AWS Networking: VPC Reference Cheatsheet
AWS Networking: VPC Reference Cheatsheet
VPC networking on one sheet, the architect exam’s way and the way it works in 2026: the VPC and the default VPC, CIDR and subnetting, subnet architecture across AZs, public, private and Elastic IPs, route tables and longest prefix match, endpoints, network ACLs and security groups, NAT gateways (now also regional), bastions and what replaced them, Site-to-Site VPN, Direct Connect, VPC peering, Transit Gateway, flow logs and network adapters, then the IP, OSI and port fundamentals underneath. Twenty-one diagrams, and every point checked against AWS as of October 2026. The tickable companion is bubim-awsnet-run.
The VPC and the default VPC
A VPC is your logically isolated network in one Region. It spans every Availability Zone of that Region; each subnet lives in exactly one AZ. Nothing reaches it from outside, or leaves it, unless a route, a gateway and the firewalls allow it.
| Fact | Value |
|---|---|
| Scope | one Region, all its AZs |
| VPCs per Region | 5 by default, raisable to hundreds |
| Subnets per VPC | 200 by default |
| IPv4 CIDR size | /16 (65,536) down to /28 (16) |
| CIDR blocks per VPC | 5 IPv4 and 5 IPv6, each raisable to 50 |
| IPv6 | a /56 per VPC, a /64 per subnet |
| DNS | enableDnsSupport, enableDnsHostnames |
| Default VPC (one per Region) | Value |
|---|---|
| CIDR | 172.31.0.0/16 |
| Subnets | one /20 per AZ, all public |
| Internet gateway | attached; main route table sends 0.0.0.0/0 to it |
| Public IPv4 | auto-assigned on launch |
| NACL, security group | default ones: allow all, and allow within the group |
| Use it for | experiments; build your own VPC for anything real |
CIDR blocks and subnetting
The number after the slash is how many leading bits are the network; the rest are hosts. Subnetting borrows host bits to cut a block into equal smaller blocks. AWS takes five addresses out of every subnet.
fig 1 · each extra prefix bit halves the block; pick the mask from the number of subnets and the hosts each needs
fig 2 · size subnets for growth: AWS takes five addresses whatever the mask, so tiny subnets lose a third of their space
| Mask | Netmask | Addresses | Usable in AWS | Typical use |
|---|---|---|---|---|
| /16 | 255.255.0.0 | 65,536 | 65,531 | a whole VPC |
| /18 | 255.255.192.0 | 16,384 | 16,379 | large EKS or container subnets |
| /20 | 255.255.240.0 | 4,096 | 4,091 | default VPC subnets; busy app tiers |
| /22 | 255.255.252.0 | 1,024 | 1,019 | app tiers with autoscaling |
| /24 | 255.255.255.0 | 256 | 251 | the classic per-tier subnet |
| /26 | 255.255.255.192 | 64 | 59 | endpoint or firewall subnets |
| /28 | 255.255.255.240 | 16 | 11 | transit gateway attachment subnets |
Corrections A /28 holds 16 addresses, not 128. The five reserved addresses are the first four and the last one of every subnet, and the VPC router is the subnet base plus one.
Subnet design
Subnets group resources with the same exposure and the same routing. A subnet is public only because its route table sends 0.0.0.0/0 to an internet gateway; everything else is private.
