Route Tables
8 posts tagged Route Tables.
Your 25 Gbps instance does 5 Gbps to the internet, and that is documented
EC2 instance bandwidth is one number on the spec sheet and at least three in practice. Traffic through an internet gateway is capped at 5 Gbps on anything under 32 vCPUs, and a single flow is capped at 5 Gbps nearly everywhere. Neither is a fault, and both get filed as one.
Networking6 minA regional NAT Gateway makes the most common NAT mistake impossible to express
The zonal NAT Gateway has a placement rule, a per-AZ route table requirement, and a single-zone dependency, and each one is a documented outage. Regional mode does not fix those bugs. It removes the configuration they live in.
Networking7 minYou can route around the local route, and that is how intra-VPC inspection works
"The local route always wins and cannot be overridden" is the version most people learn. It is wrong twice: a route more specific than the VPC CIDR wins by longest prefix match, and the local route's target can be replaced outright. The first is what makes inspecting traffic between two subnets possible.
Networking5 minA stale static route silently shadows the BGP route you are advertising
VPC route priority puts static routes above propagated ones at the same prefix. So a leftover static route wins over a healthy BGP advertisement, and the routing table looks correct because the route is there.
Networking5 minA 200 millisecond penalty is what a completely broken IPv6 path looks like
Happy Eyeballs means a dead address family costs you latency instead of errors. The fixed delay on dual-stack destinations is a specific enough fingerprint to diagnose from, and it can sit unnoticed indefinitely.
Networking7 minVPC peering has no reverse path forwarding, and AWS documents what that costs
A hub peered to two VPCs that share a CIDR will deliver one of them's replies to the other. AWS states the behaviour outright, and the configuration is legal to build because the overlap guardrail is narrower than people think.
Networking5 minThe misconfiguration that does not appear in the API output
A subnet with no explicit route table association is returned by nothing. DescribeRouteTables says so in one line of its own reference, and it means "check the route tables" structurally cannot find the problem.
Networking4 minOne Transit Gateway rule explains both an outage and a security hole
Route lookup happens against the route table associated with the attachment traffic arrived on. That single sentence produces a connection that should work and does not, and a connection that should be impossible and is not.
Networking5 min