public vs. private subnet
expressioncloud
The basic VPC split: public subnets route to the internet gateway and can be reached; private subnets reach out through NAT and cannot.
Load balancers in public, workloads in private: the pattern behind most cloud reference architectures.
In cloud networking a public subnet has a route to an internet gateway and a private one does not, and that single routing difference is the entire distinction. It is not about addresses, and a resource in a private subnet may hold a perfectly ordinary address that simply has no path outward.
The pattern this produces is the standard reference architecture: load balancers in the public subnet, application servers and databases in private subnets, and outbound access for the private tier through a NAT gateway that permits egress without permitting inbound. That arrangement means a compromised application server cannot be reached directly from the internet even if it is listening.
Two mistakes recur often enough to be worth naming. A resource placed in a private subnet with a public address attached is not private, because the route is what matters and someone will assume the address implies isolation. And the outbound path is frequently forgotten in threat modelling: a private subnet with unrestricted egress lets an attacker exfiltrate data and reach command infrastructure freely, so the control that matters is often on the way out rather than the way in.