AWS VPC Networking Fundamentals for Network Engineers

What Is an Amazon VPC?

An Amazon Virtual Private Cloud, or Amazon VPC, is a logically isolated network inside an AWS Region. It provides the addressing, routing, security and connectivity required by resources such as Amazon EC2 instances, load balancers and Amazon RDS databases.

For a network engineer, a VPC is similar to a virtual data centre network, but some traditional networking functions operate differently. AWS manages the physical routers and switches. Engineers define the desired network state through the AWS Management Console, AWS CLI, APIs or infrastructure-as-code tools.

A VPC has the following important characteristics:

• It belongs to one AWS account and one Region.
• It can span multiple Availability Zones within that Region.
• It supports IPv4 and IPv6 addressing.
• It contains one or more subnets.
• It uses route tables to control traffic paths.
• It can connect to the internet, other VPCs and on-premises networks.

The default VPC created by AWS is useful for basic testing. Production environments normally use custom VPCs because they provide better control over IP addressing, subnet design, routing and security.

VPC Address Planning

A VPC requires an IPv4 CIDR block when it is created. The permitted IPv4 prefix size is generally between /16 and /28. You can also associate additional IPv4 CIDR blocks later, subject to AWS rules and service quotas.

For example, a company may assign 10.20.0.0/16 to a production VPC and divide it into smaller subnets:

Avoid overlapping CIDR blocks when VPCs may later be connected through VPC peering, AWS Transit Gateway, AWS Site-to-Site VPN or AWS Direct Connect. Overlapping addresses make routing difficult and can prevent direct connectivity.

AWS reserves the first four addresses and the last address in every IPv4 subnet. In 10.20.1.0/24, for example, 10.20.1.0 through 10.20.1.3 and 10.20.1.255 are unavailable for resources. AWS does not support broadcast traffic, but the final address is still reserved.

For IPv6, AWS can allocate an IPv6 CIDR block to the VPC. VPC IPv6 allocations are commonly /56 blocks, with /64 blocks assigned to individual subnets. IPv6 addresses are globally unique, so internet access must be controlled through routes and security policies rather than private addressing or NAT.

Subnets and Availability Zones

A subnet is an IP address range inside a VPC. Unlike a VPC, a subnet exists in only one Availability Zone. Applications that require high availability should use subnets in at least two Availability Zones.

AWS does not assign a permanent public or private classification to a subnet. The subnet's effective role depends mainly on its route table.

Public subnets

A public subnet has a route to an internet gateway. A typical IPv4 route is:

0.0.0.0/0 -> igw-xxxxxxxx

A resource in that subnet also needs a public IPv4 address or Elastic IP address to communicate directly through the internet gateway over IPv4. A route to the gateway alone does not create a public address.

Public subnets commonly contain:

• Internet-facing Application Load Balancers
• Public Network Load Balancers
• NAT gateways
• Carefully controlled bastion hosts, where required

Private subnets

A private subnet has no direct route to an internet gateway. Instances can obtain outbound IPv4 internet access through a NAT gateway placed in a public subnet.

A typical private-subnet default route is:

0.0.0.0/0 -> nat-xxxxxxxx

A NAT gateway allows connections initiated from the private subnet to reach the internet. It does not permit unsolicited inbound internet connections to private instances.

For resilience, organisations normally deploy a NAT gateway in each active Availability Zone and route each private subnet to the NAT gateway in the same zone. This avoids unnecessary cross-zone dependency and data transfer.

Isolated subnets

An isolated subnet has no route to an internet gateway or NAT gateway. It is suitable for databases and internal services that do not need internet access. Private access to supported AWS services can be provided with VPC endpoints.

How VPC Routing Works

Every subnet must be associated with one route table. If no explicit association exists, the subnet uses the VPC's main route table.

Each route table automatically contains a local route for every IPv4 and IPv6 CIDR block associated with the VPC. A route may look like this:

10.20.0.0/16 -> local

The local route enables communication between subnets in the VPC. It cannot be removed. Security groups, network ACLs and host firewalls can still block the traffic.

AWS route tables use destination-based routing and longest-prefix matching. A route for 10.30.10.0/24 is preferred over 10.30.0.0/16 when both match a destination.

