NAT Gateways (Network Address Translation) are crucial components for allowing resources within a private subnet in AWS to access the Internet while preventing inbound traffic from the Internet. This comprehensive guide will walk you through setting up NAT Gateways in AWS, ensuring your private resources have outbound Internet access.

Understanding NAT Gateways in AWS

A NAT Gateway enables instances in a private subnet to connect to the Internet or other AWS services, but it prevents the Internet from initiating a connection with those instances. This setup is essential for scenarios where you want to restrict direct Internet access but still require your instances to download software updates or communicate with public services like Amazon S3.

Prerequisites for Setting Up NAT Gateways

Before you start, you need to ensure the following:

  • An AWS account with sufficient privileges.
  • Familiarity with Virtual Private Cloud (VPC) concepts.
  • Basic knowledge of how EC2 instances, subnets, and internet gateways work.
  • AWS CLI or AWS Management Console access for creating resources.

Creating a VPC and Subnets

  1. Log into the AWS Management Console: Go to the VPC dashboard.
  2. Create a VPC:
    • Select Create VPC.
    • Name your VPC (e.g., MyVPC).
    • Choose a CIDR block, such as 10.0.0.0/16.
    • Choose default tenancy or dedicated tenancy based on your requirements.
    • Click Create.
  3. Create Subnets:
    • In the VPC Dashboard, go to Subnets and click Create Subnet.
    • Choose your VPC.
    • Create one subnet as a Public Subnet (e.g., 10.0.1.0/24), which will have direct internet access.
    • Create another subnet as a Private Subnet (e.g., 10.0.2.0/24), where you’ll deploy instances that require internet access via the NAT Gateway.

Establishing Internet Connectivity with an Internet Gateway

You need to set up an Internet Gateway to allow Internet access to resources on your VPC.

  1. Create an Internet Gateway:
    • Navigate to the Internet Gateways section and click Create Internet Gateway.
    • Attach the newly created internet gateway to your VPC.
  2. Update Route Table for Public Subnet:
    • Go to Route Tables.
    • Select the route table associated with your public subnet.
    • Edit the routes and add a route for 0.0.0.0/0 that points to the Internet Gateway.
    • This will allow instances in the public subnet to have full internet access.

Configuring Public and Private Subnets

To maintain a secure architecture, we need to differentiate between public and private subnets:

  • Public Subnet: Will allow traffic directly from the internet via the Internet Gateway.
  • Private Subnet: Instances in this subnet won’t have direct internet access but will reach out via the NAT Gateway.

Launching EC2 Instances in Public and Private Subnets

Now, we’ll launch EC2 instances in both subnets:

  1. Public Subnet EC2 Instance:
    • Launch an EC2 instance and select the Public Subnet.
    • Assign a public IP to the instance to access it directly from the internet.
  2. Private Subnet EC2 Instance:
    • Launch another EC2 instance in the Private Subnet.
    • Ensure this instance does not have a public IP, as it will access the internet only via the NAT Gateway.

Creating and Configuring a NAT Gateway

With your instances launched, the next step is to set up the NAT Gateway for outbound internet access for your private subnet.

  1. Create a NAT Gateway:
    • In the VPC dashboard, go to NAT Gateways and click Create NAT Gateway.
    • Choose the Public Subnet and assign an Elastic IP to the NAT Gateway (this Elastic IP ensures stable outbound internet access).
    • Click Create NAT Gateway and wait for it to be available.

Updating Route Tables for NAT Gateway Integration

Once the NAT Gateway is set up, you’ll need to configure the route table for the private subnet:

  1. Update the Private Subnet’s Route Table:
    • Navigate to Route Tables in the VPC console.
    • Select the route table associated with the private subnet.
    • Edit the routes and add a route for 0.0.0.0/0, pointing to the newly created NAT Gateway.
    • Save the changes.

This ensures that any traffic originating from instances in the private subnet will route through the NAT Gateway for internet access.

Testing Internet Connectivity via NAT Gateway

Finally, verify that the private instances can reach the internet by testing connectivity:

  1. Connect to the Private Subnet Instance:
    • First, SSH is added to the example in the Public Subnet.
    • From there, use SSH to access the Private Subnet instance.
  2. Test Internet Connectivity:
    • On the private instance, run commands like ping google.com or try updating system packages to ensure internet access via the NAT Gateway.

If everything is configured correctly, the private instance should be able to access the internet despite not having a public IP.

Conclusion

Setting up a NAT Gateway in AWS allows you to maintain strict control over your private resources while enabling them to access the internet when needed. This setup enhances security by blocking direct inbound traffic to your private instances and allows outbound traffic for updates or connecting to public AWS services.

References

NAT gateways

Configure a VPC with Private Subnets and a NAT Gateway