DEV Community

Ved Dandotia
Ved Dandotia

Posted on

🌐 Building a Custom VPC on AWS — Public & Private Subnets, Route Tables, and an EC2 Instance

#cloud #aws #vpc #subnet

In my previous post, I launched my first Amazon EC2 instance using AWS's default VPC. While that's a great way to get started, production environments rarely rely on the default network configuration.

In this tutorial, we'll build a custom Virtual Private Cloud (VPC) from scratch, configure public and private subnets, connect the VPC to the internet using an Internet Gateway, create Route Tables, and finally launch an EC2 instance inside the public subnet.

By the end of this guide, you'll have a solid understanding of one of the most fundamental networking concepts in AWS.

🚀 What You'll Build

In this tutorial, we'll create:

  • ✅ A Custom VPC
  • ✅ A Public Subnet
  • ✅ A Private Subnet
  • ✅ An Internet Gateway
  • ✅ Public and Private Route Tables
  • ✅ An EC2 Instance in the Public Subnet

🧠 Why Create a Custom VPC?

AWS provides a default VPC in every region, which is perfect for learning or quick deployments. However, real-world cloud architectures require more control over networking.

With a custom VPC, you can:

  • Define your own IP address ranges using CIDR blocks
  • Separate internet-facing resources from internal resources
  • Control routing between subnets and the internet
  • Improve security by isolating sensitive workloads

A common production architecture places web servers in public subnets while keeping databases and backend services in private subnets.

🏗️ Architecture

📋 Prerequisites

Before starting, make sure you have:

  • An AWS Account
  • Basic understanding of CIDR and subnets
  • Basic familiarity with Amazon EC2 (optional but recommended)

Step 1 — Create the VPC

  1. Open the AWS Management Console.
  2. Navigate to VPC.
  3. Select Your VPCs.
  4. Click Create VPC.
  5. Choose VPC only.

Use the following configuration:

Setting Value
Name demo-vpc
IPv4 CIDR Block 10.0.0.0/16
IPv6 None
Tenancy Default

Click Create VPC.

A /16 CIDR block provides 65,536 IP addresses, giving you plenty of room to divide your network into multiple subnets.

Step 2 — Create Public and Private Subnets

We'll create two subnets inside our VPC.

Subnet CIDR Purpose
demo-public-subnet-1a 10.0.1.0/24 Internet-facing resources
demo-private-subnet-1a 10.0.2.0/24 Internal resources

To create each subnet:

  1. Open Subnets.
  2. Click Create Subnet.
  3. Select demo-vpc.
  4. Enter the subnet name.
  5. Choose an Availability Zone (for example, ap-south-1a).
  6. Enter the CIDR block.
  7. Click Create Subnet.

💡 Tip

A /24 subnet provides 256 IP addresses, of which 251 are usable because AWS reserves five IP addresses in every subnet.

Step 3 — Create an Internet Gateway

An Internet Gateway (IGW) allows resources inside your VPC to communicate with the internet.

To create one:

  1. Navigate to Internet Gateways.
  2. Click Create Internet Gateway.
  3. Name it demo-IGW.
  4. Create the gateway.
  5. Select the Internet Gateway.
  6. Click Actions → Attach to VPC.
  7. Choose demo-vpc.

Without an Internet Gateway, resources inside your VPC cannot communicate with the public internet.

Step 4 — Create Route Tables

Route Tables determine where network traffic is directed.

We'll create two Route Tables.

Public Route Table

Create a new Route Table.

Setting Value
Name demo-public-RT
VPC demo-vpc

Add the following routes.

Destination Target
10.0.0.0/16 local
0.0.0.0/0 demo-IGW

Associate this Route Table with:

demo-public-subnet-1a

Private Route Table

Create another Route Table.

Setting Value
Name demo-private-RT
VPC demo-vpc

Leave only the default route.

Destination Target
10.0.0.0/16 local

Associate it with:

demo-private-subnet-1a

⚠️ Important

A subnet is considered private because it has no route to an Internet Gateway.

Step 5 — Launch an EC2 Instance

Open the EC2 Console and click Launch Instance.

Use the following configuration.

Setting Value
AMI Amazon Linux 2
Instance Type t3.micro
VPC demo-vpc
Subnet demo-public-subnet-1a
Auto Assign Public IP Enabled

Create or select a Security Group allowing:

Type Port
SSH 22
HTTP 80

Create or choose an existing Key Pair and launch the instance.

Because this EC2 instance is placed inside the public subnet and the subnet is associated with a Route Table pointing to the Internet Gateway, AWS automatically allows internet connectivity.

Step 6 — Verify Connectivity

Once the instance reaches the Running state:

  • Copy its Public IPv4 Address
  • Verify that a Public IP has been assigned

Connect using SSH.

ssh -i demo_ec2.pem ec2-user@<your-public-ip>
Enter fullscreen mode Exit fullscreen mode

If the connection succeeds, your networking configuration is working correctly.

Now imagine launching another EC2 instance inside the private subnet.

You'll notice:

  • No Public IP Address
  • No direct internet connectivity
  • Accessible only from inside the VPC or through a Bastion Host/NAT Gateway

That's exactly how secure production architectures are designed.

🔍 Quick Recap

Resource Purpose
demo-vpc Custom Virtual Private Cloud
demo-public-subnet-1a Hosts public resources
demo-private-subnet-1a Hosts internal resources
demo-IGW Provides internet connectivity
demo-public-RT Routes public traffic to the IGW
demo-private-RT Keeps private resources isolated
EC2 Instance Runs inside the public subnet

🧹 Cleanup

To avoid unnecessary AWS charges:

  1. Terminate the EC2 instance.
  2. Delete Route Table associations.
  3. Delete both subnets.
  4. Detach and delete the Internet Gateway.
  5. Delete the VPC.

🎉 Conclusion

Congratulations! You've successfully built a custom AWS Virtual Private Cloud from scratch.

In this tutorial, you learned how to:

  • Create a custom VPC
  • Configure public and private subnets
  • Attach an Internet Gateway
  • Create Route Tables
  • Launch an EC2 instance inside the public subnet
  • Understand how AWS networking works behind the scenes

This architecture forms the foundation of almost every production workload deployed on AWS.

🚀 What's Next?

In the next tutorial, we'll add a NAT Gateway so instances inside the private subnet can securely access the internet for software updates and package downloads—without being directly exposed to incoming internet traffic.

Stay tuned, and happy cloud learning! ☁️

Top comments (0)