Route Tables and Longest-Prefix Match

How a VPC decides where a packet goes

Every subnet is associated with exactly one route table; a route table can serve many subnets. Each route has a destination CIDR and a target, such as local, an internet gateway (igw-...), a NAT gateway (nat-...), a peering connection (pcx-...) or a transit gateway (tgw-...). Every VPC route table contains a local route for the VPC's own CIDR, which lets all subnets in the VPC reach each other; you cannot delete it. When several routes match a destination, the VPC picks the most specific one, meaning the longest prefix. So with routes for 10.1.0.0/16 and 10.1.5.0/24, traffic to 10.1.5.9 follows the /24. The default route 0.0.0.0/0 matches everything, so it is used only when nothing more specific does. Routing decides the path; it does not allow or deny traffic. Firewalls (security groups and network ACLs) make that decision separately.

Tracing a route lookup

This toy lookup mirrors the VPC router: collect every matching route, then keep the one with the longest prefix.

import ipaddress

routes = [
    ("10.0.0.0/16", "local"),
    ("10.1.0.0/16", "pcx-peer"),
    ("10.1.5.0/24", "tgw-attach"),
    ("0.0.0.0/0", "nat-gw"),
]

def lookup(dst):
    ip = ipaddress.ip_address(dst)
    matches = [(ipaddress.ip_network(c), t) for c, t in routes if ip in ipaddress.ip_network(c)]
    best = max(matches, key=lambda m: m[0].prefixlen)
    return best[1]

print(lookup("10.0.3.9"))
print(lookup("10.1.5.9"))
print(lookup("142.250.1.1"))

1. Line 3: The table has a local route, a peering route, a more specific transit gateway route inside the peering range, and a default route.
2. Line 16: First lookup: 10.0.3.9. Only the local /16 and the default /0 contain it.
3. Line 13: The longest prefix wins, so /16 beats /0 and the packet stays inside the VPC.
4. Line 17: 10.1.5.9 matches the peering /16, the transit /24 and the default route. Three candidates.
5. Line 13: /24 is the most specific, so the packet goes to the transit gateway, not the peer.
6. Line 18: A public address matches only the default route, so it leaves through the NAT gateway.

The same lookup, run for real

Running the snippet confirms the trace.

import ipaddress

routes = [
    ("10.0.0.0/16", "local"),
    ("10.1.0.0/16", "pcx-peer"),
    ("10.1.5.0/24", "tgw-attach"),
    ("0.0.0.0/0", "nat-gw"),
]

def lookup(dst):
    ip = ipaddress.ip_address(dst)
    matches = [(ipaddress.ip_network(c), t) for c, t in routes if ip in ipaddress.ip_network(c)]
    best = max(matches, key=lambda m: m[0].prefixlen)
    return best[1]

print(lookup("10.0.3.9"))
print(lookup("10.1.5.9"))
print(lookup("142.250.1.1"))

Output:

local
tgw-attach
nat-gw

Routes are one-way

A route in VPC A towards VPC B does nothing for the reply. The return path needs its own route in B's route table. 'It works one way only' is almost always a missing return route.

त्वरित जाँच: A route table has 10.0.0.0/16 -> local, 10.2.0.0/16 -> pcx-1, 10.2.4.0/22 -> tgw-1 and 0.0.0.0/0 -> igw. Where does traffic to 10.2.6.4 go?

• pcx-1
• tgw-1
• igw
• local