Virtual Networks, Subnets, and Routing
The CNEcl exam tests subnet design and packet forwarding: CIDR planning, public versus private subnets, route-table behavior, longest-prefix match, and NAT. You must be able to read a route table and predict whether a packet is delivered, dropped, or translated.
Core rules
- Every subnet associates with exactly one route table; the main table applies only when no explicit association exists.
- Longest-prefix match wins: a /32 beats a /24, which beats a /0, regardless of metric.
- A public subnet needs a route to an internet gateway; a private subnet needs a route to a NAT gateway or NAT instance in a public subnet.
- NAT is outbound-only; unsolicited inbound sessions are dropped.
- Reserve provider-specific addresses (commonly the first four and last address in AWS; Azure reserves five).
- IPAM prevents overlap across accounts and regions.
Worked example
VPC 10.0.0.0/24; public 10.0.0.0/26; private 10.0.0.64/26. Public route: 0.0.0.0/0 to the internet gateway. Private route: 0.0.0.0/0 to nat-1 in the public subnet. nat-1 needs an Elastic IP, and the public route table must point to the internet gateway. If the private route exists but the NAT subnet has no internet gateway route, egress fails silently and flow logs show no response.
Traps
- Forgetting the route-table association for a new subnet.
- Expecting NAT to permit inbound sessions.
- Using security groups as if they were subnet ACLs.
- Allocating a /24 when a /26 suffices, then colliding with on-premises space later.