Skip to main content
This guide demonstrates how to provide outbound-only internet access to an EC2 instance in a private subnet using an AWS NAT Gateway. The EC2 instance will have no public IPv4 address and cannot be reached from the internet, but it will be able to initiate outbound connections via a NAT Gateway in a public subnet. Goal
  • Allow outbound-only internet access for a private EC2 instance (no public IP).
  • Use a NAT Gateway in a public subnet to provide internet egress for the private subnet.
Architecture overview
  • VPC: 10.0.0.0/16
  • Private Subnet: 10.0.1.0/24 (EC2 instance without public IP)
  • Public Subnet: 10.0.2.0/24 (NAT Gateway + Elastic IP + IGW route)
  • Internet Gateway (IGW) attached to the VPC
  • Public Route Table (0.0.0.0/0 -> IGW) associated to the public subnet
  • Private Route Table (0.0.0.0/0 -> NAT Gateway) associated to the private subnet
Quick resource summary Prerequisites
  • AWS account with permissions to create VPCs, subnets, EC2 instances, IGWs, NAT Gateways, Elastic IPs, and route tables.
  • Optionally: AWS CLI configured if you prefer command-line steps.
Step-by-step setup
  1. Create the VPC
  • Create a VPC using CIDR 10.0.0.0/16 (no IPv6 needed for this demo).
  1. Create the private subnet and launch the EC2 instance
  • Private Subnet: 10.0.1.0/24
  • Launch an EC2 instance in the private subnet:
    • AMI: Amazon Linux (or preferred AMI)
    • Instance name: PrivateServer
    • Subnet: Private Subnet (10.0.1.0/24)
    • Public IPv4 address: Disable / Do not auto-assign
    • Security Group: default (or configure as needed)
Here’s the instance details showing that it has no public IPv4 address:
Screenshot of the AWS EC2 console showing one instance named "private-server" (i-0126...) in a Running state. The instance is a t2.micro with private IPv4 10.0.1.62 and no public IPv4 address.
This instance has no public IPv4 address, so it cannot be reached directly from the internet. With a NAT Gateway, it can still initiate outbound connections to the internet.
  1. Create an Internet Gateway (IGW)
  • Create an IGW and attach it to your VPC:
    • Create Internet Gateway
    • Attach Internet Gateway to VPC
You can confirm the IGW attachment in the VPC console:
A screenshot of the AWS VPC console showing the "Internet gateways" page. It lists one internet gateway (igw-01cb142aa30c5362d) in the Attached state and its VPC ID.
  1. Create a public subnet
  • Public Subnet: 10.0.2.0/24
  • This subnet will host the NAT Gateway and the Elastic IP.
  1. Create route tables and associate subnets
  • Public Route Table
    • Add route: 0.0.0.0/0 -> Internet Gateway (igw-xxxxx)
    • Associate with: Public Subnet (10.0.2.0/24)
  • Private Route Table
    • Do NOT add 0.0.0.0/0 -> IGW (keeps subnet private)
    • Associate with: Private Subnet (10.0.1.0/24)
  1. Create the NAT Gateway
  • Console: NAT Gateways -> Create NAT Gateway
    • Name: my-nat-gateway
    • Subnet: Public Subnet (10.0.2.0/24)
    • Elastic IP: Allocate Elastic IP (EIP) and associate it with the NAT Gateway
  • Wait for the NAT Gateway to reach state Available (EIP allocation and provisioning can take a short time).
CLI example (optional)
  1. Update the private route table to use the NAT Gateway
  • Private Route Table -> Routes -> Edit routes
    • Add route: 0.0.0.0/0 -> NAT Gateway (nat-xxxxxxxx)
    • Save changes
CLI example (optional)
Note: Immediately after creation the NAT Gateway may be in a pending state while EIP allocation and provisioning complete. Wait until the NAT gateway state becomes Available before relying on it for outbound traffic. Testing connectivity
If routing and the NAT Gateway are configured correctly, you should see an HTTP response header (or other expected output) returned. Operational considerations
NAT Gateways are Availability Zone-scoped. A NAT Gateway deployed in one AZ serves subnets in that AZ but is not resilient across AZ failures. In production, deploy a NAT Gateway in each AZ and configure routing (or per-AZ route tables) so instances use the NAT Gateway in their AZ to avoid a single point of failure.
Other important notes
  • The Elastic IP associated with the NAT Gateway is the public address used for outbound connections from private instances.
  • NAT Gateways are managed AWS services and incur:
    • An hourly NAT Gateway charge
    • A per-GB data processing charge Review pricing before enabling NAT Gateways in production.
  • For cost-optimized or specialized scenarios you can consider NAT instances (self-managed) but they require maintenance and scaling logic. NAT Gateways are easier to manage and scale automatically.
Recommended production setup
  • Deploy a NAT Gateway in each Availability Zone.
  • Use per-AZ route tables or routing rules so each private subnet uses the NAT Gateway in its AZ.
  • Monitor NAT Gateway metrics and costs.
Links and references This completes the NAT Gateway setup for outbound-only internet access from private EC2 instances. For production, make the NAT deployment AZ-resilient and monitor costs and performance.

Watch Video