fig 3 · one subnet per tier per AZ; a subnet never spans AZs, so resilience comes from repeating the pattern
| Subnet kind | Route to the internet |
|---|---|
| Public | 0.0.0.0/0 to the IGW; instances need a public IP or an Elastic IP to be reachable |
| Private | 0.0.0.0/0 to a NAT gateway: outbound only |
| Isolated | no default route; endpoints for AWS APIs |
| VPN-only | on-premises prefixes to a VGW or TGW, nothing else |
| Good practice | Why |
|---|---|
| Mirror every tier in at least two AZs | a subnet cannot span AZs; resilience comes from repetition |
| Name and tag by tier and AZ | app-private-a tells routing and owners at a glance |
| Leave room to grow | subnets cannot be resized; add a secondary CIDR if you must |
| Avoid tiny subnets | a /28 loses 5 of 16 addresses to AWS |
| Plan CIDRs across VPCs and sites | overlaps block peering and complicate VPN and TGW |
Public, private, Elastic and IPv6 addresses
| Address | Where from | Survives stop | Cost | Notes |
|---|---|---|---|---|
| Private IPv4 | the subnet’s range | yes | free | every ENI has a primary one; the OS only ever sees private addresses |
| Public IPv4 (auto) | Amazon’s pool, if the subnet or launch asks for one | no new one after stop | $0.005 per hour | mapped one-to-one to the private IP by the internet gateway |
| Elastic IP | allocated to your account (or BYOIP) | yes | $0.005 per hour, used or idle | move between instances or ENIs; 5 per Region by default |
| IPv6 | Amazon /56 for the VPC, or your own | yes | free | globally unique, no NAT; an egress-only IGW gives outbound-only |
| Elastic network interface (ENI) | Detail |
|---|---|
| What it carries | MAC address, primary and secondary private IPs, an Elastic IP per private IP, IPv6 addresses, security groups, source/destination check |
| Primary (eth0) | created with the instance, cannot be detached |
| Secondary ENIs | attach, detach and move to another instance in the same AZ; keeps its IPs and MAC |
| Uses | failover by moving the ENI, management networks, appliances, licences tied to a MAC |
| Public IP auto-assign | off by default on new subnets; turn it on per subnet or per launch |
Public IPv4 is no longer free Since 1 February 2024 every public IPv4 address costs $0.005 per hour, attached or not (750 free hours a month in the first year). Count them with Public IP Insights; prefer load balancers, endpoints and IPv6.
Route tables and routing
Every VPC has an implicit router. Route tables tell it where packets go: the destination is the network you want to reach, the target is the way there. A local route for the VPC CIDR is always present, so every subnet reaches every other subnet.
fig 4 · to change routing safely, build a new table, test it on one subnet, then make it the main table
fig 5 · the most specific route always wins; 0.0.0.0/0 only catches what nothing else matched
| Packet to | Routes that match | Chosen | Why |
|---|---|---|---|
| 10.0.1.1 | 10.0.0.0/16, 0.0.0.0/0 | local | /16 is more specific than /0 |
| 153.23.43.124 | 0.0.0.0/0 | internet gateway | only the default route matches |
| 192.168.10.10 | 192.168.0.0/16, 0.0.0.0/0 | VGW to the data center | /16 beats /0 |
| 192.168.1.1 | 192.168.1.0/24, 192.168.0.0/16, 0.0.0.0/0 | peering connection | /24 beats the VGW /16 and the IGW /0 |
| Rule | Detail |
|---|---|
| Longest prefix wins | the most specific matching route is used |
| Same prefix twice | static routes beat propagated ones |
| Main route table | used by every subnet without an explicit association |
| One table per subnet | a table may serve many subnets |
| Local route | cannot be deleted; since 2021 you can add more specific routes to send subnet-to-subnet traffic through an appliance |
| Gateway route table | an edge association on the IGW or VGW steers inbound traffic to a firewall |
| Quota | Default |
|---|---|
| Route tables per VPC | 200 |
| Static routes per table | 500, raisable to 1,000 (IPv4 and IPv6 counted apart) |
| Propagated routes per table | 100, fixed: advertise a summary or default route instead |
| Prefix lists | one route or rule for many CIDRs; counts by its max entries |
| Target | ID | Sends traffic to |
|---|---|---|
| Internet gateway | igw- | the internet, with one-to-one NAT for public IPs; scales without limit, one per VPC |
| Egress-only internet gateway | eigw- | the internet over IPv6, outbound only |
| NAT gateway | nat- | the internet from private subnets, outbound only |
| Virtual private gateway | vgw- | Site-to-Site VPN or Direct Connect for one VPC |
| Transit gateway | tgw- | other VPCs and sites through the regional hub |
| Peering connection | pcx- | one peered VPC |
| Gateway endpoint | vpce- via pl- | S3 or DynamoDB in the same Region |
| Network interface, GWLB endpoint | eni-, vpce- | a firewall or other appliance |
fig 6 · only subnets whose route table points at the VGW can reach the data center; the others stay local
VPC endpoints and endpoint services
Reach AWS services and other people’s services without the internet, a NAT gateway or public IPs. The traffic stays on the AWS network.
