Understanding VPC Routing: The Longest Prefix Match Rule

When you create a Virtual Private Cloud (VPC) in AWS, you are creating your own private network in the cloud. At the heart of this network is the VPC Router, an implicit, highly available component that directs all traffic flowing into, out of, and within your VPC. To control this router, you use Route Tables.

Understanding how the VPC router makes decisions is critical for building complex and predictable network architectures. The primary rule it follows is the Longest Prefix Match.

The Golden Rule: Longest Prefix Match

When your VPC router evaluates a packet of traffic, it looks at the destination IP address and checks it against the list of routes in its associated route table. If multiple routes in the table could potentially match the destination IP, the router will always choose the route with the most specific network path.

"Most specific" simply means the route with the longest subnet mask (the highest number after the /). For example:

• A route to 10.0.1.0/24 is more specific than a route to 10.0.0.0/16.

• A route to 192.168.1.10/32 (a single IP address) is more specific than a route to 192.168.1.0/24.

A Practical Routing Scenario

Let's imagine a common scenario where a VPC is connected to multiple destinations.

The Route Table

Consider the following route table associated with a subnet in VPC-A:

| Destination | Target | Comment |

| :--- | :--- | :--- |

| 10.0.0.0/16 | local | Route for traffic within VPC-A |

| 0.0.0.0/0 | igw-xxxxxxxx | Default route to the Internet Gateway |

| 10.10.0.0/16 | vgw-yyyyyyyy | Route to an on-premises network via VPN |

| 172.16.1.0/24| pcx-zzzzzzzz | Route to a specific subnet in a peered VPC |

Test Case 1: Traffic to a Peered VPC

• Packet Destination: 172.16.1.55

• Evaluation:

  1. Does 172.16.1.55 match 10.0.0.0/16? No.

  2. Does 172.16.1.55 match 0.0.0.0/0? Yes (prefix length: 0).

  3. Does 172.16.1.55 match 10.10.0.0/16? No.

  4. Does 172.16.1.55 match 172.16.1.0/24? Yes (prefix length: 24).

• Decision: The router has two matching routes: /0 and /24. Since 24 is longer than 0, the Longest Prefix Match rule applies.

• Result: The traffic is sent to the VPC Peering connection (pcx-zzzzzzzz).

Test Case 2: Traffic to an On-Premises Server

• Packet Destination: 10.10.50.100

• Evaluation:

  1. Does 10.10.50.100 match 10.0.0.0/16? No.

  2. Does 10.10.50.100 match 0.0.0.0/0? Yes (prefix length: 0).

  3. Does 10.10.50.100 match 10.10.0.0/16? Yes (prefix length: 16).

  4. Does 10.10.50.100 match 172.16.1.0/24? No.

• Decision: The router has two matching routes: /0 and /16. Since 16 is longer than 0, the Longest Prefix Match rule applies.

• Result: The traffic is sent to the Virtual Private Gateway (vgw-yyyyyyyy).

Test Case 3: Traffic to the Internet

• Packet Destination: 52.95.110.81 (a public AWS IP)

• Evaluation:

  1. Does 52.95.110.81 match 10.0.0.0/16? No.

  2. Does 52.95.110.81 match 0.0.0.0/0? Yes (prefix length: 0).

  3. Does 52.95.110.81 match 10.10.0.0/16? No.

  4. Does 52.95.110.81 match 172.16.1.0/24? No.

• Decision: The router has only one matching route: /0.

• Result: The traffic is sent to the Internet Gateway (igw-xxxxxxxx).

The Tie-Breaker: Route Priority

There is one rule that comes before the Longest Prefix Match:

• Local Routes are always prioritized. If a destination IP falls within the VPC's own CIDR block, the traffic will always be routed locally, regardless of other, more specific routes you may have added. For example, if you added a static route for 10.0.1.0/24 pointing to a gateway, traffic to an EC2 instance at 10.0.1.50 would still be routed locally because it matches the 10.0.0.0/16 local route first.

Why It Matters

Understanding the Longest Prefix Match rule is essential for designing predictable and secure networks. It allows you to carve out exceptions from broad routes. You can send most traffic to the internet (0.0.0.0/0) while ensuring that traffic destined for a peered VPC or an on-premises network is always directed to the correct gateway, preventing accidental data exposure and ensuring proper connectivity.