How do route tables work in a VPC, and how is that different in Azure and GCP?
Show the answer
Say this first
In AWS each subnet is associated with exactly one route table; subnets without an explicit association
use the main route table. Every table has a local route for the VPC CIDR that you cannot delete.
Lookups use longest prefix match. Azure starts with system routes and lets you override them with
user-defined routes per subnet. GCP routes belong to the whole VPC and can be scoped with network tags.
Go deeper
AWS
- Local route.
10.10.0.0/16 localis in every table. All subnets in the VPC can reach each other unless a security group or NACL stops it. - Targets.
igw-,nat-,pcx-(peering),tgw-,vgw-,eni-(an appliance),vpce-(gateway or GWLB endpoint), egress-only IGW for IPv6. - Selection. Longest prefix match first. For identical prefixes, static routes beat propagated (BGP) routes.
- Propagation. A route table can learn routes from a virtual private gateway when route propagation is enabled for it.
- Gateway route tables. You can associate a route table with the internet gateway or virtual private gateway itself (edge association) to steer inbound traffic through a firewall appliance.
Azure
Every subnet gets system routes: the VNet range, peered VNets, 0.0.0.0/0 to Internet, and next hop
None for RFC 1918 and 100.64.0.0/10 ranges that are not in the VNet. You attach a route table of
user-defined routes (UDRs) to a subnet with next hop types such as VirtualAppliance,
VirtualNetworkGateway, Internet or None. For the same prefix, a UDR beats a BGP route, which
beats a system route.
GCP
Routes are VPC-wide objects. Subnet routes are created for you. A default route to the default internet gateway exists until you delete it. Custom static routes have a priority (lower wins on a tie) and can apply only to instances with a network tag. Cloud Router adds dynamic routes, either for its own region or for all regions depending on the VPC's dynamic routing mode.
They will ask next
Can you route traffic between two subnets of the same VPC through a firewall?
Yes. AWS lets you add a route more specific than the VPC CIDR, for example the other subnet's
/24, pointing to the firewall's ENI or a GWLB endpoint. Without that, thelocalroute sends subnet-to-subnet traffic straight across.Why did my BGP route from the VPN not appear in the subnet's route table?
Route propagation from the virtual private gateway is off for that route table. Propagation is enabled per route table, not per VPC.
Traps
- Thinking a route table is per VPC in AWS. It is associated per subnet.
- Forgetting the main route table. A new subnet silently uses it until you associate another.