Lesson 05 — Route Tables

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 04 – Amazon VPC & Network Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand what Route Tables are.
Explain how routing works inside an Amazon VPC.
Create and manage Route Tables.
Associate Route Tables with Subnets.
Configure routes using the AWS Console and AWS CLI.
Verify routing in an enterprise AWS environment.

📚 Lesson Information

Estimated Time: 90 Minutes

Difficulty: Beginner

Prerequisites: Lesson 04 – Public & Private Subnets

Hands-on Lab: Yes

💼 Business Value

Imagine building a city with roads but no signboards.

People would have no idea how to reach:

Office Buildings
Hospitals
Schools
Shopping Centres

Eventually, traffic would stop.

Cloud networking works exactly the same way.

Every packet travelling inside AWS needs instructions telling it where to go.

Those instructions are stored inside Route Tables.

Without Route Tables:

Applications cannot communicate.
Servers cannot reach the Internet.
Databases become inaccessible.
Load Balancers cannot forward requests.

🏢 CloudNova Scenario

CloudNova has created the following network.

CloudNova-VPC

10.10.0.0/16

│

├── Public Subnet

10.10.1.0/24

│

├── Private App Subnet

10.10.2.0/24

│

└── Private DB Subnet

10.10.3.0/24

However…

No applications can communicate.

The reason?

No routing has been configured.

As a Cloud Security Engineer, your next task is to create Route Tables.

🌍 What is a Route Table?

A Route Table is a collection of rules that tells AWS where network traffic should go.

Each subnet must be associated with one Route Table.

Every Route Table contains one or more routes.

Each route has:

Destination
Target

Example:

Destination

↓

Target

↓

Where traffic should go

📦 Components of a Route

Component	Description
Destination	IP Address or CIDR Range
Target	Where traffic is forwarded

Example:

Destination	Target
10.10.0.0/16	Local
0.0.0.0/0	Internet Gateway

🏗 Enterprise Example

Public Subnet

↓

Public Route Table

↓

Internet Gateway

↓

Internet

Private subnet

Private Subnet

↓

Private Route Table

↓

NAT Gateway

↓

Internet

Database subnet

Private DB

↓

Private Route Table

↓

Local Communication Only

🌐 Local Route

Every Route Table automatically contains:

Destination

10.10.0.0/16

↓

Target

Local

This route allows communication between resources inside the VPC.

Never delete this route.

🌍 Public Route

To allow Internet access:

Destination

0.0.0.0/0

↓

Internet Gateway

This sends all non-local traffic to the Internet Gateway.

🔒 Private Route

Private Subnets should not connect directly to the Internet.

Instead they use:

0.0.0.0/0

↓

NAT Gateway

Applications receive outbound Internet access while remaining inaccessible from the Internet.

🏗 CloudNova Enterprise Architecture

Internet

│

Internet Gateway

│

──────────────

Public Route Table

│

Public Subnet

↓

Application Load Balancer

↓

──────────────

Private Route Table

↓

Private App Subnet

↓

EC2

↓

──────────────

Private Route Table

↓

Private DB Subnet

↓

Amazon RDS

🛠 Lab 01 — View Existing Route Tables

Step 1

Open

AWS Console

↓

VPC

Step 2

Navigate to

Route Tables

Step 3

Review

Route Table Name
VPC
Routes
Associated Subnets

🛠 Lab 02 — Create Public Route Table

Navigate to

Route Tables

↓

Create Route Table

Example

Setting	Value
Name	Public-RT
VPC	CloudNova-VPC

Click

Create Route Table

Add Internet Route

Select

Public-RT

↓

Routes

↓

Edit Routes

↓

Add Route

Configure

Destination	Target
0.0.0.0/0	Internet Gateway

Save Changes.

Associate Public Subnet

Navigate to

Subnet Associations

↓

Edit

Select

Public-Subnet-A

Save.

🛠 Lab 03 — Create Private Route Table

Create another Route Table.

Example

Setting	Value
Name	Private-RT
VPC	CloudNova-VPC

Associate Private Subnets

Associate:

Private-App-A
Private-DB-A

At this stage, do not add a default Internet route.

