Public and Private Subnets

The difference is the route table

An internet gateway connects a VPC to the internet for resources with public IPs. A NAT gateway lets private resources make outbound connections (to download packages or call APIs) without being reachable from outside.

Spread across availability zones

Create one public and one private subnet in each of two or three availability zones, and one NAT gateway per zone, so losing a zone doesn't take your outbound traffic with it.

import ipaddress

vpc = ipaddress.ip_network("10.20.0.0/16")
zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
blocks = vpc.subnets(new_prefix=20)

layout = []
for tier in ["public", "private"]:
    for zone in zones:
        net = next(blocks)
        route = "igw" if tier == "public" else f"nat-{zone[-1]}"
        layout.append((tier, zone, net, route))

for tier, zone, net, route in layout:
    print(f"{tier:8} {zone}  {str(net):15} 0.0.0.0/0 -> {route}")
print("remaining /20 blocks for later:", len(list(blocks)))

public   eu-west-1a  10.20.0.0/20    0.0.0.0/0 -> igw
public   eu-west-1b  10.20.16.0/20   0.0.0.0/0 -> igw
public   eu-west-1c  10.20.32.0/20   0.0.0.0/0 -> igw
private  eu-west-1a  10.20.48.0/20   0.0.0.0/0 -> nat-a
private  eu-west-1b  10.20.64.0/20   0.0.0.0/0 -> nat-b
private  eu-west-1c  10.20.80.0/20   0.0.0.0/0 -> nat-c
remaining /20 blocks for later: 10

The same layout elsewhere

• Azure: subnets have no "public" flag; inbound internet access comes through a public load balancer or application gateway, and outbound through a NAT gateway attached to the subnet.
• Google Cloud: VMs without external IPs use Cloud NAT for outbound traffic; firewall rules control inbound access.