An internet gateway is a horizontally scaled, provider-managed component of cloud networking that attaches to a virtual private cloud (VPC) and gives its resources a path to and from the public internet. It serves as the target of a default route, typically 0.0.0.0/0 for IPv4 and ::/0 for IPv6, and performs one-to-one translation between private addresses and the public addresses assigned to instances.
The term is most closely associated with AWS, where it is an explicit resource, but every major cloud provides the same function. In Azure and Google Cloud, internet access is handled by system routes and the default internet gateway rather than by a resource that users attach by hand.
How an internet gateway routes traffic
An internet gateway works only together with route tables and public addresses. A subnet becomes a public subnet when its route table sends internet-bound traffic to the gateway; a subnet without that route remains private even if the VPC has a gateway attached.
For IPv4, an instance never sees its public address on its own network interface. When it sends a packet to the internet, the gateway rewrites the private source address to the associated public IPv4 or Elastic IP address, and reverses the translation for replies. This is static one-to-one NAT, not the many-to-one port translation that a NAT gateway performs. For IPv6, addresses are globally routable, so the gateway forwards packets without translation.
| Requirement | Where it is configured | What fails without it |
|---|---|---|
| Gateway attached to the VPC | VPC resource | No internet path exists at all |
| Default route to the gateway | Subnet route table | Traffic stays inside the VPC |
| Public IPv4 or IPv6 address | Instance or network interface | No translatable source address |
| Permissive security group | Instance-level firewall | Packets dropped at the instance |
| Permissive network ACL | Subnet-level filter | Packets dropped at the subnet edge |
A VPC can have only one internet gateway attached at a time, and the gateway is highly available by design: there is no instance to size, patch or place in an availability zone, and it imposes no bandwidth limit of its own.
Internet gateway compared with neighboring components
An internet gateway is one of several edge components that move traffic in and out of a VPC. Each answers a different question about direction, address type and destination, and confusing them is a common design error.
| Component | Direction | Translation | Typical purpose |
|---|---|---|---|
| Internet gateway | Inbound and outbound | One-to-one for IPv4 | Public subnets, internet-facing hosts |
| NAT gateway / Cloud NAT | Outbound only | Many-to-one with ports | Private subnets reaching updates and APIs |
| Egress-only internet gateway | Outbound only, IPv6 | None | Private IPv6 workloads |
| VPN gateway | Both, to a named peer | Usually none | Encrypted link to on-premises networks |
| Transit gateway | Between networks | None | Hub for many VPCs and connections |
| Private endpoint | To a specific service | None | Reaching cloud services without the internet |
Note that a managed NAT gateway itself sits in a public subnet and sends its traffic through the internet gateway. Private instances therefore reach the internet in two hops: private subnet to NAT gateway, then NAT gateway to internet gateway.
Designing public and private subnets
The standard pattern is to expose as little as possible through the internet gateway. Only components that must accept connections from the internet belong in public subnets, and everything else stays private behind them.
| Workload | Subnet type | Internet path |
|---|---|---|
| Public load balancer | Public | Inbound via internet gateway |
| Application servers | Private | Outbound via NAT, inbound via load balancer |
| Databases | Private, isolated | None, or private endpoints only |
| Bastion host | Public, tightly filtered | Inbound SSH from known ranges |
| NAT gateway | Public | Outbound via internet gateway |
Many organizations now replace bastion hosts with session manager or identity-aware proxy services, which remove the need for any inbound administrative port. A useful rule of thumb is that a database with a public IP address is a design defect, regardless of firewall rules.
Cost, logging and security considerations
An internet gateway usually has no hourly charge, but traffic leaving the cloud through it is billed as data transfer out, often called egress fees. On some providers, public IPv4 addresses are now billed per hour, which makes address inventory a cost topic as well as a security one.
- Flow visibility: VPC flow logs record accepted and rejected connections at the interface level, which is the main evidence for traffic through the gateway.
- Filtering: the gateway does not inspect traffic; filtering is the job of security groups, network ACLs and cloud firewalls.
- Centralized inspection: some architectures route internet traffic through an inspection VPC with firewall appliances instead of giving every VPC its own gateway.
- Guardrails: organization policies can forbid attaching internet gateways to sensitive accounts entirely.
Common mistakes and troubleshooting
Most connectivity incidents involving an internet gateway come from one missing link in the chain rather than from the gateway itself. The table maps typical symptoms to their usual cause.
| Symptom | Likely cause | Fix |
|---|---|---|
| Instance unreachable from the internet | No public address assigned | Associate a public or Elastic IP |
| Outbound traffic times out | Route table lacks the default route | Add a route to the internet gateway |
| Private instances cannot update | No NAT path | Add a NAT gateway and private route |
| Only replies are blocked | Stateless ACL missing ephemeral ports | Allow ports 1024 to 65535 outbound |
| Unexpected exposure of a service | Resource placed in a public subnet | Move it to a private subnet |
Explained without jargon
A cloud network is like a private office building with no doors to the street. An internet gateway is the main entrance that connects the building to the outside world.
Having the entrance is not enough on its own. Each room also needs signs pointing to the door, which are the routes, and a public street address, so that visitors can find it. Rooms without those signs stay private, which is exactly how sensitive systems such as databases are kept away from the internet.
A typical use case
An online store runs in a VPC with the address range 10.0.0.0/16. Two public subnets, one per availability zone, hold the load balancer and a NAT gateway, and their route tables send 0.0.0.0/0 to the internet gateway. Six application servers and a database cluster sit in private subnets with no public addresses.
Customers reach the load balancer through the internet gateway, the load balancer forwards requests to the application servers, and those servers download security patches through the NAT gateway. When an auditor scans the public address space, only ports 80 and 443 on the load balancer respond, and the database is not reachable from the internet at all.