Rewrote the beginner lab around current VPC console steps, explicit public and private routes, IPv4 and IPv6 behavior, security controls, costs, and dependency-aware cleanup.
This tutorial creates a small VPC you can inspect without launching a server. It uses one VPC, two Availability Zones, two public subnets, and two private subnets. It creates an internet gateway but no NAT gateway, EC2 instance, VPN, or interface endpoint, so the lab keeps its cost and cleanup surface small.
You will learn how a CIDR block, subnet, route table, internet gateway, security group, and network ACL fit together. The companion AWS VPC configuration guide covers design choices for production networks; this article stays focused on a safe first build.
What this VPC lab teaches
The basic objects
A VPC is a logically isolated network in one AWS Region. It spans the Region's Availability Zones, but each subnet belongs to exactly one Availability Zone. Route tables choose a target for each destination. Security groups filter traffic at a resource's network interface, and network ACLs filter traffic at the subnet boundary.
A subnet is not public because of its name. AWS considers it public when its route table has a route to an internet gateway. A resource in that subnet also needs a public IPv4 address or an IPv6 address and rules that allow the traffic. A private subnet has no direct internet gateway route; this lab leaves its private subnets without a NAT route, so they have no general internet egress.
The lab layout
Resource
Example
Purpose
VPC
10.20.0.0/16
Address boundary for the lab
Public subnets
10.20.1.0/24, 10.20.2.0/24
One in each of two Availability Zones, with an internet gateway route
Private subnets
10.20.11.0/24, 10.20.12.0/24
One in each Zone, with only the VPC local route
Internet gateway
One attachment
Route target for public IPv4 or IPv6 traffic
Each Availability Zone has one public/private pair: public-A and private-A share AZ A, while public-B and private-B share AZ B.
Use the current AWS references
AWS updates console labels and service behavior. Keep the official Create a VPC, VPC basics, and route table pages nearby while following the lab.
VPC terms in plain language
CIDR: a compact notation for an IP address range. The VPC's range contains the ranges used by its subnets.
Availability Zone: an isolated location inside an AWS Region. A subnet cannot span Zones.
Route table: a set of destination and target pairs. Every subnet is associated with one route table at a time.
Internet gateway: a redundant VPC attachment that can provide public internet paths when routes and addresses allow them.
Security group: a stateful allow-list attached to a resource. It has no deny rules.
Network ACL: an ordered, stateless allow/deny list applied to a subnet. Return traffic must be allowed separately.
This lab demonstrates those relationships without exposing an SSH or RDP management port and without creating a paid NAT gateway.
Before you create anything
Choose one Region and write it down. The resources in this lab are Region-specific.
Use an identity that can create and delete the VPC resources, or ask an administrator to perform those actions. Do not use a long-lived root credential for routine work.
Set a personal reminder to run the cleanup section when you finish. A VPC itself has no additional charge, but gateways, public IPv4 addresses, endpoints, data transfer, and other resources can cost money.
Use a distinctive tag such as Lab=beginner-vpc-2026-10-04. It makes the resources easier to identify before deletion.
For this lab, use 10.20.0.0/16. It contains 65,536 IPv4 addresses and leaves room for the four /24 subnets below. Do not use this range if it overlaps a network you plan to connect later. A connected corporate network or VPC with the same range cannot be routed cleanly through peering, Transit Gateway, or VPN.
A /24 contains 256 IPv4 addresses, but AWS reserves the first four and the last address in each IPv4 subnet. That leaves 251 usable addresses in each lab subnet. See AWS's subnet sizing rules rather than treating the CIDR size as a host count.
Choose Create VPC. For Resources to create, choose VPC and more. AWS currently uses this flow to create the VPC, subnets, route tables, and gateways together.
Keep name-tag auto-generation enabled or enter a lab name. Apply the same identifying tag to the resources when the form allows it.
For IPv4 CIDR block, enter 10.20.0.0/16. For IPv6 CIDR block, choose no IPv6 CIDR for the base lab. IPv6 is covered separately below.
Choose Number of Availability Zones: 2. Choose Number of public subnets: 2. Choose Number of private subnets: 2.
Expand Customize subnets CIDR blocks and enter the four /24 ranges explicitly: in AZ A, public-A is 10.20.1.0/24 and private-A is 10.20.11.0/24; in AZ B, public-B is 10.20.2.0/24 and private-B is 10.20.12.0/24. Keep each public/private pair in the same AZ.
Set NAT gateways to None. Do not choose one for this lab. A NAT gateway is useful for private IPv4 egress, but it is billed while provisioned and is not needed to learn the routing model.
If the form offers VPC endpoints, leave them disabled for the base lab. A gateway endpoint for S3 or DynamoDB is an optional extension; an interface endpoint has hourly and data-processing charges.
