Skip to main content
This guide shows how to make a subnet public so instances launched into it are reachable from the internet. We’ll build everything from scratch:
  • Create a VPC.
  • Create a subnet inside that VPC.
  • Launch an EC2 instance in that subnet and assign a public IP.
  • Create and attach an Internet Gateway (IGW) to the VPC.
  • Update the subnet’s route table so 0.0.0.0/0 routes to the IGW.
  • Verify network connectivity.
Follow the sequence below — each step includes the console screenshots from the demo to keep the context clear.

​
1) Create the VPC (10.0.0.0/16)

Begin by creating a VPC for your resources. In this demo we use the CIDR block 10.0.0.0/16.
A screenshot of the AWS VPC Management Console showing details for a VPC named "vpcdemo" (ID vpc-0aca126152745f63c) with its state listed as Available. The page displays configuration info like IPv4 CIDR 10.0.0.0/16, DNS settings, route table, and associated IPv6 CIDR.

​
2) Create a subnet (10.0.1.0/24)

Create a subnet inside the VPC. Use 10.0.1.0/24 for the example public subnet.
Screenshot of the AWS VPC Management Console showing the "Subnet settings" page. The form is filled to create a subnet named "public-subnet" with IPv4 CIDR block 10.0.1.0/24 and tag fields visible.

​
3) Launch an EC2 instance into the subnet (enable public IP)

Launch an EC2 instance into the subnet. Key points during the instance launch:
  • Choose an AMI (e.g., Amazon Linux).
  • Select an instance type (e.g., t2.micro for Free Tier).
  • Select the VPC and the subnet you created.
  • Enable Auto-assign Public IP so the instance receives a public IP.
  • Create or select a key pair for SSH.
  • Create/edit a security group to allow required traffic (for demo: SSH TCP/22 from anywhere; optionally add ICMP for ping).
Screenshot of the AWS EC2 "Launch an instance" console. It shows Network settings (VPC, subnet, auto-assign public IP, security group) on the left and a Summary panel on the right listing the AMI, instance type (t2.micro), storage and a "Launch instance" button.
At this stage the instance is running and has a public IP assigned. However, without an Internet Gateway attached and the proper route in the subnet’s route table, the instance will not be reachable from the internet.

​
4) Verify initial connectivity (expected to fail)

From your laptop or terminal, try to ping or SSH to the public IP. If no IGW/route is configured yet, you’ll typically see timeouts or connections that hang:
Even though the instance has a public IP, the VPC currently lacks a path to the internet.

​
5) Create and attach an Internet Gateway (IGW)

Create an Internet Gateway and attach it to your VPC. This provides a path for internet-bound traffic from the VPC to the internet.
The screenshot shows the AWS VPC console on the "Create internet gateway" page with a form to enter a Name tag and optional tags. A "Create internet gateway" button is visible at the bottom.
After creating and attaching the IGW, the attachment alone is not sufficient — you must ensure the subnet’s route table sends non-local traffic to the IGW.

​
6) Check the subnet route table (initially only local route)

Inspect the subnet’s route table association. By default the route table only contains the local route for the VPC CIDR (for example, 10.0.0.0/16), so there’s no route for internet-bound traffic yet.
Screenshot of the AWS VPC console showing the Subnets page with a selected "public-subnet" (subnet ID, IPv4 CIDR) and its Route table details. The route table pane lists local routes including 10.0.0.0/16 and an IPv6 prefix.

​
7) Add a default route to the IGW (make the subnet public)

To make the subnet public, either modify the existing route table or create a new route table and associate it with the subnet. Add a route with:
  • Destination: 0.0.0.0/0
  • Target: your Internet Gateway (e.g., igw-xxxxxxxx)
Steps:
  • Create/choose a route table within the VPC.
  • Associate the route table with your subnet.
  • Add the 0.0.0.0/0 -> IGW route.
After adding the default route, the route table will show a 0.0.0.0/0 entry pointing to the IGW.
A screenshot of the AWS VPC console showing the details for a route table (rtb-09d7182cdaf843778 / public-rt). The Routes panel lists entries including a 0.0.0.0/0 route pointing to an internet gateway and subnet associations.

​
8) Re-test connectivity (expected to succeed if security rules allow)

Once the default route exists and the IGW is attached, retry ping or SSH:
Make sure your security group and Network ACLs allow the traffic you intend (for example, SSH on TCP/22 and ICMP for ping). Security groups are stateful; NACLs are stateless. If connectivity still fails after attaching the IGW and adding the default route, double-check those security rules and NACL entries.

​
9) Confirm IGW attachment

You can also verify the IGW attachment on the Internet Gateways page — it should show the IGW as “Attached” to your VPC.
A screenshot of the AWS VPC console on the Internet gateways page. It shows two internet gateways (one named "my-igw") with their IDs and state marked "Attached," and details for the selected gateway displayed below.

​
Quick checklist (summary)

​
Troubleshooting tips

  • If SSH/ping still fail, confirm:
    • Instance has a public IP (not just a private IP).
    • Route table associated with the subnet contains 0.0.0.0/0 pointing to the IGW.
    • Security group inbound rules allow the protocol/port from your source IP.
    • NACLs attached to the subnet allow inbound/outbound traffic (remember they are stateless).
  • Use the EC2 Serial Console or Session Manager for deeper troubleshooting when SSH is blocked by network rules.

Watch Video