Internet Gateway for public access in AWS - Deep Dive

Overview - Internet Gateway for public access

What is it?

An Internet Gateway is a virtual device in a cloud network that allows resources inside a private network to communicate with the internet. It acts like a door that lets data flow in and out between your cloud network and the wider internet. This is essential for making servers or services publicly accessible. Without it, your cloud resources would be isolated and unreachable from outside.

Why it matters

Without an Internet Gateway, your cloud resources cannot connect to the internet or be accessed by users worldwide. This means websites, applications, or APIs hosted in the cloud would be invisible to the public. The Internet Gateway solves this by providing a secure and controlled path for internet traffic, enabling real-world use cases like websites, online stores, or public APIs.

Where it fits

Before learning about Internet Gateways, you should understand basic cloud networking concepts like Virtual Private Clouds (VPCs) and subnets. After mastering Internet Gateways, you can explore related topics like Route Tables, Network Access Control Lists (ACLs), and Security Groups to control traffic flow and security.

Mental Model

Core Idea

An Internet Gateway is the cloud network's front door that lets your private resources talk to the internet safely and openly.

Think of it like...

Imagine your cloud network as a gated community. The Internet Gateway is the main gate that opens to the outside world, allowing visitors in and residents to leave, while keeping control over who comes and goes.

┌─────────────────────┐
│     Internet        │
└─────────┬───────────┘
          │
   ┌──────▼───────┐
   │Internet      │
   │Gateway (IGW) │
   └──────┬───────┘
          │
┌─────────▼─────────┐
│   VPC (Private    │
│   Network)        │
│ ┌───────────────┐ │
│ │Public Subnet  │ │
│ │(with IGW)     │ │
│ └───────────────┘ │
│ ┌───────────────┐ │
│ │Private Subnet │ │
│ │(no IGW)       │ │
│ └───────────────┘ │
└───────────────────┘

Build-Up - 6 Steps

1

Foundation

What is an Internet Gateway

Concept: Introduce the basic idea of an Internet Gateway as a bridge between a private cloud network and the internet.

An Internet Gateway (IGW) is a component in cloud networking that connects your private cloud network (called a VPC) to the internet. It allows resources inside your VPC to send and receive traffic from the internet. Without it, your cloud resources cannot be accessed publicly or reach the internet themselves.

Result

You understand that an IGW is necessary for public internet access from your cloud network.

Knowing that an IGW acts as the essential link to the internet helps you see why public cloud services need it to be reachable.

2

Foundation

Role of Subnets with Internet Gateway

Concept: Explain how subnets inside a VPC relate to the Internet Gateway for public access.

Inside a VPC, you have subnets which are smaller network sections. Only subnets that are 'public' have routes pointing to the Internet Gateway. This means only resources in these public subnets can send and receive internet traffic directly. Private subnets do not have this route and remain isolated from the internet.

Result

You can distinguish between public and private subnets based on their routing to the IGW.

Understanding subnet roles clarifies how cloud networks control which resources are public or private.

3

Intermediate

How Routing Enables Internet Access

🤔Before reading on: Do you think adding an Internet Gateway alone makes resources public, or is routing also needed? Commit to your answer.

Concept: Introduce the concept of route tables directing traffic to the Internet Gateway for public subnets.

An Internet Gateway alone does not make resources public. You must also update the route table of a subnet to send internet-bound traffic (0.0.0.0/0) to the IGW. This tells the network where to send outgoing internet traffic and how to receive responses. Without this route, traffic won't flow through the IGW.

Result

You know that both an IGW and proper routing are required for internet access.

Knowing that routing controls traffic flow prevents the common mistake of assuming IGW alone is enough.

4

Intermediate

Security Controls with Internet Gateway

🤔Before reading on: Do you think an Internet Gateway automatically makes your resources safe from attacks? Commit to your answer.

Concept: Explain that security groups and network ACLs work alongside the IGW to protect resources.

Even with an Internet Gateway, your resources are protected by security groups and network ACLs. These act like guards deciding who can enter or leave your network. The IGW only provides the path; security controls decide what traffic is allowed. Without proper security settings, your resources could be exposed to unwanted access.

Result

You understand that IGW enables access but security controls enforce safety.

Recognizing the separation of access path and security helps you design safer cloud networks.

5

Advanced

NAT Gateway vs Internet Gateway

🤔Before reading on: Do you think private subnets use Internet Gateways directly for internet access? Commit to your answer.

Concept: Introduce the difference between Internet Gateways and NAT Gateways for private subnet internet access.

Private subnets cannot use an Internet Gateway directly because they have no route to it. Instead, they use a NAT Gateway, which sits in a public subnet with an IGW. The NAT Gateway allows private resources to access the internet for updates or downloads without exposing them to inbound internet traffic. This keeps private resources secure while still allowing outbound internet access.

Result

You can differentiate when to use IGW and when to use NAT Gateway.

Understanding this distinction is key to designing secure and functional cloud networks.

6

Expert

Internet Gateway Internals and Scaling

🤔Before reading on: Do you think an Internet Gateway is a single physical device or a scalable cloud service? Commit to your answer.

Concept: Explain how the Internet Gateway is a horizontally scaled, redundant service managed by the cloud provider.

An Internet Gateway is not a single physical device but a highly available, horizontally scaled service managed by AWS. It automatically scales to handle traffic without user intervention. It also supports both IPv4 and IPv6 traffic. This design ensures reliability and performance for public internet access without the user managing hardware or scaling.

Result

You appreciate the robustness and scalability of the IGW service.

Knowing the IGW is a managed, scalable service helps you trust it for production workloads and avoid over-engineering.

