AWS VPC Route Tables
Understand how VPC route tables direct traffic, when to add an internet gateway route, and how subnet associations control connectivity.
Route tables tell AWS where traffic should go after it leaves an interface in your subnet. Every VPC route table contains a local route that allows communication within the VPC’s own CIDR range. Beyond that default, you add routes for internet access, NAT, peering, VPN connections, transit gateways, or other destinations depending on the architecture.
The most common beginner example is the public subnet route table. In addition to the local route, it contains 0.0.0.0/0 pointing to an Internet Gateway. That single rule is what lets internet-bound traffic leave the VPC directly. Private subnets omit that route and usually point 0.0.0.0/0 to a NAT Gateway instead when outbound internet access is needed.
| Route | Meaning |
|---|---|
| local | Traffic for the VPC CIDR stays inside the VPC |
| 0.0.0.0/0 -> igw | Default route to the internet for public subnets |
| 0.0.0.0/0 -> nat | Outbound internet via NAT for private subnets |
Route tables only affect the subnets associated with them. That is why public and private tiers often use separate tables even inside the same VPC. If you associate the wrong table with a subnet, resources may lose internet access or accidentally become reachable in ways you did not intend.
Troubleshooting route tables usually means checking three things together: the route table itself, the subnet association, and the presence of the referenced target such as an Internet Gateway or NAT Gateway. A route can look correct on paper but still fail if the gateway is missing or the resource sits in a different subnet than expected.
Pair this lesson with AWS VPC Subnets and AWS VPC NAT Gateway for the full traffic picture.
aws ec2 describe-route-tables --output table
aws ec2 create-route --route-table-id rtb-1234567890abcdef0 --destination-cidr-block 0.0.0.0/0 --gateway-id igw-1234567890abcdef0
aws ec2 associate-route-table --route-table-id rtb-1234567890abcdef0 --subnet-id subnet-1234567890abcdef0
Operational note
When network troubleshooting gets confusing, reduce the problem to layers: subnet placement, route table association, security group rules, and the presence of the correct gateway or endpoint. AWS networking becomes much easier to reason about when you verify those four items in order instead of changing everything at once. Shared standards like this make future environments easier to launch, review, and support.
Local route
What does the default local route in a VPC route table do?
Public subnets
Which route is typically added to make a subnet public?