Common route targets include:

• Internet gateway
• NAT gateway
• VPC peering connection
• Transit gateway
• Virtual private gateway
• Egress-only internet gateway
• Elastic network interface
• Gateway endpoint

VPC route tables are not configured like Cisco IOS routers. Engineers do not enter a router configuration mode or run OSPF directly on the AWS VPC router. Dynamic routing with BGP is available at specific connectivity boundaries, including AWS Site-to-Site VPN, AWS Direct Connect and supported Transit Gateway attachments.

Internet Gateways, NAT and IPv6 Egress

An internet gateway is a horizontally scaled AWS-managed VPC component. It is attached to a VPC and used as a route target for public internet traffic.

For inbound IPv4 connectivity, an EC2 instance normally requires:

1. A public IPv4 address or Elastic IP address.
2. A subnet route to the internet gateway.
3. A security group rule permitting the required traffic.
4. A network ACL that permits both the request and response flows.
5. A listening application and a suitable operating-system firewall policy.

A public NAT gateway requires an Elastic IP address and must be created in a public subnet. Private subnets route outbound IPv4 traffic to it. NAT gateways are managed services and do not require manual patching, but they have hourly and data-processing charges. Current pricing should always be checked on the official AWS pricing pages.

IPv6 does not use NAT gateways for standard internet egress. An egress-only internet gateway allows IPv6 connections initiated from the VPC while preventing new inbound connections initiated from the internet.

Security Groups and Network ACLs

Security groups and network ACLs are separate controls. Understanding their differences is essential for AWS network troubleshooting.

Security groups

A security group acts as a stateful virtual firewall for an elastic network interface. If an inbound connection is allowed, response traffic is automatically permitted even when there is no matching outbound rule for the response path.

Rules can reference CIDR ranges, prefix lists or other security groups in supported scenarios. Referring to an application-tier security group from a database security group is usually safer than allowing an entire subnet.

Example database rule:

Type: PostgreSQL
Protocol: TCP
Port: 5432
Source: sg-application-tier

Network ACLs

A network ACL is a stateless subnet-level control. Inbound and outbound rules are evaluated separately. Because it is stateless, the return path must also be allowed, including the relevant ephemeral ports.

Network ACLs can provide broad subnet guardrails or explicit deny rules. They should not replace correctly designed security groups. Complex ACL rule sets can create difficult troubleshooting conditions if ephemeral port ranges and traffic direction are not understood.

Elastic Network Interfaces and IP Addresses

An Elastic Network Interface, or ENI, is a virtual network interface in a VPC. It can have:

• A primary private IPv4 address
• Secondary private IPv4 addresses
• IPv6 addresses
• One or more security groups
• A MAC address
• An optional Elastic IP association

Many AWS services create and manage ENIs inside customer subnets. Examples include interface VPC endpoints, load balancers and some AWS Lambda networking configurations.

Private IPv4 addresses normally remain associated with an ENI until they are changed or the interface is deleted. A public IPv4 address can change after an EC2 instance is stopped and started. Use an Elastic IP when a stable public IPv4 address is genuinely required, while also considering its cost and architectural implications.

Connecting VPCs and On-Premises Networks

AWS offers several connectivity models. The correct choice depends on scale, routing requirements, cost and operational ownership.

VPC peering

VPC peering creates private connectivity between two VPCs. Routes must be added on both sides, and security controls must permit the traffic. Peering is non-transitive: if VPC A peers with VPC B and VPC B peers with VPC C, VPC A cannot automatically reach VPC C through VPC B.

AWS Transit Gateway

AWS Transit Gateway provides a regional hub for connecting multiple VPCs and supported external networks. Transit Gateway route tables can segment environments such as production, development and shared services. It is generally easier to operate than a large mesh of peering connections.

Site-to-Site VPN and Direct Connect

AWS Site-to-Site VPN provides encrypted IPsec tunnels between AWS and an on-premises network. AWS uses two tunnels per VPN connection for redundancy, and BGP can be used with dynamic routing configurations.

AWS Direct Connect provides dedicated private connectivity from a customer network to AWS through a Direct Connect location or partner. It offers more consistent network performance than an internet-based path, but encryption is not automatically provided by the physical connection. Designs may combine Direct Connect with VPN or MAC Security where supported and required.

Network engineers in Chennai and Bangalore increasingly work on hybrid designs that combine campus or data-centre routing skills with Transit Gateway, BGP, VPN and cloud security knowledge.

Private Access to AWS Services

VPC endpoints allow resources to reach supported AWS services without using a NAT gateway or public internet path.

