VPC basics: public and private subnets

Inbound request

Beginner

1. A visitor’s request arrives at your network’s front gate.
2. The gate lets it through to the lobby, where the greeter waits.
3. The greeter walks the request to the app in a back room.
4. The app hands back its answer.
5. The greeter carries it back to the front gate.
6. The visitor gets their page, without ever knowing where the back room is.

Practitioner

1. Traffic enters the VPC through the internet gateway.
2. It reaches the load balancer in a public subnet.
3. The load balancer forwards to the private app server.
4. The app server responds to the load balancer.
5. The load balancer sends the response out.
6. The response reaches the user. The app was never directly exposed.

Architect

1. Inbound flow to the ALB’s public IP is translated by the IGW.
2. Public route table and the ALB’s security group allow 443 from anywhere.
3. Target traffic stays inside the VPC; the app’s security group only trusts the ALB’s.
4. Response returns on the same connection.
5. Stateful security groups allow the return traffic automatically.
6. Round trip complete; the app has no public IP and no inbound route from the internet.

App calls out

Beginner

1. The app needs a software update, so it sends a request to the mail room.
2. The mail room swaps the return address for its own and sends it out.
3. The request goes out to the internet.
4. The update server replies to the mail room’s address.
5. The reply arrives at the mail room.
6. The mail room passes it to the app. Strangers still can’t start a conversation with the app.

Practitioner

1. The private app sends outbound traffic to the NAT gateway.
2. NAT replaces the private source address with its public one.
3. Traffic leaves the VPC.
4. The reply comes back to the NAT’s public address.
5. The internet gateway hands it to the NAT gateway.
6. NAT forwards the reply to the private instance.

Architect

1. Private route table sends 0.0.0.0/0 to the NAT gateway in the same zone.
2. Source NAT to the NAT gateway’s Elastic IP, then out via the IGW.
3. Egress to the update server.
4. Return traffic matches the NAT’s connection-tracking entry.
5. Delivered to the NAT gateway.
6. Translated back to the private IP. Unsolicited inbound connections have no mapping and are dropped.