title: “VPC Route Tables” created: 2026-07-22 updated: 2026-07-22 type: knowledge tags:

• aws
• certification
• networking
• vpc

VPC Route Tables

What It Is

A Route Table is a set of rules (routes) that determine where network traffic from a subnet is directed. Every subnet must be associated with exactly one route table.

Why It Matters

Route tables are the mechanism that defines whether a subnet is public or private. They control all traffic flow within and out of the VPC. Misconfigured routes are a common cause of connectivity failures.

Key Concepts

Route Structure

Each route has two parts:

Route Evaluation

Routes are evaluated from most specific (longest prefix / biggest number after /) to least specific:

1. 10.0.0.0/16 → local (more specific, matches VPC traffic first)
2. 0.0.0.0/0 → igw or nat (catch-all for everything else)

The most specific matching route wins.

Public Subnet Route Table

Private Subnet Route Table

Main Route Table

• Every VPC has a main route table automatically
• Subnets without an explicit association use the main route table
• Best practice: leave the main route table restrictive (no IGW route) and explicitly associate public subnets with a custom route table

The local Route

• Automatically present in every route table
• Cannot be removed or modified
• Ensures all subnets within the VPC can communicate with each other

Gotchas

• A subnet can only be associated with one route table at a time
• Multiple subnets can share the same route table
• The local route is immutable — you cannot block intra-VPC traffic via route tables (use NACLs or security groups instead)
• Adding a route to 0.0.0.0/0 → igw effectively makes the associated subnet public

See Also

• [[vpc-subnets]]
• [[vpc-internet-gateway]]
• [[vpc-nat-gateway]]
• [[vpc-fundamentals]]
• [[cidr-notation]]