NAT Gateways VPC Demo

In this walkthrough, you’ll learn how to configure an AWS NAT Gateway to enable internet access for EC2 instances in a private subnet—while preventing unsolicited inbound connections from the internet. By the end, only instances that initiate outbound requests will receive responses.

1. Create a New VPC

1. Open the VPC console and select Create VPC.
2. Enter a Name tag (e.g., demo-vpc) and set the IPv4 CIDR block to 10.0.0.0/16.
3. Leave IPv6 settings disabled and click Create.

2. Create a Private Subnet

This subnet will host your EC2 instance without a public IP.

• Name: private-subnet
• Availability Zone: e.g., us-east-1b
• IPv4 CIDR block: 10.0.1.0/24

3. Launch an EC2 Instance in the Private Subnet

1. Navigate to the EC2 console → Launch Instance.
2. Select the Amazon Linux 2 AMI (or your preferred AMI).
3. Under Network settings:
   • Choose your demo-vpc and the private-subnet.
   • Disable Auto-assign Public IP.
4. Configure or select a security group (default settings are fine).
5. Review and Launch. Name it private-server.

Because there’s no public IP, the instance cannot be reached directly from the internet.

4. Create and Attach an Internet Gateway

An Internet Gateway (IGW) is required to give public subnets internet access.

1. In the VPC console, go to Internet Gateways → Create Internet Gateway.
2. Name it my-igw and click Create.
3. Select the new IGW → Actions → Attach to VPC → choose demo-vpc.

5. Create a Public Subnet

This subnet will host the NAT Gateway and must have a route to the IGW.

• Name: public-subnet
• Availability Zone: same or different (e.g., us-east-1b)
• IPv4 CIDR block: 10.0.2.0/24

6. Configure Route Tables

You need two route tables: one public and one private.

Steps

1. Create public-route-table → select demo-vpc → Create.
2. Edit routes → Add route 0.0.0.0/0 → Target: Internet Gateway → choose my-igw → Save.
3. Associate with public-subnet.
4. Create private-route-table → select demo-vpc → Create.
5. Associate with private-subnet (no default route yet).

7. Deploy a NAT Gateway

In a public subnet, NAT Gateways allow private instances to access the internet securely.

1. Go to NAT Gateways → Create NAT Gateway.
2. Name it my-nat-gateway.
3. Subnet: public-subnet.
4. Allocate a new Elastic IP.
5. Click Create NAT Gateway.

You can also use the AWS CLI:

aws ec2 create-nat-gateway \
  --subnet-id <public-subnet-id> \
  --allocation-id <eip-allocation-id>

8. Update the Private Route Table

After the NAT Gateway becomes available:

1. Open private-route-table → Edit routes.
2. Add route 0.0.0.0/0 → Target: NAT Gateway → select my-nat-gateway.
3. Save.

Now, instances in private-subnet will send outbound traffic through the NAT Gateway while remaining inaccessible from the internet.

9. Plan for High Availability

NAT Gateways are zonal resources. To avoid a single point of failure:

• Deploy one NAT Gateway per Availability Zone.
• Update each private route table to point to the NAT Gateway in its own AZ.

Links and References

• Amazon VPC Documentation
• AWS NAT Gateway
• AWS CLI Command Reference