PreviewLab2.5 hours

Routing

Internet Gateway, NAT Gateway, VPC peering, and longest-prefix routing across three subnet tiers.

This builds directly on The VPC Itself and Subnets. All 6 subnets and 3 route tables must exist.
In a new terminal session, run the resume script at the end of Subnets.
Read the callout before every step. Predict what will happen, then run it.

Internet Gateway

Goal

Create an Internet Gateway, attach it to the VPC, and add a route to the public route table. Understand exactly what an IGW does and why attaching it alone is not enough.

Estimated time: 30 minutes

Create and attach an Internet Gateway

What's happening here

An Internet Gateway is a horizontally scaled, redundant, highly available VPC component: it is not a single point of failure and has no bandwidth limit. It serves two functions: (1) it provides a target for routes (0.0.0.0/0 → igw-xxx) so that packets destined for the internet have somewhere to go, and (2) it performs NAT for public IPs: when a packet leaves an instance with a public IP, the IGW translates the source from the private IP to the public IP before sending it out. Without this NAT, the internet would see packets from a 10.x.x.x address and drop the response.

Creating the IGW and attaching it are two separate operations. A detached IGW is useless, it exists but isn't associated with any VPC. One VPC can have at most one IGW.

bash

# Create the IGW
export IGW_ID=$(aws ec2 create-internet-gateway \
  --region $AWS_REGION \
  --query 'InternetGateway.InternetGatewayId' --output text)

aws ec2 create-tags \
  --resources $IGW_ID \
  --tags Key=Name,Value=networking-lab-igw \
  --region $AWS_REGION

echo "IGW ID: $IGW_ID"

# Attach it to the VPC
aws ec2 attach-internet-gateway \
  --internet-gateway-id $IGW_ID \
  --vpc-id $VPC_ID \
  --region $AWS_REGION

echo "IGW attached to VPC"

Verify the attachment:

bash

aws ec2 describe-internet-gateways \
  --internet-gateway-ids $IGW_ID \
  --region $AWS_REGION \
  --query 'InternetGateways[0].{Id:InternetGatewayId,State:Attachments[0].State,VPC:Attachments[0].VpcId}'

Checkpoint: State: attached, VPC matches your $VPC_ID.

Add the internet route to the public route table

What's happening here

Attaching the IGW to the VPC does nothing for routing by itself. You must explicitly add a route that says "send all non-local traffic to the IGW". The route 0.0.0.0/0 → igw-xxx is a catch-all default route: it matches any destination that doesn't match a more specific route. The local route 10.0.0.0/16 → local is more specific for traffic within the VPC, so intra-VPC traffic still routes locally. Only traffic destined for IPs outside 10.0.0.0/16 hits the default route and goes to the IGW. We add this route only to the public route table, private and isolated subnets get no IGW route.