There are two commonly encountered endpoint types:

• Gateway endpoints: Used for Amazon S3 and DynamoDB. They add service routes to selected route tables and do not have hourly endpoint charges.
• Interface endpoints: Powered by AWS PrivateLink. They create ENIs with private IP addresses in selected subnets and use security groups.

Private DNS is important with interface endpoints. When enabled and correctly configured, standard regional service names can resolve to the endpoint's private addresses inside the VPC.

VPC DNS behaviour is controlled by attributes including DNS resolution and DNS hostnames. The Amazon-provided DNS server is available within the VPC, while Amazon Route 53 Resolver endpoints can support DNS queries between AWS and on-premises environments.

Monitoring and Troubleshooting VPC Traffic

A structured troubleshooting process should check addressing, routes, security policies, DNS and the application itself.

Useful AWS tools include:

• VPC Flow Logs: Capture metadata about accepted and rejected IP traffic for VPCs, subnets or ENIs. They do not capture packet payloads.
• Reachability Analyzer: Analyses the configured network path between a source and destination and identifies blocking components.
• Traffic Mirroring: Copies supported ENI traffic to monitoring or security appliances for deeper inspection.
• CloudWatch metrics: Provide service-specific visibility for components such as NAT gateways and VPN connections.
• AWS CloudTrail: Records API activity and helps identify configuration changes.

A practical troubleshooting order is:

1. Confirm source and destination IP addresses.
2. Check the subnet route table in both directions.
3. Verify security group rules.
4. Check inbound and outbound network ACL rules.
5. Test DNS resolution.
6. Confirm that the application is listening on the expected port.
7. Review Flow Logs and Reachability Analyzer findings.

Traditional commands such as ping, traceroute, tracepath, dig, nslookup, curl and ss remain useful, although ICMP may be blocked and AWS paths may not expose every intermediate hop.

Creating a Basic VPC with AWS CLI

The following example creates a VPC, a subnet and an internet gateway. Replace the Region and CIDR blocks to suit the design.

aws configure set region ap-south-1

VPC_ID=$(aws ec2 create-vpc \
  --cidr-block 10.20.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=training-vpc}]' \
  --query 'Vpc.VpcId' \
  --output text)

aws ec2 modify-vpc-attribute \
  --vpc-id "$VPC_ID" \
  --enable-dns-hostnames '{"Value":true}'

SUBNET_ID=$(aws ec2 create-subnet \
  --vpc-id "$VPC_ID" \
  --cidr-block 10.20.1.0/24 \
  --availability-zone ap-south-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-a}]' \
  --query 'Subnet.SubnetId' \
  --output text)

IGW_ID=$(aws ec2 create-internet-gateway \
  --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=training-igw}]' \
  --query 'InternetGateway.InternetGatewayId' \
  --output text)

aws ec2 attach-internet-gateway \
  --internet-gateway-id "$IGW_ID" \
  --vpc-id "$VPC_ID"

ROUTE_TABLE_ID=$(aws ec2 create-route-table \
  --vpc-id "$VPC_ID" \
  --query 'RouteTable.RouteTableId' \
  --output text)

aws ec2 create-route \
  --route-table-id "$ROUTE_TABLE_ID" \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id "$IGW_ID"

aws ec2 associate-route-table \
  --route-table-id "$ROUTE_TABLE_ID" \
  --subnet-id "$SUBNET_ID"

aws ec2 modify-subnet-attribute \
  --subnet-id "$SUBNET_ID" \
  --map-public-ip-on-launch

This is a learning example rather than a complete production architecture. A production design should include multiple Availability Zones, private subnets, controlled security groups, logging, tagging and an appropriate egress strategy.

Skills Network Engineers Should Build

Network engineers moving into AWS should combine existing TCP/IP knowledge with cloud-specific operational skills. Important areas include:

• CIDR planning and subnetting
• Security groups and network ACLs
• Transit Gateway and VPC peering
• BGP, IPsec VPN and Direct Connect concepts
• Route 53 Resolver and hybrid DNS
• VPC Flow Logs and Reachability Analyzer
• AWS CLI and infrastructure as code
• Identity and Access Management for network changes
• Cost awareness for NAT gateways, endpoints and data transfer

Cisco routing and switching experience remains valuable, especially for hybrid connectivity and troubleshooting. However, AWS networking also requires an understanding of APIs, automation, distributed security controls and shared responsibility. Hands-on labs that build multi-tier and hybrid VPC designs are the best way to connect traditional networking knowledge with AWS operations.