NAT Gateway — Out but Not In
Inkwell's nightly image job lives in a private subnet, safely unreachable from the internet. Then it needs a security update from the Linux package servers, and the download fails: a private subnet has no route out. Moving the job to a public subnet would fix the download but expose the server. There is a middle path.
The rule
NAT lets private servers call out; nobody can call in.
A NAT gateway (Network Address Translation) is a managed AWS service that acts on behalf of private instances:
- A private instance sends a request to an internet address.
- The private subnet's route table sends it to the NAT gateway.
- The NAT gateway swaps the private source address for its own public address and forwards the request through the internet gateway.
- The reply comes back to the NAT gateway, which hands it to the instance that asked.
Because the NAT gateway only forwards replies to conversations that were started from inside, the internet cannot start a connection to the private instance.
Setting it up has three parts:
- Create the NAT gateway in a public subnet, with an Elastic IP. It needs the public subnet's route to the internet gateway to do its job.
- In the private subnet's route table, add
0.0.0.0/0 → nat-inkwell. - Leave the internet gateway where it is; the NAT gateway uses it.
Private route table
10.0.0.0/16 local
0.0.0.0/0 nat-inkwellTwo practical points. A NAT gateway is charged per hour and per gigabyte processed, so it is not free to leave running. And it lives in one zone: for resilience, run one per zone and point each private subnet at the NAT gateway in its own zone. For traffic to S3, a gateway endpoint avoids NAT charges.
The shortcut
Ask two questions for any private resource: "Does it need to start conversations with the internet? Does the internet need to start them with it?" Out only → NAT. In as well → it belongs in a public subnet, or behind a load balancer.
Does it call out?
Yes: it downloads updates.
The classic mistake is creating the NAT gateway inside the private subnet. There it has no route to the internet gateway, so it has nowhere to send traffic.
Drills
Answer fast — trust the rule.
Where must a public NAT gateway be created?
Which route sends a private subnet's internet traffic through the NAT gateway?
A stranger on the internet tries to connect to the image job through the NAT gateway. What happens?
Inkwell has private subnets in two zones and one NAT gateway in ap-south-1a. What is the risk?
Remember
- NAT lets private servers call out; nobody can call in.
- NAT gateway in a public subnet, with an Elastic IP; private route table sends
0.0.0.0/0to it. - Traps: never place it in the private subnet, and remember it costs per hour, per GB, and lives in one zone.