fig 7 · endpoints keep AWS API traffic on the AWS network and let private subnets work without a NAT gateway
| Type | How it works | Reach from | Cost |
|---|---|---|---|
| Gateway endpoint | a prefix-list route in chosen route tables; endpoint policy limits buckets or tables | the same VPC only | free |
| Interface endpoint (PrivateLink) | an ENI per subnet with a private IP and a security group; private DNS answers the normal service name | the VPC, peered VPCs, TGW, VPN and Direct Connect | per AZ-hour and per GB |
| Gateway Load Balancer endpoint | a route target that sends traffic through third-party appliances | route tables | per hour and per GB |
| Resource and service-network endpoints | VPC Lattice: reach a database or a whole service network privately | the VPC | per hour and per GB |
| Endpoint service (provider side) | publish your service behind an NLB or GWLB; consumers create interface endpoints; you approve them | other VPCs and accounts; other Regions since late 2024 | consumers pay their endpoints |
Correction S3 is no longer the only endpoint. Gateway endpoints exist for S3 and DynamoDB; almost every other service, and S3 too, has interface endpoints.
Network ACLs and security groups
fig 8 · traffic between two subnets crosses two NACLs and two security groups; inside one subnet only the security groups apply
| Aspect | Security group | Network ACL |
|---|---|---|
| Applies to | network interfaces (instances, endpoints, load balancers, RDS, Lambda in a VPC) | whole subnets, automatically |
| Rules | allow only | allow and deny |
| State | stateful replies always allowed | stateless replies need their own rule |
| Evaluation | all rules; any allow wins | in number order; first match wins; * denies the rest |
| Sources | CIDR, prefix list, or another security group | CIDR only |
| New one | no inbound, all outbound | denies everything |
| Default one | inbound from members of the same group, all outbound | allows everything |
| Quotas | 60 inbound and 60 outbound rules; 5 groups per ENI, up to 16 | 20 rules per direction, up to 40; one NACL per subnet |
| Use for | the real policy, per tier | coarse guardrails and explicit blocks of known-bad ranges |
fig 9 · NACLs are a coarse subnet guard: allow and deny, by number, without memory of connections
| Ephemeral (reply) ports | Range |
|---|---|
| Linux kernels | 32768-60999 |
| Windows Server 2008 and later | 49152-65535 |
| Load balancers, NAT gateway, Lambda | 1024-65535 |
| Safe NACL rule for replies | TCP 1024-65535 |
fig 10 · the NACL passed both requests; the security group, which only allows what it names, stopped the second
fig 11 · referencing groups instead of CIDRs keeps rules correct as instances come and go
Correction The limit of five security groups is per network interface, not per instance, and can be raised to 16 as long as groups times rules stays within 1,000.
NAT gateways
Private instances need outbound internet for patches and APIs. A NAT gateway rewrites their source address to its own public IP and lets only replies back in. Since November 2025 there are two kinds.
fig 12 · outbound only: return traffic for connections the instances opened comes back, new inbound connections never do
| Aspect | Zonal NAT gateway | Regional NAT gateway |
|---|---|---|
| Lives in | a public subnet in one AZ | the VPC; no public subnet needed |
| High availability | one per AZ, each AZ’s private route table pointing at its own | expands into every AZ where you have workloads (up to 60 minutes for a new AZ) |
| Routes | one route table per AZ | the same NAT ID in every private route table |
| Addresses | up to 8 IPs (2 Elastic IPs by default) | automatic or manual; up to 32 IPs per AZ |
| Private NAT (to other networks) | supported | not supported |
| Throughput | 5 Gbps, scaling to 100 Gbps (per AZ); 55,000 connections per IP to one destination | |
| NAT instance (legacy) | NAT gateway |
|---|---|
| an EC2 instance you size, patch and fail over yourself | managed, scales on its own |
| disable source/destination check; can have a security group; can be a bastion | no security group, no SSH |
| cheap for tiny workloads | per hour plus per GB processed; gateway endpoints for S3 and DynamoDB avoid that charge |
Reaching private instances
fig 13 · if you keep a bastion: one admin IP, no keys stored on it, and ProxyJump rather than agent forwarding
| Way in | Needs | Inbound port | Audit |
|---|---|---|---|
| Session Manager | SSM Agent, an instance role, endpoints or NAT | none | CloudTrail plus full session logs |
| EC2 Instance Connect Endpoint | one endpoint in the VPC; IAM permission | 22 or 3389 from the endpoint’s security group | CloudTrail |
| Client VPN | a Client VPN endpoint and certificates or SSO | whatever the SGs allow from the VPN range | connection logs |
| Bastion host | an instance in a public subnet with an Elastic IP | 22 from your IP to the bastion | your own |
# through a bastion without copying keys: ProxyJump (OpenSSH 7.3+) ssh -J [email protected] [email protected] # the old way: agent forwarding; anyone with root on the bastion can use your agent while you are connected ssh-add -c mykey.pem ssh -A [email protected] # no bastion at all: Instance Connect Endpoint, or Session Manager aws ec2-instance-connect ssh --instance-id i-0abc1234def567890 --connection-type eice aws ssm start-session --target i-0abc1234def567890
Site-to-Site VPN
An encrypted IPsec link over the internet between your network and AWS, ready in minutes. The AWS end is a virtual private gateway on one VPC or a transit gateway; your end is described by a customer gateway resource.
