Route tables, and why there is no NAT

In 1 minute

A route table is a list of rules: for this destination address, send the packet there. The public route table sends 0.0.0.0/0 (everything outside the VPC) to the internet gateway. The private route table has only the local route, so the private subnets stay inside the VPC. MiniTickets has no NAT gateway; that saves about 30+ USD a month.

Picture it

flowchart LR
  subgraph PUB["public route table"]
    L1["10.0.0.0/16 → local"]
    D1["0.0.0.0/0 → internet gateway"]
  end
  subgraph PRIV["private route table"]
    L2["10.0.0.0/16 → local"]
  end
  D1 --> IGW["minitickets-dev-igw"] --> NET((Internet))

How it works

1. Every route table has the local route. 10.0.0.0/16 → local means any address inside the VPC is reachable. AWS adds it by itself.
2. The most specific route wins. A packet to 10.0.10.5 matches both /16 local and /0; the /16 is more specific, so it stays inside the VPC.
3. An internet gateway connects the VPC to the internet, but only for resources with a public IP, and only if a security group rule allows the traffic.
4. A NAT gateway would let private resources call out without a public IP. Postgres and Valkey never start outbound connections, so they do not need one.

In MiniTickets

Both tables are made in infra/src/network.ts → createNetwork: minitickets-dev-public-rt (associated with both public subnets) and minitickets-dev-private-rt (both private subnets). The gateway is minitickets-dev-igw.

How the tasks reach AWS services without a NAT: they run in the public subnets with a public IP, so ECR, Secrets Manager, CloudWatch Logs and SNS are reached through the internet gateway, over HTTPS. The other common fix, VPC endpoints, also costs money per hour and per zone.

From → to	What happens	What allows it
Public subnets → Public route table	both public subnets use this route table	route route table associations minitickets-dev-public-rta-1 and -2createNetwork
Public route table → Internet gateway	traffic for the internet leaves through the internet gateway	route route 0.0.0.0/0 → minitickets-dev-igw (next to the local route 10.0.0.0/16)createNetwork

See stage 2 on the map →

See it in AWS

Console

VPC → Route tables → minitickets-dev-public-rt → Routes: 0.0.0.0/0 → igw-…, Status Active. Then Subnet associations.

CLI

aws ec2 describe-route-tables --filters Name=tag:Name,Values=minitickets-dev-public-rt

Code

infra/src/network.ts → createNetwork

Break it

Symptom	Cause	Where to look
The site times out from every network	The 0.0.0.0/0 route is missing or Blackhole	Public route table → Routes
One zone works, the other does not	A public subnet is not associated with the public table	Subnet associations
A task moved to a private subnet cannot pull its image	No NAT and no VPC endpoint	Private route table: local only

Say it in an interview

Say it like this (20-30 seconds)

Each subnet has a route table. The public one has the local route and 0.0.0.0/0 to the internet gateway; the private one has only the local route, which is what makes it private. There is no NAT gateway: the Fargate tasks sit in public subnets with public IPs and reach ECR and Secrets Manager through the internet gateway. That saves about 30 dollars a month, at the price of public task IPs.

Follow-ups

When would you add a NAT gateway?

When tasks must run in private subnets, for example a policy that no compute has a public IP. Then each zone needs a NAT gateway (or VPC endpoints for the AWS services the tasks call).

What is the difference between a NAT gateway and an internet gateway?

An internet gateway lets resources with a public IP talk in both directions. A NAT gateway lets resources with only a private IP start connections out, and blocks connections in.

What happens if the internet gateway is detached?

The 0.0.0.0/0 route becomes Blackhole. Visitors time out, and new tasks cannot pull images or read secrets, so they fail to start.

Advanced: Why VPC endpoints were not chosen

Interface endpoints for ECR (two), Secrets Manager, CloudWatch Logs and SNS would each be billed per hour per availability zone, and S3 needs a gateway endpoint. For one dev task that is more than the task itself costs. The public-IP design keeps the bill small; the security groups do the protecting.

Checkpoint

Answer these without scrolling up. If one feels hard, reread that section.

1. Which route does every route table have?
2. Which route wins when two match?
3. What two more things does traffic need besides the 0.0.0.0/0 route?
4. How do the tasks reach ECR without a NAT gateway?
5. Why do Postgres and Valkey not need any way out?

Redraw it from memory: the two route tables, their routes, and the internet gateway

Try this: in the AWS console or on the map, find the one route that makes the public subnets public

Mark this page as read