Later, after creating a NAT Gateway, you will update this Route Table.

💻 AWS CLI Lab

List Route Tables

aws ec2 describe-route-tables

Create Public Route Table

aws ec2 create-route-table \
  --vpc-id vpc-xxxxxxxx

Add Name Tag

aws ec2 create-tags \
  --resources rtb-xxxxxxxx \
  --tags Key=Name,Value=Public-RT

Create Internet Route

aws ec2 create-route \
  --route-table-id rtb-xxxxxxxx \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id igw-xxxxxxxx

Associate Route Table

aws ec2 associate-route-table \
  --subnet-id subnet-xxxxxxxx \
  --route-table-id rtb-xxxxxxxx

Create Private Route Table

aws ec2 create-route-table \
  --vpc-id vpc-xxxxxxxx

Tag Private Route Table

aws ec2 create-tags \
  --resources rtb-yyyyyyyy \
  --tags Key=Name,Value=Private-RT

Associate Private Subnet

aws ec2 associate-route-table \
  --subnet-id subnet-yyyyyyyy \
  --route-table-id rtb-yyyyyyyy

View Route Tables

aws ec2 describe-route-tables

View Specific Route Table

aws ec2 describe-route-tables \
  --route-table-ids rtb-xxxxxxxx

✅ Verify

Confirm:

Public Route Table

10.10.0.0/16 → Local

0.0.0.0/0 → Internet Gateway

Private Route Table

10.10.0.0/16 → Local

(No Internet route yet.)

🔍 Troubleshooting

Problem

EC2 cannot access the Internet.

Possible causes

Internet Gateway missing.
Incorrect Route Table.
Route Table not associated.
Wrong subnet.

Problem

Wrong Route Table associated.

Solution

Navigate to:

Route Tables

↓

Subnet Associations

↓

Edit

Associate the correct subnet.

Problem

Internet route missing.

Solution

Verify:

0.0.0.0/0

↓

Internet Gateway

exists in the Public Route Table.

🏢 Enterprise Notes

CloudNova standards:

Separate Route Tables for Public and Private Subnets.
Never expose database subnets directly to the Internet.
Use clear naming conventions.
Review Route Tables during security audits.
Document all routing decisions.
Minimise unnecessary outbound routes.

🚫 Common Mistakes

❌ Associating a Private Subnet with a Public Route Table.

❌ Forgetting to associate a Route Table with a Subnet.

❌ Sending database traffic directly to the Internet.

❌ Using one Route Table for every subnet without considering security requirements.

❌ Deleting the Local route.

🧪 DIY Challenge

Using your AWS account:

Create:

Public-RT
Private-RT

Associate:

Public-Subnet-A → Public-RT
Private-App-A → Private-RT
Private-DB-A → Private-RT

Configure:

Public Route Table

10.10.0.0/16 → Local

0.0.0.0/0 → Internet Gateway

Verify:

Route Tables created.
Correct subnet associations.
Local route present.
Internet route configured only for the Public Route Table.

Take screenshots of:

Route Tables
Routes
Subnet Associations
AWS CLI output (describe-route-tables)

📊 Knowledge Check

What is a Route Table?
What is the purpose of the Local route?
What does the destination 0.0.0.0/0 represent?
Which Route Table should be associated with a Public Subnet?
Which Route Table should be associated with a Private Subnet?
Can a subnet be associated with more than one Route Table at the same time?
Which AWS CLI command lists Route Tables?
Why shouldn’t database subnets use a Public Route Table?
What happens if no Route Table is associated with a subnet?
Why are Route Tables important in enterprise cloud networking?

💡 Key Takeaways

After completing this lesson, you should understand:

Route Tables determine how network traffic flows within an Amazon VPC.
Every subnet must be associated with a Route Table.
Public Route Tables use an Internet Gateway for outbound internet access.
Private Route Tables typically use a NAT Gateway for secure outbound connectivity.
Proper routing is essential for building secure, scalable and enterprise-ready AWS networks.

🚀 Next Lesson

➡️ Lesson 06 — Internet Gateway & NAT Gateway