Under the Hood

The Internet Gateway acts as a target for route tables in public subnets. When a resource sends traffic to an internet address, the route table directs it to the IGW. The IGW then translates the private IP address of the resource to a public IP address (via NAT for instances without public IPs) and sends the traffic to the internet. Incoming responses are routed back through the IGW to the resource. This process involves network address translation and routing managed by AWS infrastructure.

Why designed this way?

AWS designed the Internet Gateway as a horizontally scalable, redundant service to avoid single points of failure and to simplify user management. By separating routing (route tables) from the gateway device, AWS allows flexible network design. Alternatives like physical gateways would be less scalable and harder to manage. The IGW also supports both IPv4 and IPv6 to future-proof connectivity.

┌───────────────┐       ┌───────────────┐
│  Private IP   │──────▶│ Internet      │
│  (Instance)   │       │ Gateway (IGW) │
└──────┬────────┘       └──────┬────────┘
       │ NAT (if no pub IP)         │
       ▼                           ▼
┌───────────────┐           ┌───────────────┐
│ Public IP     │◀──────────│ Internet      │
│ (Elastic IP)  │           │               │
└───────────────┘           └───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does attaching an Internet Gateway alone make all VPC resources public? Commit to yes or no.

Common Belief: Attaching an Internet Gateway automatically makes all resources in the VPC accessible from the internet.

Reality: Only resources in subnets with route tables directing traffic to the IGW and with proper security settings are accessible. Simply attaching the IGW does not expose all resources.

Why it matters: Assuming IGW alone exposes resources can lead to false security assumptions or misconfigurations causing unexpected access or outages.

Quick: Can private subnets use an Internet Gateway directly for internet access? Commit to yes or no.

Common Belief: Private subnets can use the Internet Gateway directly to access the internet.

Reality: Private subnets cannot route traffic directly to the IGW; they must use a NAT Gateway or NAT instance in a public subnet to access the internet.

Why it matters: Misunderstanding this leads to failed internet access from private resources and confusion during troubleshooting.

Quick: Does the Internet Gateway provide security controls like firewalls? Commit to yes or no.

Common Belief: The Internet Gateway acts as a firewall and controls what traffic is allowed in and out.

Reality: The IGW only routes traffic; security groups and network ACLs enforce security policies. The IGW itself does not filter traffic.

Why it matters: Relying on IGW for security can leave resources exposed and vulnerable to attacks.

Quick: Is the Internet Gateway a single physical device you must manage? Commit to yes or no.

Common Belief: The Internet Gateway is a physical device that users must configure and maintain.

Reality: The IGW is a managed, scalable cloud service provided by AWS, requiring no user maintenance or hardware management.

Why it matters: Expecting to manage hardware leads to unnecessary complexity and misunderstanding of cloud services.

Expert Zone

1

The Internet Gateway supports both IPv4 and IPv6 traffic, but routing and security must be configured separately for each protocol.

2

An IGW does not perform source/destination checks on instances, unlike NAT instances, which affects how traffic flows and security is managed.

3

When using multiple IGWs in complex architectures (like VPC peering or Transit Gateway), routing and traffic flow become more intricate and require careful planning.

When NOT to use

Do not use an Internet Gateway for private subnets that require outbound internet access without inbound exposure; use a NAT Gateway instead. Also, for hybrid cloud setups requiring VPN or Direct Connect, use Virtual Private Gateway or Transit Gateway rather than IGW.

Production Patterns

In production, Internet Gateways are paired with route tables and security groups to expose only necessary resources publicly, such as web servers. NAT Gateways handle outbound internet for private resources. Monitoring and logging are enabled on IGW traffic for security audits. Multi-AZ deployments ensure high availability.

Connections

Network Address Translation (NAT)

Builds-on

Understanding how IGW works with NAT Gateways clarifies how private resources securely access the internet without direct exposure.

Firewall Rules

Complementary

Knowing that IGW only routes traffic while firewalls control access helps separate concerns in network security design.

Urban Planning and City Gates

Analogous

City gates control who enters and leaves a city, similar to how IGWs control internet access, highlighting the importance of controlled entry points in complex systems.

Common Pitfalls

#1 Assuming attaching an Internet Gateway alone makes resources public.

Wrong approach:

aws ec2 attach-internet-gateway --internet-gateway-id igw-123456 --vpc-id vpc-123456
# No route table update

Correct approach:

aws ec2 attach-internet-gateway --internet-gateway-id igw-123456 --vpc-id vpc-123456
aws ec2 create-route --route-table-id rtb-123456 --destination-cidr-block 0.0.0.0/0 --gateway-id igw-123456

Root cause:

Misunderstanding that routing must explicitly send traffic to the IGW for internet access.

#2 Trying to route private subnet traffic directly to the Internet Gateway.

Wrong approach:

Route table for private subnet:
Destination: 0.0.0.0/0 -> Target: igw-123456

Correct approach:

Route table for private subnet:
Destination: 0.0.0.0/0 -> Target: nat-123456 (NAT Gateway in public subnet)

Root cause:

Not knowing that private subnets cannot use IGW directly and require NAT for outbound internet.

#3 Relying on Internet Gateway for security filtering.

Wrong approach:

No security groups or network ACLs configured, assuming IGW blocks unwanted traffic.

Correct approach:

Configure security groups and network ACLs to allow only desired traffic; IGW only routes traffic.

Root cause:

Confusing routing function of IGW with security enforcement.

Key Takeaways

An Internet Gateway is essential for enabling public internet access to cloud resources within a VPC.

Simply attaching an Internet Gateway is not enough; route tables must direct traffic to it for public subnets.

Security groups and network ACLs work alongside the IGW to protect resources from unwanted access.

Private subnets cannot use the Internet Gateway directly and require NAT Gateways for outbound internet access.

The Internet Gateway is a managed, scalable cloud service that handles routing and translation without user maintenance.