AWS Internet Gateway Explained: How VPCs Reach the Internet

When deploying workloads on Amazon Web Services, understanding how traffic flows across network boundaries is critical. When you provision a new VPC, AWS automatically creates a default route table and associates it with the default subnets, but public internet connectivity requires explicit configuration. The gateway acts as a virtual router on the edge of your VPC, translating private IP addresses to public IPs and managing bidirectional packet flow without introducing a single point of failure or bandwidth bottlenecks.

Quick Answer

An AWS Internet Gateway is a managed VPC component that connects your private virtual network to the public internet. It performs two primary functions: it provides a target in your VPC route tables for internet-routable traffic, and it performs Network Address Translation (NAT) for instances that have been assigned public IPv4 addresses or Elastic IP addresses. To establish connectivity, you attach an IGW to your VPC and add a route pointing 0.0.0.0/0 to that gateway.

For administrators and cloud architects, mastering this component is essential for building secure web applications, API gateways, and hybrid cloud environments. By separating resources into public and private subnets, teams can expose only necessary web-facing entry points while keeping databases and application servers securely locked away from external threats.

What Is an Internet Gateway?

An Internet Gateway is more than a simple bridge; it is a fully managed, scalable AWS service designed to handle petabytes of data traffic without administrative intervention. Unlike traditional hardware firewalls or software virtual appliances that require manual scaling or clustering, the gateway scales automatically with your network traffic.

IGW attachment

An Internet Gateway cannot exist in a vacuum; it must be explicitly attached to a single VPC at any given time. Creating an IGW is a lightweight operation performed via the AWS Management Console, AWS CLI, or Infrastructure as Code tools like Terraform. Once created using a command such as aws ec2 create-internet-gateway, the gateway remains in a detached state until you bind it to your target VPC using aws ec2 attach-internet-gateway --internet-gateway-id igw-xxxxxx --vpc-id vpc-xxxxxx. This attachment establishes the foundational network edge where VPC traffic meets the wider internet, though traffic will still be dropped until route tables and security boundaries are properly defined.

Public Subnets

Not every subnet in a VPC has access to the internet. A subnet becomes a public subnet only when its associated route table contains a route directing all traffic destined outside the VPC toward an active Internet Gateway. Conversely, a private subnet lacks this route, meaning any packets originating from instances within it cannot reach external destinations directly.

In standard architectures, public subnets host resources that need direct inbound or outbound communication with the world, such as Application Load Balancers, public-facing web servers, or NAT gateways. Security groups and network access control lists (NACLs) act as secondary layers of defense, ensuring that even though a subnet is technically public, only authorized ports and protocols remain accessible from the outside.

Route Table Configuration

Route tables are the navigational compass of your VPC. Each route table contains a set of rules, called routes, that determine where network traffic is directed based on destination IP addresses. Without a proper route table entry pointing to your gateway, your instances remain isolated.

Route table

Every subnet in your VPC must be associated with a route table. By default, subnets are linked to the VPC main route table, which contains a local route enabling communication within the VPC itself. To turn a subnet public, you must create or modify a custom route table and add a destination of 0.0.0.0/0 (representing all IPv4 addresses outside the VPC) with the target set to your Internet Gateway identifier (igw-xxxxxx). Subnets explicitly associated with this custom route table inherit the rule, allowing instances inside them to route outbound requests straight to the gateway. For IPv6 traffic, a similar route for ::/0 pointing to the IGW enables native dual-stack connectivity.

Public IPs

Routing traffic to an Internet Gateway is only half the equation; instances also require a routable public IP address for external entities to reach them, or for the gateway to translate outbound private packets into valid public responses.

Public IP

AWS offers two primary methods for assigning public IPv4 connectivity to EC2 instances: Auto-assigned Public IPv4 addresses and Elastic IP (EIP) addresses. When you launch an instance in a public subnet with auto-assign enabled, AWS assigns a public IP from the Amazon pool. However, this address changes if the instance is stopped and restarted. For production environments requiring a static address for DNS records or firewall whitelists, an Elastic IP—a static, persistent public IPv4 address allocated to your AWS account—can be associated with the instance network interface. The Internet Gateway uses these mappings to translate the private IP addresses assigned to your elastic network interfaces (ENIs) into public IP addresses as packets cross the network boundary.

Internet Access Flow

Understanding the end-to-end journey of a packet helps demystify how cloud networking operates at scale. When an application on an EC2 instance in a public subnet needs to fetch data from an external web API, it generates an IP packet destined for that external server's IP address.

Return traffic

The operating system on the instance checks its local routing table, sees no local match for the destination IP, and forwards the packet to the default gateway, which is the VPC router. The VPC router checks the subnet's associated route table, finds the 0.0.0.0/0 rule pointing to the Internet Gateway, and forwards the packet to the IGW. The Internet Gateway performs source NAT, replacing the instance's private IP address with its public IP or Elastic IP, and dispatches the packet onto the public internet. When the external server replies, return traffic hits the IGW, which performs destination NAT, mapping the public IP back to the instance's private IP before forwarding the packet back through the VPC router and into the subnet. Because security groups in AWS are stateful, return traffic matching an established outbound connection is automatically allowed back through, regardless of inbound security group rules.

Common Mistakes

Deploying cloud networking components requires precision. Engineers often run into predictable pitfalls that disrupt connectivity or compromise security posture.

Another frequent error involves misconfiguring Network ACLs or security groups, blocking ephemeral return ports (typically ports 1024 through 65535), which manifests as mysterious connection timeouts even when route tables are completely correct. Always verify traffic paths using tools like AWS VPC Reachability Analyzer before assuming a gateway failure.