IP Routing

IP routing moves packets between networks by examining their destination IP addresses and selecting an appropriate next hop. A route normally identifies a destination address range, expressed as a CIDR prefix, and a forwarding target such as a gateway or network interface. Routers and cloud networking systems use routing information to decide where traffic should go; routing does not itself decide whether an application is authorized to receive that traffic.

When multiple routes match a destination, the most specific matching prefix generally wins. For example, a route for 10.20.0.0/16 takes precedence over a default route for 0.0.0.0/0 when the destination is 10.20.5.8. The default route handles IPv4 destinations without a more specific match. IPv6 uses separate routes, with ::/0 representing its default route. Configuring an IPv4 route does not automatically provide an equivalent IPv6 path.

In cloud networks, a virtual private network boundary contains subnets and routing configuration. In AWS, Amazon VPC provides this network boundary, and each subnet is associated with one subnet route table at a time. Without an explicit association, the subnet uses the VPC's main route table. Multiple subnets can share a route table. VPC route tables include local routes for communication within the VPC address ranges, although security controls can still block that communication.

AWS classifies a subnet as public when its route table has a direct route to an internet gateway. For direct IPv4 internet communication through that gateway, an instance also needs a public IPv4 address or Elastic IP address and appropriate security rules. Merely attaching an internet gateway to the VPC does not make every subnet public, and placing a resource in a public subnet does not automatically make it reachable from the internet.

A private subnet can support outbound IPv4 internet access by routing traffic to a public NAT gateway in a public subnet. The public subnet then routes internet traffic through an internet gateway. For example, application servers can download software updates without accepting unsolicited inbound internet connections through the NAT gateway. NAT translates addresses; routing selects the forwarding path. For IPv6, an egress-only internet gateway supports outbound-initiated internet communication without performing NAT.

Routing also connects cloud networks to other cloud networks and on-premises environments. Peering connections, transit gateways, VPNs, and dedicated connectivity provide different forwarding targets and network topologies. Static routes offer explicit control but require maintenance. Dynamic routing can distribute network reachability automatically, but introduces route propagation and policy considerations. Address planning matters because overlapping network ranges can prevent straightforward private connectivity.

Practical troubleshooting follows both the outbound and return paths. Check the source subnet's route table, the selected target, destination-side routing, and security controls. Security groups filter traffic at supported resource network interfaces, while network ACLs filter traffic at subnet boundaries; neither replaces routing. A valid route can still lead to blocked traffic, and an allow rule cannot create a missing route. Centralized gateways can simplify management, but their placement and design affect availability, traffic inspection, and processing or data-transfer costs.