Contents
AWS understand · networking · 21
NAT Gateway
A hand-drawn animated video with a voice and subtitles. Every fact in it comes from the official AWS documentation (listed at the end).
- A NAT gateway lets servers in a private subnet connect to things outside the VPC, but outside services cannot start a connection to those servers.
- NAT = network address translation = swapping the sender address on the way out, and swapping it back on the reply.
- A public NAT gateway lives in a public subnet and must get an Elastic IP address (a fixed, public IPv4 address) when you create it.
- Routes: private subnet
0.0.0.0/0→nat-gateway-id; public subnet0.0.0.0/0→internet-gateway-id. - A standard (zonal) NAT gateway lives in one Availability Zone. For resilience, make one in each zone and route each zone to its own one. A regional NAT gateway also exists and spreads across zones by itself.
Video file: aws-understand/06-networking/21-nat-gateway/video.mp4
The ideas
01The picture, part by part
| AWS word | In the picture | What AWS docs say |
|---|---|---|
VPC | Gated society | A virtual network dedicated to your AWS account. |
| Private subnet | A building with no road to the main gate | Does not have a direct route to an internet gateway. Needs a NAT device to access the public internet. |
| Public subnet | A building with a road to the main gate | Has a direct route to an internet gateway. |
| Internet gateway | The society's main gate | Lets instances connect to the internet through the Amazon EC2 network edge. |
| NAT gateway | A reception / post desk in the public building | A Network Address Translation service: private instances can connect out, outside services cannot start a connection in. |
| Elastic IP address | The desk's fixed public return address | A static, public IPv4 address. |
Source: how-it-works.html, configure-subnets.html, vpc-nat-gateway.html, vpc-eips.html
02Out yes, in no
AWS docs: "You can use a NAT gateway so that instances in a private subnet can connect to services outside your VPC but external services can't initiate a connection with those instances." Also: "Connections must always be initiated from within the VPC containing the NAT gateway."
Note from AWS: the word NAT follows common IT use; the real job of a NAT device is both address translation and port address translation (PAT).
Source: vpc-nat-gateway.html, vpc-nat.html
03Where it lives and the routes
"You create a public NAT gateway in a public subnet and must associate an Elastic IP address with the NAT gateway at creation." A route table is a set of rules (routes) that decide where network traffic from your VPC goes.
| Route table of | Destination | Target | Meaning |
|---|---|---|---|
| Private subnet | VPC CIDR | local | Talk to other instances in the VPC |
| Private subnet | 0.0.0.0/0 | nat-gateway-id | All other traffic goes to the NAT gateway |
| Public subnet | VPC CIDR | local | Talk to other instances in the VPC |
| Public subnet | 0.0.0.0/0 | internet-gateway-id | All other traffic goes to the internet gateway, so the NAT gateway can reach the internet |
Source: vpc-nat-gateway.html, nat-gateway-scenarios.html ("Routing"), how-it-works.html ("Route tables")
04The two address swaps
| Step | Who | What changes |
|---|---|---|
| 1 | NAT gateway | Instance's private IPv4 address → NAT gateway's private IPv4 address |
| 2 | Internet gateway | NAT gateway's private IPv4 address → the Elastic IP address of the NAT gateway |
| 3 | NAT gateway (reply) | Translates the address back to the original source IP address |
The example addresses in the video (10.0.2.15, 10.0.1.20) are made up for the picture.
Source: vpc-nat-gateway.html
05One per zone
"Each NAT gateway is created in a specific Availability Zone and implemented with redundancy in that zone." "If you have resources in multiple Availability Zones and they share one NAT gateway, and if the NAT gateway's Availability Zone is down, resources in the other Availability Zones lose internet access. To improve resiliency, create a NAT gateway in each Availability Zone, and configure your routing to ensure that resources use the NAT gateway in the same Availability Zone."
AWS also offers regional NAT gateways: "Unlike standard NAT gateways (referred to as zonal NAT gateways), which operate in a single Availability Zone, regional NAT gateways follow your workloads." A regional NAT gateway does not need a public subnet, and does not support private NAT.
Source: nat-gateway-basics.html, nat-gateways-regional.html
06Public vs private NAT gateway
| Type | Lets private instances reach | Elastic IP? | Note |
|---|---|---|---|
| Public (default) | The internet (through the internet gateway) | Yes, required at creation | Lives in a public subnet |
| Private | Other VPCs or your on-premises network (your own data centre) | No, cannot have one | If you route its traffic to the internet gateway, the internet gateway drops it |
Source: vpc-nat-gateway.html
07Guards, speed and cost
| Fact | What AWS docs say |
|---|---|
| Security group (guard at the flat door) | No security group on a NAT gateway. Put security groups on your instances. |
| Network ACL (guard at the building gate) | You can use a network ACL to control traffic to and from the NAT gateway's subnet. NAT gateways use ports 1024-65535. |
| Speed (bandwidth = how much data can flow) | 5 Gbps, automatically scales up to 100 Gbps. |
| Cost | Charged for each hour the NAT gateway is available and each gigabyte of data it processes. |
Source: nat-gateway-basics.html, nat-gateway-pricing.html
08NAT gateway vs NAT instance
| Attribute | NAT gateway | NAT instance (your own EC2 server) |
|---|---|---|
| Maintenance | Managed by AWS, no maintenance for you | Managed by you, for example software updates and OS patches |
| Bandwidth | Up to 100 Gbps | Depends on the instance type |
| Availability | Built with redundancy in each zone | You use a script to manage failover |
| Security groups | No | Yes |
AWS: "We recommend that you use NAT gateways because they provide better availability and bandwidth and require less effort on your part to administer."
Source: vpc-nat-comparison.html, vpc-nat.html
Reference
—Sources
| What | Where (official AWS docs) |
|---|---|
| NAT devices: what NAT does, gateway vs instance | vpc/latest/userguide/vpc-nat.html |
| NAT gateways: public and private, address mapping | vpc/latest/userguide/vpc-nat-gateway.html |
| NAT gateway basics: zones, bandwidth, security groups, ACLs | vpc/latest/userguide/nat-gateway-basics.html |
| Use cases: route tables | vpc/latest/userguide/nat-gateway-scenarios.html |
| Regional NAT gateways | vpc/latest/userguide/nat-gateways-regional.html |
| Compare NAT gateways and NAT instances | vpc/latest/userguide/vpc-nat-comparison.html |
| NAT gateway pricing | vpc/latest/userguide/nat-gateway-pricing.html |
| Elastic IP addresses | vpc/latest/userguide/vpc-eips.html |
| How Amazon VPC works: route tables, internet access | vpc/latest/userguide/how-it-works.html |
| Subnet types: public and private | vpc/latest/userguide/configure-subnets.html |