What is a VPC, and what is the difference between public and private subnets?
A VPC is your own private network inside AWS. A public subnet has a route to an internet gateway, so resources with public IPs can be reached from the internet. A private subnet has no such route; its servers reach the internet only outbound, through a NAT gateway placed in a public subnet.
Explain it simply
Picture a gated housing society. The society is your VPC (Virtual Private Cloud): a fenced area with its own address system that only you control.
Inside, some blocks face the main road with a gate, like the shops near the entrance. Visitors can walk in. That is a public subnet.
The residential towers sit deep inside with no gate to the road. Outsiders cannot walk in. That is a private subnet.
Residents still need to order groceries. They send requests through the society's security office, which talks to the outside world for them. Delivery people only ever see the office, never the flat. That office is the NAT gateway: it lets private servers start outbound connections without letting anyone start a connection to them.
Example
A typical three-tier web app in one VPC:
VPC 10.0.0.0/16
Public subnet 10.0.1.0/24 (AZ a) -> load balancer, NAT gateway
Public subnet 10.0.2.0/24 (AZ b) -> load balancer, NAT gateway
Private subnet 10.0.11.0/24 (AZ a) -> app servers
Private subnet 10.0.12.0/24 (AZ b) -> app servers
Private subnet 10.0.21.0/24 (AZ a) -> database
Private subnet 10.0.22.0/24 (AZ b) -> database standby
Public route table: 0.0.0.0/0 -> internet gateway
Private route table: 0.0.0.0/0 -> NAT gateway (in the same AZ)Users reach only the load balancer. App servers download updates through NAT. The database has no internet route at all.
How it works
- VPC: created in one Region with a private IP range written in CIDR, like
10.0.0.0/16(about 65,000 addresses). - Subnet: a slice of that range that lives in exactly one Availability Zone. AWS reserves five addresses in every subnet.
- Route table: each subnet is associated with one. It decides where traffic goes. Every route table has a local route so all subnets in the VPC can talk to each other.
- Internet gateway (IGW): attached to the VPC. A subnet is "public" only because its route table sends
0.0.0.0/0to the IGW. An instance there also needs a public IP or Elastic IP to be reachable. - NAT gateway: sits in a public subnet with an Elastic IP. Private subnets route
0.0.0.0/0to it. It translates private addresses to its own public address for outbound traffic, and replies come back, but new inbound connections from the internet are not allowed. - Security: security groups and network ACLs then filter which traffic is allowed.
Real-world use
Almost every production setup on AWS looks like the example: public-facing load balancers, app servers and databases tucked into private subnets, and NAT for outbound calls such as reaching a payment gateway API, sending SMS through a provider or pulling OS patches.
Common mistakes
- Thinking "public subnet" is a checkbox. It is defined by the route to an internet gateway.
- Putting the database in a public subnet so a developer can connect from a laptop. Use a bastion host, AWS Systems Manager Session Manager or a VPN instead.
- Placing the NAT gateway in a private subnet. It must be in a public subnet.
- Using one NAT gateway for all AZs. If that AZ fails, every private subnet loses outbound access.
- Choosing a CIDR range that overlaps with the office network or another VPC, which blocks peering and VPN later.
What to say in the interview
"A VPC is a logically isolated private network in a Region, with an IP range I choose. I split it into subnets, each in one AZ. A subnet is public if its route table has a default route to an internet gateway; otherwise it is private. I put load balancers in public subnets and app servers and databases in private ones. Private instances that need outbound internet access go through a NAT gateway in a public subnet, which allows outbound connections and their replies but blocks connections started from outside. For high availability I'd use one NAT gateway per AZ."
Follow-up questions
- What is the difference between an internet gateway and a NAT gateway?
- How can a private instance reach S3 without going through NAT?
- How do two VPCs talk to each other?
- How would you SSH into a server in a private subnet?
Go deeper
Read these once the basics above feel easy.
VPC endpoints let private subnets reach AWS services privately. A gateway endpoint covers S3 and DynamoDB and is added to the route table; interface endpoints (PrivateLink) create private IPs for many other services. This removes NAT from the path for that traffic, which improves security and often lowers data processing charges. For IPv6, an egress-only internet gateway plays the role NAT plays for IPv4.
Connecting many VPCs and on-premises networks: VPC peering is one-to-one and not transitive, so it gets messy at scale. Transit Gateway acts as a central hub with its own route tables. Site-to-Site VPN and Direct Connect link a data centre. Plan non-overlapping CIDR ranges across all accounts from the start, and use VPC Flow Logs to debug which traffic is accepted or rejected.