Network Isolation & AWS VPC Architecture: Subnets, CIDR Sizing, and NAT Gateways

Building secure, scalable cloud infrastructure requires isolating critical system components from public exposure. In cloud platforms like AWS, a Virtual Private Cloud (VPC) isolates virtual networks into Public and Private Subnets.

Public subnets expose user-facing services (e.g., web UIs) to the internet, while private subnets isolate backend services and databases. Communication between these layers—and safe outbound access from private resources—is managed through Network Address Translation (NAT) Gateways and precise CIDR range allocations.

1. Network Isolation: Public vs. Private Subnets

Placing all infrastructure resources (servers, applications, databases) directly on the public internet leaves them vulnerable to unauthorized access and network tampering. Isolation ensures that only necessary entry points are reachable from the outside world.

Internet (Public Users)
   |
   | Inbound Traffic
   v
Public Subnet (Web UI / Reverse Proxy)
   |
   | Internal Communication
   v
Private Subnet (Backend Logic / Databases)

• Public Subnet: Contains resources that must be directly accessible from the internet (e.g., web application frontends, load balancers, public API gateways). Instances in a public subnet possess public IPv4 addresses.
• Private Subnet: Contains sensitive internal resources (e.g., application servers, databases, payment processing engines) that must never accept direct inbound traffic from the internet. Resources in a private subnet receive only private IP addresses (e.g., 10.0.x.x).

Conceptually: While a public frontend (like a web UI) must reside in a public subnet to accept user traffic, it must communicate internally with backend components residing safely inside private subnets.

2. IP Allocation & CIDR Range Sizing

To assign unique IP addresses to devices across public and private subnets, networks rely on Classless Inter-Domain Routing (CIDR) notation. CIDR defines an IP address range using a network prefix mask.

The total number of available IPv4 addresses in a given CIDR block is calculated as:

Where $P$ is the CIDR prefix length.

Sizing Examples

• /32 Prefix:

Allocates exactly **1 IP** address (typically assigned to a single specific host or elastic interface).

• /31 Prefix:

Allocates **2 IPs** (useful for point-to-point links or small 2-device public subnets).

• /30 Prefix:

Allocates **4 IPs** (suitable for a tiny sub-network housing up to 4 devices).

• /25 Prefix:

Allocates **128 IPs** for mid-sized subnets.

• /16 Prefix:

Allocates **65,536 IPs**, standard for an entire parent VPC block (e.g., `10.0.0.0/16`).

CIDR Range Comparison Matrix

3. Core Mental Model: The Hotel & Kitchen Analogy

Understanding how private components safely interact with public networks requires a clear mental model.

Real-Life Analogy

Imagine visiting a hotel restaurant to order food (e.g., Dal Makhani):

• The Dining Hall (Public Subnet): This is where public customers sit, view the menu card, and interact.
• The Kitchen (Private Subnet): This is where the meal is prepared. Customers cannot walk directly into the kitchen to grab food; doing so would violate security, hygiene, and operational bounds.
• The Waiter / Order Workflow (NAT Gateway): Customers select Dal Makhani from the public menu and place an order with the waiter. The waiter carries the order into the private kitchen, retrieves the cooked meal, and delivers it back to the customer.

The kitchen stays isolated from direct public access, while the waiter (NAT Gateway) acts as the bridge translating public requests into private execution safely.

4. NAT Gateway Architecture & Traffic Flow

A Network Address Translation (NAT) Gateway is a managed service residing in a public subnet. It acts as an intermediary bridge for private subnet instances.

Core Responsibilities of a NAT Gateway

1. Outbound Internet Access: Allows instances in a private subnet to reach out to the internet (e.g., downloading OS patches, pulling third-party software packages, making external API calls).
2. Inbound Blockade: Prevents external internet sources from initiating direct inbound connections to instances in the private subnet.
3. IP Consolidation: Translates multiple private IP addresses from internal instances into a single public IP address visible to the outside world.

5. Availability Zones (AZs) and Subnet Allocation Strategy

To ensure high availability and fault tolerance, cloud providers organize infrastructure into Regions and Availability Zones (AZs).

The Apple Store Analogy

• Region: Represents an entire geographical area (e.g., ap-south-1 in Mumbai).
• Availability Zones: Represent distinct, physically separated data center facilities within that region (like multiple authorized Unicorn / Apple Stores across a city).
• Subnets: Individual network spaces defined inside each AZ. A single retail store (AZ) has a public storefront (Public Subnet) and internal inventory storage (Private Subnets).

Subnet Sizing Calculation

When designing a multi-AZ VPC:

• If you configure 3 Availability Zones:
  • 3 Public Subnets are provisioned (1 per AZ for frontend services).
  • 3 to 6 Private Subnets are provisioned (e.g., 1 application tier + 1 database tier per AZ).
  • Total Subnets: $3 \text{ Public} + 3 \text{ Private} = 6 \text{ Subnets}$ total.

6. Hands-On Walkthrough: Creating an AWS VPC

Here is the architectural workflow for creating a custom VPC in the AWS Management Console:

7. Subnet & Networking Component Reference

8. Real-World Engineering & Debugging Considerations

1. NAT Gateway Cost Overhead:

   • Issue: Provisioning a NAT Gateway in every Availability Zone incurs hourly running costs and data transfer charges.
   • Resolution: In development/testing environments, deploy a single NAT Gateway across AZs to save costs. In production, maintain 1 NAT Gateway per AZ for fault tolerance.

2. Route Table Misconfiguration:

   • Issue: Instances in a private subnet cannot download software packages or reach external endpoints.
   • Resolution: Verify the private subnet's Route Table. Ensure the default route (0.0.0.0/0) points to the NAT Gateway ID (nat-xxxxxxxxx), not directly to the Internet Gateway (igw-xxxxxxxxx).

3. CIDR Block Overlap:

   • Issue: VPCs cannot be peered with on-premises corporate networks or other cloud VPCs if their IP ranges overlap.
   • Resolution: Avoid using standard default home ranges like 192.168.0.0/16 if corporate networks use them; select distinct private blocks such as 10.0.0.0/16 or 172.16.0.0/16.

Summary and Key Takeaways

• Public vs. Private Isolation: Never place backend databases or core internal logic in public subnets. Keep public interfaces isolated in public subnets and backend systems in private subnets.
• CIDR IP Sizing: Subnet sizing uses CIDR notation based on $2^{(32 - P)}$. /32 grants 1 IP, /30 grants 4 IPs, /25 grants 128 IPs, and /16 grants 65,536 IPs.
• NAT Gateway Functionality: A NAT Gateway sits in a public subnet and translates private instance IP addresses, allowing private resources to initiate outbound requests while blocking uninvited inbound internet traffic.
• The Hotel/Kitchen Analogy: Public subnets operate like a restaurant dining hall, private subnets operate like the private kitchen, and NAT Gateways act as the waiter facilitating orders safely.
• Multi-AZ Resilience: Distributing subnets across multiple Availability Zones prevents single-point-of-failure outages for cloud applications.
• Subnet Multiples: Choosing 3 Availability Zones with paired public/private tiers automatically provisions 6 distinct subnets (3 public + 3 private).
• Domain Routing Readiness: Enabling DNS hostnames and DNS resolution inside AWS VPC settings is required to route custom web domains to instances inside the VPC.