Cloud · Visual Explainer
Public vs Private vs Hybrid Subnets
The concept
The servers in all three subnets are identical. The only difference is the route table. Public routes 0.0.0.0/0 to an Internet Gateway. Private routes it to a NAT Gateway. Hybrid routes corporate ranges to a Virtual Private Gateway over VPN or Direct Connect.
Key distinctions
| Term | What it means |
|---|---|
| Public subnet | Route: 0.0.0.0/0 → Internet Gateway. Home to load balancers, bastion hosts, and the NAT Gateway itself. |
| Private subnet | Route: 0.0.0.0/0 → NAT Gateway. Outbound only, nothing reaches in. Home to app servers and databases. |
| Hybrid subnet | Route: 10.0.0.0/8 → Virtual Private Gateway. Reaches on-premises over an encrypted tunnel — where AD-joined systems live. |
| The lesson | Same VPC, same servers — only the route table makes them different. The NAT Gateway itself lives in a public subnet, which surprises people. |
Why it matters in practice
Routing decides what is reachable at all, before security groups ever come into play. This is the foundation every AWS architecture rests on.