# Route tables

How route tables decide where a subnet's internet traffic goes, how the main table differs from tables you create, and how to change routes and associations.

A route table decides where a subnet’s internet-bound traffic goes. Every subnet uses exactly one table. Traffic between addresses inside the VPC doesn’t depend on route tables.

## Main table and tables you create [#main-table-and-tables-you-create]

Every VPC has one main route table, created with the VPC. Every subnet uses it until you associate the subnet with another table. The main table starts with local routes for the VPC’s own IPv4 and IPv6 ranges. Attaching an Internet Gateway adds the default routes `0.0.0.0/0` and `::/0` through the gateway.

A table you create with `create-route-table` starts with the VPC’s local routes and no default route. A subnet that uses it reaches its own VPC and nothing else, until you add a default route. This is how you make a private subnet next to a public one.

A subnet is public when its route table has a default route to the Internet Gateway, and private otherwise.

## Routes and targets [#routes-and-targets]

A route sends traffic for a destination range to a target:

| Target | Meaning |
| --- | --- |
| `local` | The VPC itself. Names no resource. |
| `internet-gateway` | Out through the VPC’s Internet Gateway. Must name the gateway attached to this table’s VPC. |
| `nat-gateway` | Out through a NAT gateway, which translates the traffic to its own address. Must name a NAT gateway in this table’s VPC, and the destination must be `0.0.0.0/0`. |

The platform acts on default routes, the ones whose destination is `0.0.0.0/0` or `::/0`. A NAT gateway translates IPv4 only, so a `::/0` route or any narrower destination with a `nat-gateway` target is refused.

## How internet access is decided [#how-internet-access-is-decided]

The platform decides internet reachability per VPC and address family. If any route table used by a subnet of the VPC has a default route to the Internet Gateway or a NAT gateway, traffic of that family can leave the VPC.

A working connection also needs a public source address. An instance gets one from its own Floating IP, or from a NAT gateway when its subnet’s table routes `0.0.0.0/0` through one. A subnet whose table has no default route gets no working internet access. Its packets can still leave the VPC while another subnet’s table has a default route, but no reply comes back. To stop a subnet’s outbound traffic, use network ACL egress rules or security group egress rules; see [Traffic control](/docs/network/traffic-control).

## Change routes [#change-routes]

`update-route-table-routes` replaces the table’s whole route list. Send every route the table should keep, including its local routes. Read the current list with `get-route-table` first. Each `--route` takes `<destination>,<target>[,<target-urn>]`:

```sh
origin network update-route-table-routes \
  --route-table-urn <route-table-urn> \
  --route '10.0.0.0/16,local' \
  --route '<vpc-ipv6-cidr>,local' \
  --route '0.0.0.0/0,internet-gateway,<internet-gateway-urn>'
```

A change takes effect within a few seconds and applies to new connections. A connection that’s already open through a gateway keeps running until it closes or times out, so removing a route doesn’t cut a transfer in progress.

## Associate a subnet with a table [#associate-a-subnet-with-a-table]

`associate-route-table` points a subnet at a table, replacing the one it used before. The table must belong to the subnet’s VPC.

```sh
origin network associate-route-table --subnet-urn <subnet-urn> \
  --route-table-urn <route-table-urn>
```

## What is refused [#what-is-refused]

- Deleting a VPC’s main route table. It’s removed only with the VPC.
- Deleting a table that a subnet still uses. Associate those subnets with another table first.
- A route that names an Internet Gateway of another VPC, or a detached gateway.
- A route that names a NAT gateway of another VPC, or one that no longer exists.
- Deleting a NAT gateway while any table still routes through it.
- Detaching an Internet Gateway while a table other than the main one still routes through it.

## Related [#related]

- [Give a private subnet internet access with a NAT gateway](/docs/network/internet-access/nat-gateways)
- [Attach and detach an Internet Gateway](/docs/network/internet-access/internet-gateways)
- [`update-route-table-routes` reference](/docs/network/reference/cli#update-route-table-routes)
- [`associate-route-table` reference](/docs/network/reference/cli#associate-route-table)