What Is the Difference Between a Public and Private Subnet?
Understand the difference between public and private subnets in AWS VPC, how route tables decide it, and how NAT gateways enable safe outbound access.
Expected Interview Answer
A public subnet has a route to an internet gateway so its resources can be reached directly from the internet, while a private subnet has no such route and stays isolated from direct inbound internet traffic.
In a VPC, subnets themselves are not inherently public or private — the route table attached to them decides that. A public subnet's route table sends 0.0.0.0/0 traffic to an internet gateway, so instances with a public IP can be reached directly. A private subnet's route table instead sends outbound traffic (if any) to a NAT gateway sitting in a public subnet, letting it reach the internet for updates without accepting inbound connections. This pattern puts load balancers and bastion hosts in public subnets while databases and application servers sit in private subnets, shrinking the attack surface.
- Limits direct internet exposure to only the resources that need it
- Keeps databases and backend services unreachable from outside
- Lets private resources still reach the internet outbound via NAT
- Supports defense-in-depth alongside security groups and NACLs
- Maps cleanly to compliance requirements for segmented networks
AI Mentor Explanation
A public subnet is like the boundary rope where anyone can walk up and interact with fielders, while a private subnet is the dressing room reachable only through the players' tunnel. The route table is the pass system deciding who gets tunnel access, and a NAT gateway is a manager who steps outside to fetch supplies without letting outsiders wander into the dressing room itself.
Step-by-Step Explanation
Step 1
Subnets get their identity from routing, not naming
A subnet is 'public' only because its route table points 0.0.0.0/0 to an internet gateway.
Step 2
Internet gateway enables two-way traffic
Resources with a public IP in a public subnet can send and receive traffic directly from the internet.
Step 3
Private subnets route outbound through NAT
A NAT gateway placed in a public subnet lets private-subnet instances reach out for updates without accepting inbound connections.
Step 4
Place resources by exposure need
Load balancers and bastion hosts go public; databases, caches, and internal APIs go private.
Step 5
Layer additional controls
Security groups and network ACLs add further restriction on top of the routing-based public/private split.
What Interviewer Expects
- Explains that the route table, not a subnet flag, determines public vs private
- Knows the internet gateway is required for a subnet to be public
- Understands the role of a NAT gateway for private subnet outbound access
- Can describe a typical architecture: public load balancer, private app/database tier
- Mentions security groups/NACLs as complementary controls
Common Mistakes
- Thinking a subnet is public or private by some inherent AWS setting
- Forgetting that a public IP alone does not make a subnet public without a route to an internet gateway
- Confusing a NAT gateway with an internet gateway
- Putting databases directly in public subnets for convenience
Best Answer (HR Friendly)
“A public subnet can be reached directly from the internet, which is where you'd put things like a website's load balancer. A private subnet stays hidden from the internet and is where sensitive resources like databases live, though they can still reach out to download updates through a controlled gateway.”
Code Example
resource "aws_route_table" "public" {
vpc_id = aws_vpc.main.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.igw.id
}
}
resource "aws_route_table" "private" {
vpc_id = aws_vpc.main.id
route {
cidr_block = "0.0.0.0/0"
nat_gateway_id = aws_nat_gateway.nat.id
}
}Follow-up Questions
- What does a NAT gateway do and how is it different from an internet gateway?
- How would you design subnets across multiple Availability Zones?
- What is the role of network ACLs versus security groups here?
- How would a bastion host fit into this subnet design?
- What happens to a private instance's outbound traffic if the NAT gateway fails?
MCQ Practice
1. What actually determines whether a subnet is public or private in AWS?
A subnet is public only if its route table sends internet-bound traffic to an internet gateway.
2. Which component allows a private subnet's instances to reach the internet for outbound-only traffic?
A NAT gateway, placed in a public subnet, lets private instances initiate outbound connections without accepting inbound ones.
3. Where would you typically place an application load balancer in a standard two-tier VPC design?
Load balancers that need to accept internet traffic are placed in public subnets.
Flash Cards
What makes a subnet public in AWS? — Its route table sends 0.0.0.0/0 traffic to an internet gateway.
How does a private subnet get outbound internet access? — Through a NAT gateway sitting in a public subnet.
Where do databases typically live? — In private subnets, isolated from direct internet access.
What's the difference between an internet gateway and a NAT gateway? — An internet gateway allows two-way traffic; a NAT gateway only allows outbound-initiated traffic from private resources.