Skip to main content

About route tables

Route tables give you the ability to manage how traffic is routed within a subnet by creating routes inside them. Each VPC (Virtual Private Cloud) initially comes with a default route table that you can adjust, but you can also create a custom route table for each subnet.

You can direct traffic towards various elements such as an internet gateway or a VPC endpoint. It is important to note that traffic destined for an IP (Internet Protocol) address within the VPC CIDR (Classless Inter Domain Routing) block is always routed locally.

Route tables and subnets​

Route tables govern how network traffic flows by using rules called routes, which determine the direction of network traffic. They are established for a specific network and are used by its router, which is automatically generated within your network, to define how traffic is routed.

Each subnet in a network must be linked to a route table, which manages routing for all the VM (Virtual Machines) located in that subnet. A single route table can be associated with several subnets; however, a subnet can only be associated with one route table.

warning

Just as it is advisable to dedicate a subnet to a single application, it is also recommended to use one route table and one security group (security group) per subnet.

In the following diagram, each subnet is associated with a distinct route table. The VM in subnet 1 can access the internet through the internet gateway, while the VM in subnet 2 can access an object storage service using the VPC endpoint.

Network routing diagram with route tables and subnets in Numspot

Subnets, route tables and routes

Main route table and other route tables​

Main route table​

When you create a VPC, a route table is also automatically created and considered the main route table. The main route table acts as an implicit router within your VPC: it manages traffic routing for all the subnets that are not explicitly associated with a route table. It is therefore implicitly associated with all the subnets you create in the VPC until you explicitly associate them with a route table.

The main route table created with the VPC contains only the locale route when it is created, which directs all traffic destined for a target within the VPC CIDR block to the VPC itself. This route can neither be modified nor deleted. You can add or remove routes in the main route table, and modify these routes. However, you cannot delete the main route table.

You can also define which route table is the main one for the VPC, which changes the route table used for any new subnet or any subnet that is not explicitly associated with a route table. For greater clarity, you can select a specific route table to be the main route table, which has the effect of changing the route table used by default for all newly created subnets or those that are not explicitly associated with a route table.

note

To avoid any confusion, explicitly associate a subnet with the main route table to maintain a stable routing configuration, even if you change the main route table used by the other subnets. This association ensures that the route table used by the subnet remains unchanged.

Other route tables​

In addition to the main route table, you can create additional route tables for your VPC. These route tables can be associated with one or more subnets, allowing you to customize traffic routing for each subnet according to your needs.

When you create a new route table, it automatically contains the locale route, which can neither be deleted nor modified. This route directs traffic towards the VM within the VPC. To strengthen the security of your VPC, you can keep the main route table with only the locale route and associate each new subnet with a custom route table that you have created. This way, outbound traffic from each subnet is directed only towards the VM within the VPC until you add additional routes to its route table. This allows you to control precisely how outbound traffic is routed for each subnet of your VPC.

info

In summary, the additional route tables give you greater flexibility to customize traffic routing for each subnet of your VPC, while strengthening security by limiting outbound traffic to the VM within the VPC until you explicitly authorize external access.

Routes and routing options​

A route specifies:

  • the destination of the traffic, in CIDR notation. This can be a range of IP addresses or a single IP address (using a /32 prefix);
  • the target, which corresponds to the network element used to reach the destination of the traffic.

You can route traffic using the following targets:

  • Local: a local route is automatically added to any route table created in a VPC, with the VPC CIDR block as destination and local as target. Traffic coming from the VM and going to an IP address belonging to the VPC CIDR block thus remains within the local network of the VPC.

    warning

    You can neither modify nor delete the local route.

  • Internet gateway: allows the VM in the subnet that have an associated public IP to be directly connected to the internet through the VPC internet gateway. To do this, you must add a route with the CIDR block 0.0.0.0/0 as destination and the ID of the internet gateway as target.

    For example, the route table of a subnet with VM directly connected to the internet, in a VPC with the CIDR block 10.0.0.0/16 and the internet gateway igw-12345678 attached to it, contains the following routes:

    DestinationTarget
    10.0.0.0/16local
    0.0.0.0/0igw-12345678

  • Nat gateway: allows the VM in the subnet to be indirectly connected to the internet through a nat gateway. To do this, you must add a route with the CIDR block 0.0.0.0/0 as destination and the ID of the nat gateway as target.

    For example, the route table of a subnet with VM indirectly connected to the internet, in a VPC with the CIDR block 10.0.0.0/16 and using the nat gateway nat-12345678 to direct traffic to the internet, contains the following routes:

    DestinationTarget
    10.0.0.0/16local
    0.0.0.0/0nat-12345678

  • VM or network interface: allows the VM in a subnet to send traffic towards a particular VM or network interface. You can route traffic to a VM when it has only one network interface. If the VM has NIC (Network Interface Cards) attached, you must route traffic to one of its network interfaces. To do this, you must add a route with the appropriate CIDR block as destination and the ID of the VM or of the network interface as target.

    For example, in the same VPC with the CIDR block 10.0.0.0/16, if an administration VM has a network interface eni-11111111 in a subnet A with the IP address 10.10.0.10 and another network interface in a subnet B, the route table of a subnet with VM that need to connect to this administration VM from subnet A contains the following routes:

    DestinationTarget
    10.0.0.0/16local
    10.10.0.10/32eni-11111111

  • Virtual gateway: allows the VM in the subnet to direct traffic towards a remote network through a VPN (Virtual Private Network) connection or DirectLink. To do this, you must add a route with the CIDR block of the remote network as destination and the ID of the virtual gateway attached to your VPC as target, and create a VPN or DirectLink connection using this virtual gateway.

    For example, the route table of a subnet in a VPC with the CIDR block 10.0.0.0/16, directing traffic towards your internal network with the CIDR block 192.168.1.0/24 through a VPN connection using the virtual gateway vgw-12345678, contains the following routes:

    DestinationTarget
    10.0.0.0/16local
    192.168.1.0/24vgw-12345678

  • VPC endpoint: allows you to create a private connection between your VPC and a Numspot service. The appropriate route, with the ID of the service prefix list (pl-xxxxxxxx) as destination and the ID of the VPC endpoint (vpce-xxxxxxxx) as target, is automatically added to the route tables you specify for the VPC endpoint.

    warning

    You can neither modify nor delete this route, but you can change the route tables used by the VPC endpoint.

  • VPC peering: allows you to direct traffic towards a peer VPC. To do this, you must add a route with all or part of the CIDR block of the peer VPC as destination and the ID of the VPC peering as target.

    warning

    The owner of the peer VPC must add a route in the route tables of their VPC to route traffic towards your VPC.

    For example, the route table of a subnet in a VPC A with the CIDR block 10.0.0.0/16, directing traffic towards a peer VPC B with the CIDR block 192.168.1.0/24 and using the VPC peering pcx-12345678, contains the following routes:

    DestinationTarget
    10.0.0.0/16local
    192.168.1.0/24pcx-12345678

    The route tables of the peer VPC B must contain the following routes:

    DestinationTarget
    192.168.1.0/24local
    10.0.0.0/16pcx-12345678

If the destination of the traffic matches several routes in the associated route table, the most specific route with the narrowest CIDR block matching this destination is always the one used to route the traffic.

A route is always in the "Active" state, which means that the route is active and is used to route the traffic.

Cette page vous a-t-elle été utile ?