For DNS options, keep both Enable DNS resolution and Enable DNS hostnames enabled for this lab.
Review the preview and confirm the explicit mapping: public-A/private-A in AZ A, public-B/private-B in AZ B, with exactly the four /24 CIDRs above. Do not accept generated /20 defaults if they appear. Choose Create VPC.
The exact console labels can change. If the combined form is unavailable, follow AWS's create-a-VPC procedure and create the same resources individually.
Check the result in Resource map
Open VPCs, select the lab VPC, and choose Resource map. Confirm that you can see the VPC, two Availability Zones, four subnets, route tables, and one internet gateway. AWS's VPC resource map shows relationships and can expose a private subnet that accidentally has a public route.
Understand the subnet and route table paths
Public and private are route outcomes
Open each subnet and note its Availability Zone and IPv4 CIDR. Then open the associated route table. Each table should contain a local route for 10.20.0.0/16. The public route tables should also contain 0.0.0.0/0 targeting the internet gateway. The private route tables should not contain a direct internet gateway route and, because this lab has no NAT gateway, should contain no general internet route.
One subnet has one route table association at a time. Several subnets can share a route table if they need identical paths. AWS chooses the most specific matching route, and IPv4 and IPv6 destinations are separate.
Verify each CIDR and association
Use this checklist:
Public-A is in one Zone with 10.20.1.0/24.
Public-B is in a different Zone with 10.20.2.0/24.
Private-A is in one Zone with 10.20.11.0/24.
Private-B is in a different Zone with 10.20.12.0/24.
All four subnet ranges are fully inside the VPC range, and the ranges are pairwise non-overlapping.
Each subnet is associated with the intended public or private route table.
Why this lab does not launch an EC2 instance
An EC2 instance would add compute, EBS, public IPv4, IAM, security, and cleanup choices without helping you understand the route table inspection. If you extend the lab later, put a temporary instance in the intended subnet, avoid inbound SSH or RDP from the entire internet, and use a private access method such as Systems Manager when its prerequisites are configured. The site's EC2 fundamentals guide explains those access choices.
Understand internet and NAT gateways
The public path
The internet gateway is attached to the VPC, but only subnets whose route table points to it have a public route. An IPv4 resource also needs a public IPv4 address; an IPv6 resource needs an IPv6 address and an IPv6 route. Security group and NACL rules still apply. An internet gateway does not turn private subnets public.
To keep this lab bounded, do not add a public server or an inbound security rule. The route-table configuration is enough to inspect the path.
What a NAT gateway would change
A public NAT gateway lets resources in a private subnet initiate outbound IPv4 connections while preventing unsolicited inbound connections. A traditional zonal NAT gateway lives in a public subnet, uses an Elastic IP, and needs a public route to an internet gateway. The private subnet's route table then sends 0.0.0.0/0 to the NAT gateway.
AWS also offers regional NAT gateways that can expand across Availability Zones and do not require a public subnet. Read the current regional NAT gateway behavior before choosing between modes. Both NAT modes have service and data-processing charges; do not add one to a short-lived lab unless you specifically need to test egress.
IPv4 and IPv6 are separate paths
This base lab is IPv4-only. If you enable IPv6, associate an IPv6 CIDR with the VPC and each intended subnet, then add ::/0 explicitly. A 0.0.0.0/0 route does not cover IPv6. For outbound-only native IPv6, route ::/0 to an egress-only internet gateway; that gateway is for IPv6 only and blocks internet-initiated connections. AWS documents the behavior in egress-only internet gateway guidance.
Review security controls without opening management ports
Security groups and NACLs do different jobs
Security groups are stateful allow rules attached to resources. If an allowed connection produces return traffic, the return traffic is allowed by the security group even without a matching reverse rule. Security groups cannot express explicit deny rules. AWS's security group guidance describes this behavior.
Network ACLs are stateless rules applied at the subnet boundary. They support allow and deny rules and evaluate entries in ascending rule-number order. Both directions need rules, including return traffic and any required ephemeral ports. The default network ACL allows traffic, while a custom NACL can easily block a valid path.
Use security groups as the primary resource control and NACLs as deliberate subnet-level guardrails. See AWS's security group and NACL comparison.
Keep the base lab low-risk
Do not add inbound SSH or RDP from 0.0.0.0/0 or ::/0.
If you add an application rule, scope it to a known source security group or narrow address range and remove it after testing.
Do not treat a public subnet as a firewall. Apply least-privilege security group rules to the actual resources.
Use VPC Flow Logs only when you need traffic evidence, and choose a protected destination with an expected logging cost.
Optional private access with a VPC endpoint
Add a gateway endpoint only when you need it
A gateway endpoint can provide private access to S3 or DynamoDB from selected route tables. It adds service-prefix-list routes and does not require an internet gateway or NAT gateway. AWS states that gateway endpoints have no additional charge; the service itself and related data transfer still follow its pricing.