fig 14 · quick and cheap to set up, encrypted, but over the internet; two tunnels on different AWS endpoints for redundancy
| Piece | Detail |
|---|---|
| Customer gateway (CGW) | an AWS resource holding your device’s public IP (or a private IP over DX) and BGP ASN |
| Virtual private gateway (VGW) | the AWS end for one VPC; attach it, then route or propagate |
| Transit gateway as the AWS end | one VPN for many VPCs; ECMP across tunnels with BGP; Accelerated VPN through Global Accelerator |
| Tunnels | always two, on different AWS endpoints; configure both on your device |
| Bandwidth | 1.25 Gbps per tunnel (Standard); 5 Gbps per tunnel (Large, since November 2025) on transit gateway and Cloud WAN only |
| Routing | static prefixes, or BGP with route propagation into route tables |
| Keeping it up | set the tunnel startup action so AWS starts IKE; otherwise an idle tunnel can drop after about 10 seconds and needs keepalive traffic |
| For people, not sites | AWS Client VPN: OpenVPN-based remote access with certificate, AD or SAML login |
| Set up, in order | CLI |
|---|---|
| 1 describe your device | create-customer-gateway |
| 2 AWS end | create-vpn-gateway, attach-vpn-gateway (or use a TGW) |
| 3 the connection | create-vpn-connection |
| 4 your device | download the vendor config, bring both tunnels up |
| 5 routes | enable-vgw-route-propagation, or static routes |
| 6 firewalls | security groups allow the on-premises ranges |
Direct Connect
A dedicated, private circuit from your network to AWS through a Direct Connect location: steady latency and high bandwidth, but weeks to provision and not encrypted unless you add MACsec or a VPN.
fig 15 · a Direct Connect gateway lets one connection reach VPCs in many Regions; a transit VIF reaches transit gateways
| Item | Detail |
|---|---|
| Dedicated connection | 1, 10, 100 or 400 Gbps port |
| Hosted connection | 50 Mbps to 25 Gbps from a partner |
| Private VIF | to a VGW, or to a Direct Connect gateway |
| Public VIF | to AWS public endpoints such as S3 |
| Transit VIF | to transit gateways through a DX gateway |
| Encryption | MACsec on 10, 100 and 400 Gbps; or IPsec VPN over the VIF |
| Direct Connect gateway | Detail |
|---|---|
| Scope | global: one VIF reaches VGWs or transit gateways in many Regions |
| Not a router between VPCs | VPCs on it cannot talk to each other through it |
| SiteLink | connects your sites to each other over the AWS backbone |
| Resilience | two connections at two locations; four for the maximum model |
| Backup | a Site-to-Site VPN as failover is common and cheap |
| Choose | Site-to-Site VPN | Direct Connect |
|---|---|---|
| Path | the internet | private fiber |
| Time to set up | minutes | weeks |
| Bandwidth | 1.25 or 5 Gbps per tunnel | 50 Mbps to 400 Gbps |
| Latency | variable | consistent |
| Encryption | always (IPsec) | optional (MACsec or VPN on top) |
| Cost | low hourly plus data out | port hours plus lower data-out rates |
VPC peering
A private one-to-one link between two VPCs, in the same or different accounts and Regions. No gateway, no single point of failure, no bandwidth bottleneck; routing and firewalls stay yours.
