AWS Networking Basics
AWS networking is the same networking you already know, renamed: a VPC is your network, subnets segment it, route tables steer traffic, security groups are stateful firewalls and an Internet Gateway is your edge router. Here is the full mapping.
The translation table
| On-prem concept | AWS equivalent |
|---|---|
| Your network / VLANs | VPC (Virtual Private Cloud) + subnets |
| Router + default route | Route tables + Internet Gateway |
| NAT for private hosts | NAT Gateway |
| Stateful firewall on a host | Security Group |
| ACL on a subnet boundary | Network ACL (stateless) |
| DNS server | Route 53 |
| Site-to-site VPN / leased line | VPN Gateway / Direct Connect |
| Inter-site links | VPC Peering / Transit Gateway |
If you know subnetting, routing tables and ACLs, you already understand 80% of AWS networking — the skills transfer directly.
The VPC building blocks
- VPC — an isolated network you define with a CIDR block (e.g. 10.0.0.0/16).
- Subnets — carve the VPC per availability zone; public subnets route to an Internet Gateway, private ones don't.
- Route tables — attached to subnets; a 0.0.0.0/0 route to the IGW is what makes a subnet public.
- NAT Gateway — lets private-subnet instances reach out to the internet without being reachable from it — exactly like PAT at home.
Security groups vs NACLs — the exam-favourite difference
Security groups are stateful and apply per instance: allow the inbound request and the reply is automatically allowed. Network ACLs are stateless and apply per subnet: you must allow both directions explicitly, with numbered rules evaluated in order — behaviourally just like a Cisco ACL.
Hybrid connectivity
Connecting your on-prem network to AWS: Site-to-Site VPN (IPsec over the internet — quick, cheaper) or Direct Connect (a dedicated private circuit — consistent latency, higher cost). Multiple VPCs interconnect via peering (two networks) or a Transit Gateway (hub-and-spoke at scale). This is where enterprise network engineers add cloud to their skill set — see the cloud network engineer career guide.
Frequently asked questions
What is a VPC in AWS?
A Virtual Private Cloud — an isolated virtual network you define with a CIDR block, divided into subnets, with route tables controlling traffic flow. It is the AWS equivalent of your on-prem network.
What is the difference between a security group and a NACL?
Security groups are stateful, instance-level firewalls — replies to allowed traffic are automatically permitted. NACLs are stateless, subnet-level filters where both directions must be explicitly allowed, like a traditional ACL.
What makes an AWS subnet public or private?
Its route table. A subnet whose route table sends 0.0.0.0/0 to an Internet Gateway is public; one without that route (often using a NAT Gateway for outbound) is private.
Do networking skills transfer to AWS?
Directly. Subnetting, routing, NAT, ACLs and VPNs are the exact concepts AWS networking is built on — a CCNA-level foundation makes cloud networking far easier to learn.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.