Routing & Gateways

The board that answers a question every network has to answer somehow: when something wants to leave, which door does it use, and who decided that? The board’s closing line is the one to keep: “‘Public’ and ‘private’ aren’t hardware - they’re which gateway your default route points at.”

Before you start. You need to know what a VPC and a subnet are: a network you control, fenced off from everyone else’s, cut into smaller pieces you can treat differently - that’s what VPC & Subnets gave you. Nothing else. Everything here is one small table, read carefully.

The idea in 30 seconds

A room is public only if its logbook sends “anywhere at all” through the door that opens onto the street. No flag, no switch - just that one entry.
The logbook is called a route table, and every room has exactly one, even if nobody assigned it on purpose.
The street door (internet gateway) is a straight, two-way connection. The mailroom (NAT gateway) swaps addresses on the way out and remembers how to route the reply home, and nobody outside can start a conversation through it.
When more than one entry matches, the tightest-fitting one wins - that’s longest-prefix match - never the order they’re written in.
Every building has a hallway nobody can lock: the local route, covering its own address range, undeletable and nearly unbeatable.
The logbook decides which door. It never decides whether the door lets you through - that’s a different lesson.

Read the story · Skip to the numbers