I am following this tutorial to configure multiple subnets and firewall:

enter image description here


This tutorial shows how to filter traffic through the firewall. However, when I look at the Public Subnet, the CIDR range for the subnet is but the route table shows local destination to be, shouldn't it be

Same thing for Private Subnet, the CIDR range for Private subnet is but the Route table for local target shows the destination as

I am either very confused or have no clue why its configured this way. Can someone please help me understand.

  • If you aggregate all the networks, then you use the 10,1,0,0/16 network as the aggregate, meaning that is what you advertise to the public. Any packets in that range get sent to you, and your network knows how to deliver the packets to the correct subnet. Remember that packets only have the destination address, not the destination mask.
    – Ron Maupin
    Oct 27, 2021 at 12:33
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 23, 2021 at 23:11

3 Answers 3


"Local" in this context means "within my VPC." So any traffic destined for somewhere else in the VPC is "local." Traffic to the Internet (i.e. outside the VPC) goes to the Internet gateway.

AWS routing does not work exactly the same as "traditional" routing with physical routers, switches, and wires. So their terminology is sometimes different.


It looks like from the diagram that is your local domain so any traffic that is for destination to will be sent out a local interface into your network. Underneath is the default route that sends all other traffic towards the Internet-gateway firewall.

So if an instance with the Private IP sends a DNS lookup to google dns it will route the traffic towards the yellow highlighted 'target' and follow the red arrows. enter image description here

If the instance wants to send a DNS lookup to eg an internal DNS server or, the route on each Firewall, Public or Private route table will send the traffic out of a local interface. But I agree that this is a bit unclear. I think if you imagine there is a virtual switch called 'local' in between all the subnets which I have added in black (and you must forgive my lack of artistic skill) then that helps with the logical direction the traffic takes.

For example, the routing table for Public Route Table 1 would traditionally probably look more like this - locally-connected-subnet - local - nat-aaaa


when I look at the Public Subnet, the CIDR range for the subnet is but the route table shows local destination to be, shouldn't it be

Here, private subnet and public subnet are terminology for subnets in different security zones (which is likely elaborated on in the further texts). is your entire example address space, routed into your realm. That is subnetted into several /24 networks that you use to create your zoned environment - some of it public, some private, separated by firewalls.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.