What is a subnet? Subnetting explained simply
A subnet — short for subnetwork — is a logical subdivision of a larger network, splitting it into smaller segments so you can organise resources, control traffic between them, and apply different security and routing rules to each. Rather than running every server on one flat network, a subnet lets you group machines that share a purpose or a trust level and treat that group as a unit. In the cloud, subnetting is one of the first design decisions you make when laying out a virtual network, because it determines what can reach the internet directly, what stays private, and how resilient the layout is if part of the infrastructure fails. This guide explains the plain idea behind subnets, the public/private pattern that shows up in almost every cloud architecture, how subnets relate to availability zones, and where the concept is tested in certification study.
The plain idea: dividing an address space
Every network has a range of IP addresses available to it. Subnetting takes that range and divides it into smaller ranges, each one its own subnet, rather than putting every device on a single undivided pool of addresses. The mechanics of how a range is split — the exact maths of masks and prefixes — belong in a dedicated networking course; the concept that matters here is simpler: a subnet is a slice of the larger address space, set aside for a specific group of resources.
Dividing a network this way brings the same benefit division always brings: smaller, purpose-built units are easier to reason about, secure and troubleshoot than one undifferentiated whole. A fault or a misconfigured rule in one subnet does not automatically expose or disrupt the others.
Subnets inside a cloud virtual network
In the cloud, subnetting happens inside a virtual private network that you create for your account — on AWS this is a VPC, and other providers use equivalent constructs (our explainer on what a virtual private cloud is covers that container in full). The VPC defines the overall address space; subnets are how you carve that space into smaller segments and place resources into the right one. A typical layout might put web servers in one subnet, application servers in another, and a database in a third, each with its own rules about what can talk to it.
Public vs private subnets
The most common design pattern splits subnets into two categories. A public subnet has a route to an internet gateway, so resources inside it can be reached from — and can reach — the public internet. A private subnet has no such route, so nothing inside it is directly reachable from outside the network.
This distinction drives one of the most repeated patterns in cloud architecture: put internet-facing components, such as web servers or load balancers, in a public subnet, and put anything that should never be exposed directly, such as a database, in a private subnet. The private resource can still reach the internet outbound if needed, typically routed through a managed gateway in the public subnet, but nothing on the outside can initiate a connection to it. This layered exposure is a core building block of secure network design, not an optional extra.
Subnets and availability zones
A subnet lives entirely within a single availability zone — it cannot span more than one. Availability zones are physically separate data centre facilities within a region (our explainer on regions and availability zones covers this idea in depth), so tying a subnet to exactly one AZ means that if that facility has an outage, only the resources in subnets located there are affected.
The practical consequence is that resilient architectures spread resources across multiple subnets in multiple availability zones rather than relying on one subnet alone. A load balancer distributing traffic across instances in two or three AZs, each in its own subnet, keeps the application running even if one zone goes down. Designing for this kind of spread is one of the most tested skills in associate-level architecture exams.
Route tables and network ACLs
Two further mechanisms attach to a subnet and shape how it behaves. A route table decides where traffic leaving the subnet is sent — it is what makes a subnet "public" by pointing internet-bound traffic at an internet gateway, or keeps a subnet "private" by omitting that route. A network access control list is a stateless set of allow/deny rules attached to the subnet itself, filtering traffic in and out at the subnet boundary, in addition to any rules applied at the individual resource level. Together they give a second layer of control on top of whatever security is configured on the resources inside the subnet.
Where subnetting appears in certification study
Subnetting is core territory in the associate-level networking and architecture exams. Expect scenario questions that describe a workload and ask you to place it in the right subnet, choose whether that subnet should be public or private, or explain how spreading subnets across availability zones improves availability. The AWS Solutions Architect Associate, AWS CloudOps Engineer Associate and Azure Administrator Associate exams all draw on this reasoning, usually alongside the virtual-network and routing concepts it depends on. Understanding the public/private pattern and the AZ relationship covers most of what those questions actually test.
Original practice questions, timed mock exams and revision notes. No card, nothing to pay.