# Internet Gateways and Public IPs — Cloud Networking: VPCs, Subnets & Peering

Source: https://www.skillbyai.com/en/cloud-networking/cn-igw

> Attach an internet gateway, add the default route and explain how public and Elastic IPs map to private addresses.

## The VPC's front door

An **internet gateway (IGW)** is a horizontally scaled, highly available component that you attach to a VPC to let it exchange traffic with the internet. You do not size it or place it in an AZ, and it is not a bottleneck you manage. For an instance to be reachable it needs three things: a route `0.0.0.0/0 -> igw-...` in its subnet's route table, a **public IPv4 address**, and firewall rules that allow the traffic. Interestingly, the instance's operating system never sees its public address. The network interface only has the private IP; the IGW performs a one-to-one translation between the public and private address as packets pass through. A public IP auto-assigned at launch can change when the instance stops and starts. An **Elastic IP** is a static public address you allocate to your account and associate with an instance or NAT gateway, useful when partners must allow-list your address.

## Wiring up an internet gateway

Create the gateway, attach it to the VPC and add the default route to the public subnet's route table. IDs are placeholders.

```bash
IGW=$(aws ec2 create-internet-gateway --query 'InternetGateway.InternetGatewayId' --output text)
aws ec2 attach-internet-gateway --internet-gateway-id "$IGW" --vpc-id vpc-0123456789abcdef0

# Default route for the PUBLIC subnet's route table only
aws ec2 create-route \
  --route-table-id rtb-0aaaaaaaaaaaaaaaa \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id "$IGW"
```

## Run ip addr on a public instance

Students expect to see the public IP on `eth0`. You will only see the private address. Query the instance metadata service or the console to find the public one; the translation happens outside the VM.

**Quiz:** An instance has a public IPv4 address, but its subnet's route table has only the local route. What happens to inbound traffic from the internet?

- [ ] It reaches the instance normally
- [ ] It is routed through the NAT gateway
- [x] The instance is unreachable from the internet
- [ ] It is redirected to the default VPC

*Answer:* The instance is unreachable from the internet. Without a route to an internet gateway there is no path between the internet and the subnet, so the public address is useless.