fig 16 · a peering connection is a route target like any other; without the route in both directions nothing flows
fig 17 · each pair needs its own peering connection; n VPCs in full mesh need n(n-1)/2 of them
fig 18 · traffic stays on the AWS backbone, including between Regions; security groups and NACLs still apply on both ends
| Rule | Detail |
|---|---|
| Overlapping CIDRs | cannot be peered; a VPC may peer with two VPCs that overlap each other, but then needs more specific routes |
| Transitive routing | none: A-B and B-C do not give A-C |
| Edge-to-edge | none: a peer cannot use your IGW, NAT gateway, VPN, Direct Connect or gateway endpoint |
| Security groups | may reference groups in the peer VPC within the same Region |
| DNS | turn on DNS resolution to get private IPs for the peer’s public hostnames |
| Quotas | 50 active peerings per VPC, up to 125; an unanswered request expires after 168 hours |
| Cost | no hourly charge; data transfer only, free within one AZ |
Transit Gateway and other ways to connect
fig 19 · a transit gateway is regional; peer transit gateways for other Regions, or use Cloud WAN for a global network
| Option | Shape | Best for | Watch out |
|---|---|---|---|
| VPC peering | one-to-one | a few VPCs, lowest latency, no hourly cost | no transit, no overlap, mesh grows as n(n-1)/2 |
| Transit gateway | regional hub | dozens to thousands of VPCs, shared VPN and DX, segmentation with TGW route tables | per attachment-hour and per GB; peer TGWs across Regions |
| Cloud WAN | global, policy-driven | multi-Region networks managed as one | more to learn |
| PrivateLink | service exposure | one service to many consumers, even with overlapping CIDRs | one direction, one service per endpoint |
| VPC Lattice | application layer | service-to-service traffic with auth policies across VPCs and accounts | HTTP, gRPC and TCP services, not whole networks |
| Shared VPC (RAM) | one VPC, many accounts | central network team, app teams own their resources | owner controls routing and NACLs |
Flow logs, tools and network adapters
| Flow logs | Detail |
|---|---|
| Attach to | a VPC, a subnet, or one network interface (also TGW attachments) |
| Capture | accepted, rejected or all traffic; rejects show security group and NACL drops |
| Send to | CloudWatch Logs, S3 or Data Firehose |
| Aggregation | 10 minutes by default, or 1 minute |
| Change one | you cannot; delete it and create a new one (tags excepted) |
| Not recorded | queries to Amazon DNS, instance metadata (169.254.169.254), Time Sync, DHCP, Windows licence activation |
| Tool | Answers |
|---|---|
| Reachability Analyzer | can A reach B on this port, and which hop blocks it |
| Network Access Analyzer | which resources are reachable from the internet, or from places they should not be |
| VPC Block Public Access (Nov 2024) | account-wide switch: block internet ingress, or ingress and egress, with exclusions per VPC or subnet |
| Traffic Mirroring | copies packets from an ENI to an IDS |
| Network Firewall | managed stateful firewall and IPS in its own subnets |
| VPC wizard, “VPC and more” | builds VPC, subnets per AZ, IGW, NAT gateways (none, one, or one per AZ) and an S3 gateway endpoint in one go |
| Adapter | What it is | Use for |
|---|---|---|
| ENI | the virtual network card every instance has; eth0 is the primary | IPs, MAC, security groups, failover |
| ENA | enhanced networking with SR-IOV: higher bandwidth and packet rates, lower latency | current instance types use it by default |
| ENA Express | ENA with AWS SRD: up to 25 Gbps for a single flow between instances in one AZ | big transfers between instances |
| EFA | ENA plus OS-bypass for MPI and NCCL | tightly coupled HPC and ML training |
Networking fundamentals
fig 20 · OSI is the teaching model; TCP/IP is what networks run; security groups filter at layers 3 and 4
| IPv4 | Detail |
|---|---|
| Format | 4 octets, 32 bits: 192.168.0.1 |
