Route Tables

What are Route Tables?

Route tables are like GPS navigation systems for your network. They tell traffic where to go based on destination IP addresses. Every subnet in your VPC must be associated with a route table, which determines how traffic flows.

Think of route tables as road maps. When a packet arrives at a destination, the route table tells it which road to take — whether that's to the internet, to another subnet, or to a virtual private gateway.

Route Table Components

Each route has a destination (where traffic is going) and a target (where to send it). The most important routes in a typical VPC are:

Local route — handles traffic between subnets within the VPC. This is always present and can't be deleted. It's like the roads within your neighborhood.

Internet route — sends traffic to the internet gateway (0.0.0.0/0 → igw-xxx). This is what gives public subnets internet access.

NAT route — sends internet-bound traffic from private subnets to a NAT gateway (0.0.0.0/0 → nat-xxx). This lets private instances reach the internet without being directly accessible.

Creating a Route Table

You can create route tables through the console or CLI:

aws ec2 create-route-table --vpc-id vpc-0123456789abcdef0

aws ec2 associate-route-table \
  --route-table-id rtb-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0

aws ec2 create-route \
  --route-table-id rtb-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id igw-0123456789abcdef0

First create the route table, associate it with a subnet, then add routes. The order of routes matters — more specific routes take priority.

Public vs Private Route Tables

Public subnets use a route table with a route to the internet gateway. This allows instances with public IPs to communicate with the internet directly.

Private subnets use a route table with a route to a NAT gateway. Instances here can reach the internet (for updates, for example) but can't be reached from outside. This is the typical setup for application and database tiers.

Troubleshooting Routes

If your instance can't reach the internet, check the route table first. The most common issue is a missing internet gateway route or a misconfigured NAT gateway.

Use the tracert (Windows) or traceroute (Linux) command to see where packets are stopping. It's like following breadcrumbs to find where the path breaks. Most connectivity issues boil down to route table or security group misconfigurations.