If you add one, choose Endpoints in the VPC console, choose a gateway endpoint for S3 or DynamoDB, select this VPC and the private route tables, apply a least-privilege endpoint policy, and confirm the new prefix-list route. Delete it before deleting those route tables during cleanup. Interface endpoints are a different type: they create endpoint network interfaces, need DNS and security group configuration, and are billed per Availability Zone and per GB processed. Read the current endpoint types first.
In Resource map, confirm each subnet's Zone and route-table relationship.
In each public route table, confirm the local route and the internet gateway default route.
In each private route table, confirm the local route and the absence of a direct internet gateway or NAT route.
Check that the VPC DNS support and DNS hostnames settings match any later private hosted zone or interface endpoint requirement. AWS documents the settings in VPC DNS attributes.
Use the AWS CLI when you want an audit trail
These commands read configuration; replace the placeholders with IDs from the console and keep the Region explicit:
These checks confirm objects and associations, not application connectivity. A real connectivity test requires a resource, a protocol, and a permitted path.
What to add only after the base lab
VPC peering is a direct, non-transitive connection between two non-overlapping VPCs; both sides need routes. Site-to-Site VPN connects a customer network through encrypted tunnels. Transit Gateway centralizes many VPC and hybrid attachments with separate route tables. These services extend the design and can introduce additional charges and cleanup dependencies. They are outside this bounded lab.
When you need those patterns, start with the VPC configuration reference and record the CIDRs, ownership, routes, and deletion order before creating a connection.
Understand cost and clean up safely
What can create a charge
The VPC and its basic route tables do not have a separate hourly charge. Charges can come from public IPv4 addresses, NAT gateways, interface endpoints, data transfer, Flow Logs destinations and queries, EC2, EBS, VPN, Transit Gateway, or other resources you add. NAT gateways charge for availability and data processing; interface endpoints charge per Availability Zone and data processed. Prices and Free Tier offers change, so use the current VPC pricing page and account billing view rather than copying a fixed dollar amount.
Delete resources in dependency order
For the base lab, use the VPC console to select the lab VPC and choose Delete VPC after confirming that it contains no resources you want to keep. If you added optional resources or the console reports dependencies, follow this order:
Terminate any temporary EC2 instances and remove load balancers or other resources you added. Wait until their network interfaces disappear.
Delete interface or gateway VPC endpoints. Wait for interface endpoint network interfaces to be removed.
Delete NAT gateways. Wait for the status to become deleted, then release their Elastic IP addresses if they are no longer needed.
Detach and delete the internet gateway. Delete an egress-only internet gateway if you created one.
Remove custom route-table associations and delete custom route tables. Keep the main route table until the VPC can be deleted.
Delete the four subnets, then delete custom security groups and network ACLs that are no longer attached.
Delete the VPC and verify that the lab's tagged resources are gone. Check Billing or Cost Explorer later for delayed usage records.
Do not release an Elastic IP that belongs to another workload, and do not delete a shared VPC or route table based only on a similar name. Confirm the VPC ID and tags before every destructive step.
Troubleshoot a configuration that does not look right
Private subnet has no internet: this is expected in the base lab. Add a NAT route only when private IPv4 egress is an intentional requirement and you accept its cost.
Public subnet is not reachable: check the internet gateway attachment, public route table association, resource public address, security group, and NACL. A public route alone is insufficient.
Subnets cannot communicate: check the local route and both resources' security groups. The default NACL permits traffic; a custom NACL may block the return path.
IPv6 does not work: verify the VPC and subnet IPv6 CIDRs, an explicit ::/0 route to the correct gateway, the resource IPv6 address, and IPv6 security rules.
Endpoint access fails: check endpoint type, route-table association for gateway endpoints, endpoint ENI security groups and DNS for interface endpoints, and endpoint policy. Use the site's endpoint troubleshooting guide.
When a supported resource-to-resource path still fails, use VPC Reachability Analyzer to identify a route or rule that blocks the path. It evaluates configuration; it does not replace a live application test.
What you should understand after the lab
A VPC CIDR contains non-overlapping subnet CIDRs, and each subnet belongs to one Availability Zone.
A public subnet has an internet gateway route; a private subnet does not have that direct route.
IPv4 and IPv6 need separate routes and security rules.
Security groups are stateful allow-lists; NACLs are stateless ordered subnet rules.
NAT is optional, has cost and routing consequences, and is not required for a private subnet to be useful.
Resource inspection and safe deletion are part of VPC configuration, not afterthoughts.
Once this small lab is deleted, use the configuration guide for production address planning, multi-AZ routing, endpoints, hybrid connectivity, and automation.