| Network and host parts | split by the mask; the old class A, B, C split is obsolete |
| Netmask | a 1 bit for every network bit: /24 = 255.255.255.0 |
| CIDR | the same thing as a prefix length: 192.168.0.0/24 |
| Network, broadcast | the first and last address of a block, whatever the mask |
| Special ranges | 127.0.0.0/8 loopback, 169.254.0.0/16 link-local (instance metadata), 100.64.0.0/10 carrier NAT |
| IPv6 | Detail |
|---|---|
| Format | 128 bits, 8 groups of 4 hex digits |
| Shortening | drop leading zeros; :: replaces one run of zero groups |
| Anywhere | ::/0 |
| In AWS | VPC /56, subnet /64, no NAT, all addresses public |
| Outbound only | egress-only internet gateway |
| IPv6-only subnets | with DNS64 and NAT64 to reach IPv4 services |
fig 21 · the IGW does the same one-to-one swap for instances with public IPs; a NAT gateway shares one address among many
| Port | Protocol |
|---|---|
| 20, 21 | FTP data, FTP control |
| 22 | SSH, SFTP |
| 25, 587 | SMTP, submission |
| 53 | DNS (UDP, and TCP for large answers) |
| 80, 443 | HTTP, HTTPS |
| 110, 143 | POP3, IMAP |
| 123 | NTP |
| 3306, 5432, 1433 | MySQL, PostgreSQL, SQL Server |
| 3389 | RDP |
| 1024-65535 | ephemeral reply ports (see NACLs) |
| Command | Shows |
|---|---|
| ip a | interfaces and addresses (Windows: ipconfig) |
| ip route | the routing table (route print) |
| ping, traceroute | reachability and path (ICMP must be allowed) |
| dig, nslookup | DNS answers |
| ss -tlnp | listening ports (netstat -ano) |
| nc -zv host 443 | is a TCP port open (Test-NetConnection) |
| curl -v | a full HTTP exchange |
| DNS in a VPC | Detail |
|---|---|
| Route 53 Resolver | at the VPC base plus two and at 169.254.169.253; 1,024 packets per second per ENI |
| Private hosted zones | your own names, visible only in associated VPCs |
| Resolver endpoints | inbound and outbound endpoints for hybrid DNS with on-premises servers |
| DNS Firewall | block or allow domains for queries leaving your VPCs |
Corrections HTTP and FTP are application-layer (7) protocols, not layer 4; TCP and UDP (layer 4) split data into segments; IP and ICMP sit at layer 3. FTP uses port 21 for control and 20 for data. The private ranges are whole blocks: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
What changed since 2020
| In 2020 | Today |
|---|---|
| S3 is the only VPC endpoint | gateway endpoints for S3 and DynamoDB; interface endpoints for almost everything; cross-Region PrivateLink (late 2024) |
| Public IPv4 addresses are free while in use | $0.005 per hour for every public IPv4 address since February 2024 |
| 50 routes per route table | 500 by default, up to 1,000; propagated routes still capped at 100 |
| Up to 5 security groups per instance | 5 per network interface by default, up to 16 |
| A NAT gateway per AZ in a public subnet | also a regional NAT gateway with no public subnet (November 2025) |
| Bastion host with agent forwarding | Session Manager, or EC2 Instance Connect Endpoint (June 2023); ProxyJump if a bastion stays |
| Constant pings so the VPN does not drop | AWS-initiated tunnel startup; 5 Gbps tunnels on transit gateways (November 2025) |
| Direct Connect at 1 to 10 Gbps | 50 Mbps to 400 Gbps, MACsec, SiteLink |
| Transit Gateway is new | the standard hub; Cloud WAN for global networks; VPC Lattice for service traffic |
| Flow logs to CloudWatch Logs or S3 | also Data Firehose; 1-minute aggregation; TGW flow logs |
| No account-wide way to block internet access | VPC Block Public Access (November 2024) |
| IPv6 only as dual stack | IPv6-only subnets with DNS64 and NAT64 (2021) |
| The local route is untouchable | more specific routes can send subnet-to-subnet traffic through a firewall (2021) |
Checked against the AWS documentation for VPC quotas, VPC peering quotas, regional NAT gateways, Site-to-Site VPN tunnel options and 5 Gbps tunnels, Direct Connect features, public IPv4 pricing and VPC Block Public Access, and against the current AWS CLI models for the new API options.
0 comments