Public vs Private Subnets

Public vs Private Subnets

In the world of cloud networking, particularly in platforms like AWS, the distinction between public and private subnets plays a vital role in designing a secure and well-architected infrastructure. Whether you're hosting a website, deploying a database, or managing internal services, choosing the right subnet type is key to controlling access and ensuring performance.

🌐 What Is a Subnet?

A subnet (short for subnetwork) is a segment of an IP network that allows you to partition a larger network into smaller, manageable pieces. In AWS, subnets are created inside a VPC (Virtual Private Cloud) and can be configured as public or private depending on your access requirements.

📤 What Is a Public Subnet?

A public subnet is a subnet whose instances can directly communicate with the internet. This is typically achieved by associating the subnet’s route table with an Internet Gateway (IGW) and assigning public IPs to instances.

Common Use Cases:

• Web servers
• Bastion hosts
• Proxies and load balancers

Example Route Table for a Public Subnet:

Destination     | Target
----------------|------------------
0.0.0.0/0       | igw-abc12345

🔒 What Is a Private Subnet?

A private subnet is one where the instances cannot directly access the internet. These are designed for resources that should not be exposed to the outside world. Private subnets use a NAT Gateway or NAT instance if outbound internet access is needed.

Common Use Cases:

• Databases (e.g., RDS)
• Application servers
• Internal APIs or microservices

Example Route Table for a Private Subnet:

Destination     | Target
----------------|------------------
0.0.0.0/0       | nat-abc12345

🔄 Key Differences Between Public and Private Subnets

⚙️ Sample VPC Configuration

// CIDR Block: 10.0.0.0/16

Public Subnet: 10.0.1.0/24
  - Route to Internet Gateway (igw-123456)

Private Subnet: 10.0.2.0/24
  - Route to NAT Gateway (nat-654321)

Using the above structure, you can host a website in the public subnet and connect it to a database placed safely in the private subnet — shielding your data from direct internet exposure.

🛡️ Best Practices for Subnet Design

• Use private subnets for sensitive resources like databases and internal services.
• Restrict security groups to limit traffic only to necessary ports and IP ranges.
• Enable logging and monitoring (e.g., VPC Flow Logs, CloudWatch) for visibility.
• Separate workloads using subnet layers for scalability and fault tolerance.

🚀 Conclusion

Understanding the core differences between Public vs Private Subnets helps you design secure, scalable, and cost-efficient architectures in cloud environments like AWS. While public subnets enable external communication, private subnets protect internal services from exposure. A balanced use of both leads to a robust network design.