Hack the Route Start free Open app Containers and cloud networking
Internet gateway and NAT gateway
The VPC's doors: one-to-one public IPs both ways through the internet gateway, and outbound-only overload through a NAT gateway.
The internet gateway maps each instance's public (elastic) IP to its private address, both ways: static NAT, held in the gateway, so the instance never sees its public address and the IP can move to another instance in a moment. An instance without one gets no internet, even in a public subnet. A NAT gateway sits in a public subnet with a public IP of its own and overloads (PAT) a private subnet onto it: replies come back, new connections from the internet do not. To join your own network, a site-to-site VPN (a virtual private gateway, IPsec over the internet) is quick and cheap; a direct connect (AWS Direct Connect, Azure ExpressRoute) is a private circuit with steady bandwidth and latency.