Learn
AWS
Networking & content delivery
Internet Gateway

AWSGCP laterAzure later

Internet GatewayAmazon VPC internet gateway

Networking & content deliveryCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

The door between a VPC and the internet. A subnet whose route table points at it is a public subnet.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalMEDSysOps Administrator – AssociateHIGHSecurity – SpecialtyMED

Where Internet Gateway takes you6 steps, all open

I know the problem it solves
I can picture it
I know how it scales
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

The way in and out

An internet gateway connects a VPC to the internet, for IPv4 and IPv6. It is horizontally scaled, redundant and highly available, so it adds no availability risk and no bandwidth limit to your traffic.

It does two jobs. It is the target in a route table for internet-bound traffic, and for IPv4 it translates one to one between an instance's private address and its public one. A subnet whose route table sends traffic to it is a public subnet.

There is no charge for an internet gateway itself; data transfer to and from the internet is charged.

Reach for it when

customers must reach a load balancer or an instance
resources with public addresses need to reach the internet
IPv6 traffic must flow in and out

It is the wrong tool when

private instances only need to get out: that is a NAT gateway
IPv6 instances need to get out but not be reached: that is an egress-only internet gateway
the traffic is only to S3 or DynamoDB: that is a gateway endpoint

Mental model

The front gate, and the porter who swaps addresses

Visitors can only find a flat that has a street address, and residents can only leave through the gate if there is a sign pointing to it. The porter at the gate swaps the street address for the flat number on the way in, and back again on the way out.

The front gatethe internet gatewayInternet gateway

A sign to the gatea route to it0.0.0.0/0

A street addressa public IPv4 or Elastic IP addressPublic IPv4

The porterswaps street address and flat numberOne-to-one NAT

A flat with no signa private subnetNo route

How it works

Four things before anything gets through

Attach itAn internet gateway does nothing until it is attached to a VPC.
Route to itAdd a route for 0.0.0.0/0, or ::/0 for IPv6, to the subnet's route table. That makes the subnet public.
Give out addressesEach resource needs a public IPv4 or Elastic IP address. IPv6 addresses are public already.
Allow it throughThe security group and the network ACL still have to allow the traffic.

Availability: Redundanthorizontally scaled
Bandwidth limit: Noneit imposes none
IPv4 translation: 1 : 1private to public address
IPv6, out only: Egress-only IGWstateful, IPv6 only

Component	Default VPC	A VPC you create
Internet gateway	Yes	No
Route for 0.0.0.0/0 to it	Yes	No
Public IPv4 address on launch	Yes, in default subnets	No

Architecture

From a customer's browser to a web server

Only the load balancer has a public address. The web servers have no route to the internet gateway at all.

Only the load balancer needs a public address. The web servers sit in private subnets with no route to the internet gateway; the load balancer reaches them over the VPC's own network, and that is the only way in. Fewer public IPv4 addresses also means a smaller bill.

Traffic simulation

Follow a customer's request in

A public address
The internet can only reach an instance with a public IPv4 or Elastic IP address.
Internet gateway
Translates the public address to the instance's private address and delivers it into the VPC.
Network ACL, inbound
The subnet's rules, lowest number first.
Security group, inbound
Only allow rules: the port must be allowed from this source.
The reply's route out
The subnet's route table must send internet traffic back to the internet gateway.

Pick a case to follow the request through each check.

Security

Where the filtering happens

Filter at the resource and the subnet. Security groups on each resource and network ACLs on each subnet decide what traffic arriving through the internet gateway may reach it.

Hand out as few public addresses as you can. Put resources in private subnets and let a load balancer be the only public face.

Connect without a public address. EC2 Instance Connect Endpoint reaches an instance from the internet with no public IPv4 address on it.

Cost

How you are charged, not what it costs today

The gateway itself is free. There is no charge for an internet gateway.

Data transfer is charged for traffic between your instances and the internet.

Every public IPv4 address is charged by the hour, whether it was assigned to a running instance at launch or is an Elastic IP address, in use or idle.

Prices change, so none are printed here. Check the VPC and EC2 pricing pages on aws.amazon.com.

Comparison

Four ways out of a VPC

Option	Traffic	Who can start a connection	Charged	Choose it when
Internet gateway	IPv4 and IPv6	Either side	No; data transfer is	Resources must be reachable from the internet
Egress-only internet gateway	IPv6 only	Only your instances	No; data transfer is	IPv6 instances need out, not in
NAT gateway	IPv4, and IPv6 to IPv4 with NAT64	Only resources inside the VPC	By the hour and by the GB processed	Private IPv4 instances need out
Gateway endpoint	To S3 and DynamoDB	Only your instances	No	Private access to S3 or DynamoDB

SAA traps

The phrase in the question, and what it means

what makes a subnet publicA route to an internet gateway in its route table

Nothing else does: not its name, and not the instances in it.

the instance is in a public subnet but cannot be reachedIt has no public IPv4 address

The internet gateway translates only for instances with a public IPv4 or Elastic IP address.

IPv6 instances must reach the internet, but not be reached from itAn egress-only internet gateway

Stateful and IPv6 only. For IPv4 the same job is a NAT gateway.

an instance with an Elastic IP cannot reach the internetIts subnet has no route to the internet gateway

A public address is not enough without the route.

is the internet gateway a single point of failureNo

It is horizontally scaled, redundant and highly available, with no bandwidth constraint.

reduce the number of public IPv4 addressesOne load balancer in front, instances in private subnets

Every public IPv4 address is charged; a load balancer uses just its own.

Scenario

Exam style, marked when you answer

A developer creates a new VPC without the console wizard, adds a subnet, and launches a web server into it with a public IPv4 address. Its security group allows HTTPS from anywhere, but browsers time out when they try to reach it. What should the developer do?

Practice

Fill the gap, the way the challenges work

Customers on the internet must reach a load balancer in public subnets, which sends their requests on to web servers in private subnets. What connects the VPC to the internet?

Web client· CustomersPick a service belowALB· Load balancerEC2· Web servers

Quick revision

The night before the exam

Public subnet: Its route table sends 0.0.0.0/0 to an internet gateway.
Public address: Needed for IPv4: a public IPv4 or Elastic IP address.
Translation: One-to-one NAT between private and public IPv4 addresses.
Availability: Horizontally scaled and redundant: never the bottleneck.
IPv6, out only: An egress-only internet gateway.
Cost: The gateway is free; data transfer and public IPv4 addresses are not.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Next: NAT GatewayLets instances in private subnets connect out, while nothing outside can start a connection to them.

Open NAT Gateway

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.