What is Internet gateway?
In the cloud networking world, if your VPC is a private island, the Internet Gateway (IGW) is the bridge that connects it to the mainland.
Without an Internet Gateway, your VPC is completely isolated—secure, but cut off from the world. Once you attach an IGW, your VPC gains the ability to talk to the public internet and, more importantly, let the internet talk to it.
An Internet Gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet.
Think of your VPC as a high-security office building:
The Building (VPC): It has internal hallways and rooms where employees work.
The Internet Gateway: This is the Main Entrance. It’s a two-way door. Employees can walk out to get lunch (Outbound), and clients can walk in for meetings (Inbound).
The Security Guard: You still have a security guard (Security Groups/NACLs) at the door, but the IGW is the physical portal that makes the entrance possible.
An IGW acts as a destination in your VPC’s Route Table. When a server wants to reach a website (like https://www.google.com/search?q=google.com), the route table says: "I don't know where that is locally, so send it to the Internet Gateway." ### 2. One-to-One NAT (The Translator)
Your servers inside the VPC use Private IP addresses (like 10.0.1.5). The public internet cannot understand these.
When a server sends data out, the IGW maps its Private IP to its Public IP address.
When a reply comes back from the internet, the IGW remembers which server it belongs to and translates the Public IP back to the Private one.
This is the most common point of confusion for cloud beginners. Here is the breakdown:
| Feature | Internet Gateway (IGW) | NAT Gateway |
| Traffic Type | Two-Way (Inbound & Outbound) | One-Way (Outbound Only) |
| Primary Use | Public-facing servers (Websites, APIs) | Private servers (Updates, Patches) |
| Initiation | The internet can start a connection to you. | The internet cannot start a connection to you. |
| Cost | Usually Free to create. | Usually Paid (Hourly + Data fees). |
Simply creating an Internet Gateway doesn't make your VPC public. You have to follow these three steps:
Create and Attach: Create the IGW and "hook" it to your VPC.
Add the Route: Update your Subnet’s Route Table to point all "External" traffic (0.0.0.0/0) to the IGW ID.
Assign Public IPs: Your servers must have a Public IP (or Elastic IP). Even with a bridge, you can't cross if you don't have a "valid passport" (a public address).
Unlike a physical router in your home, you don't have to worry about an Internet Gateway "crashing" or getting "overwhelmed."
It is software-defined.
It scales automatically to handle as much bandwidth as you throw at it.
It is redundant across the entire region, so if one data center has an issue, the "bridge" stays standing.
The Internet Gateway is the backbone of the "Public Subnet." It is the essential tool for any resource that needs to be seen by the world—whether that’s a web server, a load balancer, or a bastion host. It provides the connectivity, but it leaves the security up to you.