Internet Gateway

You've created a VPC. You've set up subnets, assigned IP ranges, launched instances. But none of them can reach the internet. Nobody on the internet can reach them. Your VPC is a sealed box.

An Internet Gateway is the bridge. It connects your VPC to the public internet, enabling two-way communication for resources in public subnets. Without it, your web servers can't serve traffic, your APIs can't receive requests, and your load balancers can't distribute incoming connections.

It sounds simple, and it is. An Internet Gateway is one of the least complex components in cloud networking. But understanding where it fits in the routing chain matters, because misconfiguring the route table is the number one reason developers spend hours debugging "why can't my instance reach the internet."

An Internet Gateway performs two functions:

1. Route target: It appears in your route table as the target for internet-bound traffic. A public subnet's route table contains a rule like:

The first rule keeps VPC-internal traffic local. The second rule sends everything else to the Internet Gateway.

2. NAT for public IPs: When an instance with a public IP sends traffic through the IGW, the gateway translates the private IP to the public IP (and vice versa for return traffic). This is a 1:1 static NAT, different from the many-to-one NAT that NAT Gateway performs.

Key characteristics:

• Horizontally scaled, redundant, and highly available by design, you don't manage capacity
• No bandwidth constraints, it scales automatically
• Free, there's no hourly charge (unlike NAT Gateway)
• One per VPC, you attach a single IGW to a VPC
• Only enables internet access for resources with public or Elastic IPs

What an IGW does NOT do: It doesn't make private subnet resources internet-accessible. If an instance has no public IP and its subnet has no route to the IGW, the Internet Gateway is irrelevant to it.