Internet Gateways and Public IPs

The VPC's front door

An internet gateway (IGW) is a horizontally scaled, highly available component that you attach to a VPC to let it exchange traffic with the internet. You do not size it or place it in an AZ, and it is not a bottleneck you manage. For an instance to be reachable it needs three things: a route 0.0.0.0/0 -> igw-... in its subnet's route table, a public IPv4 address, and firewall rules that allow the traffic. Interestingly, the instance's operating system never sees its public address. The network interface only has the private IP; the IGW performs a one-to-one translation between the public and private address as packets pass through. A public IP auto-assigned at launch can change when the instance stops and starts. An Elastic IP is a static public address you allocate to your account and associate with an instance or NAT gateway, useful when partners must allow-list your address.

Wiring up an internet gateway

Create the gateway, attach it to the VPC and add the default route to the public subnet's route table. IDs are placeholders.

IGW=$(aws ec2 create-internet-gateway --query 'InternetGateway.InternetGatewayId' --output text)
aws ec2 attach-internet-gateway --internet-gateway-id "$IGW" --vpc-id vpc-0123456789abcdef0

# Default route for the PUBLIC subnet's route table only
aws ec2 create-route \
  --route-table-id rtb-0aaaaaaaaaaaaaaaa \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id "$IGW"

Run ip addr on a public instance

Students expect to see the public IP on eth0. You will only see the private address. Query the instance metadata service or the console to find the public one; the translation happens outside the VM.

Quick check: An instance has a public IPv4 address, but its subnet's route table has only the local route. What happens to inbound traffic from the internet?

• It reaches the instance normally
• It is routed through the NAT gateway
• The instance is unreachable from the internet
• It is redirected to the default VPC