AWS VPC, Subnets, Internet Gateway, and NAT Gateway Lab

Project Overview

This hands-on project demonstrates the core networking components available in Amazon Web Services (AWS), including Amazon VPC, CIDR blocks, subnets, route tables, Internet Gateways, and NAT Gateways.

The project began by exploring the Amazon VPC console and reviewing the CIDR block assigned to the VPC. A CIDR calculator was used to understand the available IP address range. The available subnets were then reviewed, including the subnet located in the us-east-1a Availability Zone.

An Amazon EC2 instance was launched into the selected subnet. The private IP address assigned to the EC2 instance was compared with the subnet CIDR block to confirm that the instance private IP address falls within the correct subnet IP address range.

The project also covered how route tables control traffic within a VPC, how an Internet Gateway enables internet access for public subnets, and how a NAT Gateway provides outbound internet access for resources in private subnets.

Project Objectives

• Explore the Amazon VPC console.
• Review the CIDR block assigned to a VPC.
• Use a CIDR calculator to understand VPC IP address ranges.
• Review available default subnets and their CIDR blocks.
• Launch an EC2 instance into a subnet in us-east-1a.
• Verify that the EC2 private IP address belongs to the selected subnet CIDR range.
• Understand local routes in an AWS route table.
• Understand how an Internet Gateway provides internet connectivity.
• Understand why a NAT Gateway is used for private subnet resources.

AWS Services and Tools Used

• Amazon VPC
• Amazon EC2
• Subnets
• Route Tables
• Internet Gateway
• NAT Gateway
• CIDR Calculator

Architecture Diagram

                              Internet
                                 |
                         Internet Gateway
                                 |
        ------------------------------------------------
        |                     VPC                      |
        |                                              |
        |  Public Subnet                               |
        |  - Route Table                               |
        |  - Route: 0.0.0.0/0 to Internet Gateway      |
        |  - NAT Gateway                               |
        |                                              |
        |  Private Subnet                              |
        |  - Private EC2 Resources                     |
        |  - Route: 0.0.0.0/0 to NAT Gateway           |
        |                                              |
        ------------------------------------------------

Step 1: Open the Amazon VPC Console

1. Sign in to the AWS Management Console.
2. Search for VPC using the AWS console search bar.
3. Select VPC from the search results.
4. The Amazon VPC dashboard opens.

The VPC dashboard provides access to networking resources such as:

• Your VPCs
• Subnets
• Route Tables
• Internet Gateways
• NAT Gateways
• Security Groups
• Network ACLs

Step 2: Review the VPC CIDR Block

1. In the VPC console left navigation panel, click Your VPCs.
2. Select the VPC to review.
3. Open the VPC details section.
4. Locate the IPv4 CIDR block assigned to the VPC.

A CIDR block defines the private IP address range available inside a VPC.

Example:

172.31.0.0/16

The /16 prefix provides a large private IP address range that can be divided into smaller subnet ranges.

Additional CIDR blocks can be added to a VPC in the future if more IP addresses are required, as long as the new CIDR range does not overlap with existing network ranges.

Step 3: Calculate the CIDR Range

1. Open a web browser.
2. Search for a CIDR calculator.
3. Enter the VPC CIDR block into the calculator.
4. Review the network address, subnet mask, IP address range, and available addresses.

CIDR calculations help identify the IP address range available for the VPC and the smaller subnet ranges that can be created within it.

Step 4: Review Available Subnets

1. In the VPC console left navigation panel, click Subnets.
2. Review the available subnets.
3. Identify the subnet in the us-east-1a Availability Zone.
4. Review the IPv4 CIDR block assigned to the subnet.

Each subnet belongs to one Availability Zone and has its own CIDR block. The subnet CIDR block must be within the larger VPC CIDR block.

Step 5: Launch an EC2 Instance in the Selected Subnet

1. Open the Amazon EC2 console.
2. Click Launch instances.
3. Configure the EC2 instance details.
4. Under Network settings, click Edit.
5. Select the VPC used for this project.
6. Select the subnet available in the us-east-1a Availability Zone.
7. Launch the EC2 instance.

The selected subnet determines the private IP address range from which AWS assigns a private IP address to the EC2 instance.

Step 6: Verify the EC2 Private IP Address

1. Open the EC2 console.
2. Select the newly created EC2 instance.
3. Review the instance details.
4. Locate the private IPv4 address assigned to the instance.
5. Return to the VPC console and open Subnets.
6. Select the subnet used by the EC2 instance.
7. Compare the EC2 private IP address with the subnet CIDR range.

The EC2 private IP address should fall within the CIDR range of the subnet selected during instance creation.

Step 7: Review the Route Table

1. In the VPC console left navigation panel, click Route tables.
2. Select the route table associated with the subnet.
3. Open the Routes tab.
4. Review the routes configured for the VPC.

Route tables contain routes that determine where network traffic is sent.

Every VPC includes a local route that allows resources inside the VPC to communicate with one another.

Destination: VPC CIDR block
Target: local

This route allows traffic within the VPC CIDR block to remain inside the VPC.

Step 8: Understand Internet Gateway Routing

An Internet Gateway enables communication between a VPC and the internet.

For a subnet to be public, its route table must include a route to an Internet Gateway.

Destination: 0.0.0.0/0
Target: Internet Gateway

The destination 0.0.0.0/0 represents all IPv4 addresses outside the local VPC network. This route sends internet-bound traffic from the public subnet to the Internet Gateway.

Step 9: Understand NAT Gateway and Private Subnets

A NAT Gateway allows resources in a private subnet to access the internet for outbound traffic without allowing unsolicited inbound internet traffic.

Before creating a NAT Gateway, a private subnet must be available for private resources. The NAT Gateway is placed in a public subnet and uses the Internet Gateway for internet access.

The private subnet route table is configured with the following route:

Destination: 0.0.0.0/0
Target: NAT Gateway

This configuration allows private EC2 instances to download updates, install packages, and access external services while remaining protected from direct inbound internet connections.

Key Learning Outcomes

• A VPC is an isolated virtual network in AWS.
• CIDR blocks define the available IP address ranges in a VPC and subnet.
• Subnets divide a VPC into smaller network segments.
• EC2 instances receive private IP addresses from the subnet CIDR range.
• Route tables control how traffic moves within a VPC and to external networks.
• Internet Gateways provide internet connectivity for public subnets.
• NAT Gateways provide secure outbound internet access for private subnet resources.
• Public and private subnet separation is an important AWS security and network design practice.

---

Author

Elochukwu Princewill

Cloud Computing • Cybersecurity

---

⭐ If you found this project helpful

Feel free to ⭐ star this repository and explore my other AWS hands-on projects as I continue building practical cloud engineering solutions.

---