specific matching route wins. Reachability Analyzer reports a route shadowed this way as
MORE_SPECIFIC_ROUTE, or asHIGHER_PRIORITY_ROUTEwhen the CIDR is identical. - The local route covers the VPC CIDR only (
VPC_LOCAL_ROUTE_CIDR_RESTRICTION). - A route to a deleted target becomes unusable:
BAD_STATE_ROUTE(blackhole, UNVERIFIED term). - Fixed limits: 100 propagated routes per table. Non-propagated routes per table can be raised to at most 1,000, at a possible cost to performance.
Internet gateway
- One per VPC at a time. Traffic passes only for interfaces with a public IPv4 or Elastic IP (
IGW_PUBLIC_IP_ASSOCIATION_FOR_EGRESS). - Outbound traffic to private (RFC 1918) or shared (RFC 6598) destination addresses is dropped.
- IPv6 outbound-only: an egress-only internet gateway, also one per VPC.
- Every public IPv4 address is billed hourly (since 2024-02-01), whether attached or idle, across services. This includes Elastic IPs and the public IPs of instances, RDS and EKS nodes. Public IP Insights (free, in VPC IPAM) shows where they are. Private subnets behind a NAT gateway, or IPv6 with an egress-only internet gateway, avoid one public IP per resource. Prices are on the VPC pricing page.
NAT gateways
| Zonal, public (default) | Zonal, private | Regional | |
|---|---|---|---|
| Placement | A public subnet in one AZ | A subnet | The VPC: no subnet |
| Elastic IP | Required at creation | Not allowed | Automatic, or manual per AZ |
| Reaches | Internet via the IGW; other VPCs or on-premises via TGW/VGW | Other VPCs and on-premises via TGW/VGW only. Routed to an IGW, the traffic is dropped | Internet via its own auto-created route table (route to the IGW); TGW supported |
| AZ coverage | One AZ: deploy one per AZ | One AZ | Expands into AZs with network interfaces, within up to 60 min |
| IPs | Up to 8 (quota) | — | Up to 32 per AZ |
| Create | create-nat-gateway --subnet-id … --allocation-id … | … --connectivity-type private (UNVERIFIED flag) | create-nat-gateway --vpc-id … --availability-mode regional |
Common to all NAT gateways:
- Connections must start inside the VPC. Only traffic from network interfaces in the same VPC is translated, not traffic arriving over peering, VPN or Direct Connect (
NGW_REQUIRES_SOURCE_IN_VPC). - Protocols: TCP, UDP and ICMP only. No IP fragmentation for TCP or ICMP. No IPsec (use NAT-T over UDP).
- Idle timeout: 350 seconds. After that, the gateway returns RST to the inside host. Use TCP keepalive below 350 s for long-lived idle connections.
- 55,000 concurrent connections per IP address to one destination (destination IP, port and protocol). Add IPs, spread clients across gateways, and watch
IdleTimeoutCountand port-allocation errors (ErrorPortAllocationmetric: UNVERIFIED name in the collected sources). - A NAT gateway does not answer ping. Test from an instance behind it.
Failedgateways are shown for about an hour, then deleted.- IPv6 to IPv4 is possible through DNS64/NAT64.
Converting zonal to regional
Either create the regional gateway, repoint routes and delete the zonal ones (new IPs), or delete the zonal ones first and reuse their Elastic IPs. Both reset existing connections, so do it in a maintenance window. A regional NAT gateway not yet in the traffic's AZ shows as REGIONAL_NGW_ROUTE_AZ_RESTRICTION in Reachability Analyzer.
VPC Block Public Access (BPA)
An account setting per Region that blocks internet traffic regardless of routes, security groups or public IPs.
| Mode | Effect |
|---|---|
| Bidirectional | Blocks all traffic to and from internet gateways and egress-only internet gateways |
| Ingress-only | Blocks inbound internet traffic; NAT gateways and egress-only internet gateways still work outbound |
Exclusions exempt a VPC or subnet. A Bidirectional exclusion allows everything. An Egress-only exclusion allows outbound traffic only, and applies only when BPA is in Bidirectional mode. The number of exclusions per account per Region is an adjustable quota. A blocked path appears as VPC_BLOCK_PUBLIC_ACCESS_ENABLED.
Symptom: a correctly built public subnet, with an internet gateway route, a public IP and open security groups, is unreachable. Check BPA before anything else.
Quotas
Internet gateways, NAT gateways per AZ, Elastic IPs per Region, IPs per NAT gateway and route tables per VPC are adjustable. Read them in Service Quotas. The errors you get when you hit them are in reference/vpc/errors.md.