What is the difference between a public and private subnet in a Amazon VPC?

Question

When I launch a server with a security group that allows all traffic into my private subnet, it displays a warning that it may be open to the world.

If it is a private subnet, how can that be?

Answer 1

The main difference is the route for 0.0.0.0/0 in the associated route table.

A private subnet sets that route to a NAT instance. Private subnet instances only need a private ip and internet traffic is routed through the NAT in the public subnet. You could also have no route to 0.0.0.0/0 to make it a truly private subnet with no internet access in or out.

A public subnet routes 0.0.0.0/0 through an Internet Gateway (igw). Instances in a public subnet require public IPs to talk to the internet.

The warning appears even for private subnets, but the instance is only accessible inside your vpc.

Answer 2

The Topic of this question is different from the actual problem which is described above. This topic is also important and highly searched over the Internet, and just because of this, other websites have much higher views of the same topic as it is not well defined here, if both Public and Private Subnets can go To the Internet to download updates and packages then what is the difference between them? Both should be Public then, but let me clear this and add my answer from AWS point of view, as well as a conceptual, practical point of view.

Answer of the Topic:

Public and Private Subnets are the name of the concept, not actually a separate entity.

Answer of the Actual Problem which is being asked

The warning is Correct technically, I am assuming you are talking about Inbound Traffic, not Outbound, because if you wanted to download software, packages, updates so you have to add every single IP in the Outbound which is practically not good and time consuming., so, the warning is about other networks and Private classes

For example: if you are adding a rule in Private Subnet security group like Inbound 0.0.0.0/0 so it doesn't mean that it is available for Public and someone can send a request to that Instance/service/machine, what actually it means that other Private Subnets or Private networks can communicate with your instance or services, like 192.168.x.x, 172.16.x.x, 10.0.0.0 Private classes, which is only possible if your routes are allowed to do that. Other than this, you can ignore that warning and not worry about it. Here you have to understand the difference between From the Internet and To the Internet, so as per Security Group rules and help info, it will show you that warning which can be misunderstood by anyone.

The Confusion

When you create a Subnet in AWS VPC, there is an option Auto-assign Public IPv4 This is the main problem which makes confusion to the people if it is set to Yes, then your Subnet is Public, no matter what name or key-value you tagged to the Subnet, which means, at the time of Subnet creation, if you use a name like Private Subnet-A so it doesn't mean its Private Subnet, it depends on your use case and configurations (Auto-assign Public IP option).

Difference between Public and Private Subnet:

Instances in Public Subnet can be accessible From the Internet, which means traffic From the Internet can hit a machine/Instance/Service in Public Subnet. You normally keep things like Load Balancers, Web Servers in Public Subnet. So when you create them, you add name Public in front of them to keep them separate from others and, it doesn't matter you enabled Auto-assign Public IPv4, but every time you choose the Public Subnet that you marked Public, you have to check or enable Auto-assign Public IPv4 option when you launch an instance of EC2 or RDS/Service. But it's better if you enable Auto-assign Public IPv4 at Subnet level to make it properly Public because this is the reason you are making difference and using Public-Private concept, so whenever you launch any service/Instance/machine in Public Subnet, it will be able to accessible From the Internet and To the Internet, means, You can hit the service/Instance over the Internet and can download updates and packages in the service/Instance as well. You can check who is going To the Internet by simply typing the command curl wgetIP.com, you will see your Instance/machine Public IP in results.

"Because, when you launch an instance into a Subnet that has this attribute enabled, a Public IP address is assigned to the primary network interface (eth0) that's created for the instance. A Public IP address is mapped to the primary Private IP address through network address translation (NAT).".....said, AWS.

Instances in Private Subnet can not be accessible From the Internet. E.g. you can put Database Server, Redis Server or these kinds of other services in a Private Subnet and no one can access it From the Internet. It would be accessible only via Instances/machines/Services in Public Subnet (Web server, ELB, etc). Because it doesn't have Public IP enabled option and also we marked it as Private for the specific use as explain, for security and unwanted access over the Internet. This is good for architecture level security to avoid loopholes. To access this Private Subnet services/Instances, you have to add allow rule in Security group and add proper routes in the route table.

Now the question is,

Can Private Subnet go To the Internet?

So, answer is by default no,
If you wanted to access To the Internet through a Private Subnet or a Subnet having no Public IP or a Subnet having disabled Auto-assign Public IPv4, you need to create NAT instance or a NAT-gateway, and that NAT-gateway must have Public IP so, your service/Instance with Private IP will go to the Internet and can download updates,software and packages. Private IP will route traffic to NAT-gateway and NAT-gateway will route to Internet Gateway. Then your communication from Private Subnets to Internet can start, you can check your IP by simply running command curl wgetIP.com, it will give you NAT-gateway Public IP, because NAT-gateway will go to the Internet for you and Internet gateway is a path of outside communication to the world and its a term in networking as well to pass the traffic from inbound to outbound. You can simply understand its main gate of the building for the exit.

Conclusion The instances in the public subnet can send outbound traffic directly to the Internet, whereas the instances in the private subnet can't. Instead, the instances in the private subnet can access the Internet by using a network address translation (NAT) gateway that resides in the public subnet. The database servers can connect to the Internet for software updates using the NAT gateway, but the Internet cannot establish connections to the database servers.".....said, AWS

Links:

Internet Access: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html

VPC & Subnets Basics: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html

VPC with Public and Private Subnets (NAT): https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html

Answer 3

As documented here

PUBLIC SUBNET If a subnet's traffic is routed to an internet gateway, the subnet is known as a public subnet. PRIVATE SUBNETIf a subnet doesn't have a route to the internet gateway, the subnet is known as a private subnet.

Answer 4

The distinction between "public" and "private" subnets in AWS VPC is determined only by whether the subnet has an Internet Gateway (IGW) attached to it. From the AWS docs:

If a subnet is associated with a route table that has a route to an internet gateway, it's known as a public subnet. If a subnet is associated with a route table that does not have a route to an internet gateway, it's known as a private subnet.

The IGW allows network traffic from the internet to reach endpoints inside the subnet.

To answer your second question:

When I launch a server with a security group that allows all traffic into my private subnet, it displays a warning that it may be open to the world. If it is a private subnet, how can that be?

It appears AWS does not check whether your chosen subnet has a route table with an IGW or not, when displaying that warning. It's a blanket warning they always show when you set up an instance with a security group allowlisting all inbound traffic. They use "may be" (as opposed to "will be") in there to cover their butts, but the warning is only relevant if you are on a public subnet.

Answer 5

The problem we are trying to solve is to make some resources "private", that is deny inbound traffic from outside your VPC, but still allow those private resouces to access the internet for e.g. updates.

There are a couple of ways to do this:

• You could try to use Network Access Control Lists (NACL) but these affect inbound- and outbound traffic the same way ("stateless"). Therefore, you cannot deny inbound traffic while allowing outbound traffic. Also, they seem to be rarely recommended anyhow (see second comment of this SO post).
• You could use security groups associated with each resource. This would work well but seems the less popular solution (maybe because it's easy to forget adding a security group to a resource?)
• At last, you could setup a separate subnet without a connection to the internet gateway but instead a connection to a NAT gateway. That NAT gateway is usually (always?!) placed in another subnet which has a connection to the internet gateway. You'd then call these two subnets private and public, respectively. In other words, the terms "private subnet" and "public subnet" are really just names for this specific setup (as the other posts here state) and do not describe an inherent feature of the subnet.