Question

It is possible to access the Internet from a private subnet only with NAT without an Internet Gateway associate with its VPC?

Background

VPC with public and private subnets (NAT) says below. Just with this sentence, it would be a fair conclusion that it only requires NAT to reach the Internet without an Internet Gateway attached its VPC.

A NAT gateway with its own Elastic IPv4 address. Instances in the private subnet can send requests to the internet through the NAT gateway over IPv4 (for example, for software updates).

I believe for any traffic from a VPC to reach the Internet, the VPC requires the Internet Gateway but the document does not clearly say so, hence being confused.

I started two EC2 instances in an Elastic Beanstalk autoscaling group in a VPC. The app on these EC2 instances needs to connect to a third party service that uses an IP address whitelist to allow access. So I'm using NAT Gateway to have static IPs so they can be added to the whitelist. The third party have already given access to the IPs from the two NAT Gateways I have configured at aws console. But I cant connect yet. On the development environment which accepts any IP connection the app is running ok.

There is a chance that I'm using wrong IP? Which command can I use to know which IP my app is getting in the internet? I did traceroute from the server to the third party service and it didn't showed the NAT Gatewa IP, is this right?

I want to set up security group for an ec2 instance(Linux). There are services running on it like mem cached, python, dhclient, nodejs etc. How do i know which IP/CIDR-block should my server be listening to on a particular port? Eg. if mysqld is running on port 3306, what should be the source CIDR/IP/SG and how to find it out? (inbound rules)

p.s. It is a vpc with various webservers, database-servers, CMS, Solr etc. I need to setup security groups for each of these. Specifically, I need to know what instance is talking to what other machines in the VPC. Presently security group setup is open for all. I need to secure it

I have a VPC that I created a long time ago before NAT gateways were a thing. Like many setups I created a NAT instance to route outbound traffic. Yesterday my NAT instance crashed. I was able to reboot but it did create a bit of a headache so I decided to try to migrate to a NAT Gateway.

I don't care if the outbound IP is the same. As a test I created a new VPC with an instance to ensure I got the settings correct. I then created the gateway in the existing VPC. I then swapped my main routing table to use it as the gateway instead of the instance.

My setup is two subnets, one public that points to an internet gateway and one private pointing to the NAT gateway. I use OpenVPN on an instance to reach my private instances.

However when I swap to the NAT gateway I can no longer route outbound on existing instances, BUT when I create a new instance it works fine. The problem is the same in reverse. If I set the subnet of my new instance that works with the NAT gateway, to use the NAT instance instead, it can no longer see the outside world.

I'm not changing the route tables on the instances themselves, only the routes in the web console.

I also tried (with my test instance) to restart networking and then a reboot but neither helped.

I've read a couple of migration guides that seem to indicate this should work, obviously the routes change but then don't work right after that. Is there a magic trick to this or am I going to have to recreate my instances to work with NAT gateway?

EDIT: Another wrinkle in this. On a whim I changed the security group of my test instance (I used a default one when I created it). Using an existing security group with the same outbound rules made the instance able to connect but swapping it back to the original group, and it can't connection.

EDIT 2: Changing the security group of one of my existing instances doesn't seem to work. Changing security group only seems to work on the new instance that I set up as a test.

As suggested, here's some screens of my setup:

Here are my route tables. The named one I added as a test and it routes to the nat gateway. I have just one subnet it, where I have an instance as a test. The second in the list is the default route which all other subnets route to, using the NAT instance.

Here's verification that my private-subnet-1e routes to the NAT Gateway:

And verification that one of my production server subnets route using the main gateway through the NAT instance:

Security group for test instance Outbound rules: (everything)

Security group for prod instance that can't route if I change the table. Same, everything is allowed

I would like to use Nat Gateway (not Nat Instance on EC2!) from another VPC to route my traffic from peered VPCs to the Internet. My infrastructure looks like this:

/---------------------VPC-LIVECHAT---------------------\
| /---Subnet A---\  /---Subnet B---\  /---Subnet C---\ |
| |              |  |              |  |              | |
| \-10.10.0.0/24-/  \-10.10.1.0/24-/  \-10.10.2.0/24-/ |
\------------------------------------------------------/
               |                        |
               | VPC Peering Connection |
               |                        |
/----------------------VPC-COMMON----------------------\
| /---Subnet A---\  /---Subnet B---\  /---Subnet C---\ |
| |  /--------\  |  |  /--------\  |  |  /--------\  | |
| |  | NAT GW |  |  |  | NAT GW |  |  |  | NAT GW |  | |
| |  \--------/  |  |  \--------/  |  |  \--------/  | |
| \-10.10.3.0/24-/  \-10.10.4.0/24-/  \-10.10.5.0/24-/ |
\------------------------------------------------------/
               |                        |
               | VPC Peering Connection |
               |                        |
/---------------------VPC-DATABASE---------------------\
| /---Subnet A---\  /---Subnet B---\  /---Subnet C---\ |
| |              |  |              |  |              | |
| \-10.10.6.0/24-/  \-10.10.7.0/24-/  \-10.10.8.0/24-/ |
\------------------------------------------------------/

My idea:

• I will setup VPC-COMMON with subnets and Nat Gateway in each subnet (one subnet per AZ)
• I will setup VPC-LIVECHAT and VPC-DATABASE VPCs, create VPC Peering connections
• In VPC-COMMON subnets there will be route 0.0.0.0/0 -> Nat Gateway in same subnet
• In VPC-LIVECHAT and VPC-DATABASE subnets (all of them) there will be route VPC-COMMON CIDR -> VPC Peering Connection
• In each subnet of VPC-LIVECHAT and VPC-DATABASE there will be route 0.0.0.0/ -> Nat gateway in corresponding subnet of VPC-COMMON (subnets A will use NAT GW in VPC-COMMON subnet A and so on...)

I think this setup should work pretty well, it is just routed VLANs. But not in AWS. AWS don't want to allow me use Nat Gateway in different VPC in route table with error

"route table rtb-293fa54d and interface interface-c2002e9e belong to different networks"

I cannot use Private IP of Nat Gateway in AWS too, AWS doesn't suport IP addresses in route target (I would really love to know why).

I'm using CloudFormation and my route definition looks like this:

"RoutePrivate3ToNatInCommon" : {
    "Type" : "AWS::EC2::Route",
    "Condition" : "IsNotVpcCommon",
    "Properties" : {
        "DestinationCidrBlock" : "0.0.0.0/0",
        "RouteTableId" : { "Ref" : "PrivateSubnet3RoutingTable" },
        "NatGatewayId" : { "Fn::GetAtt" : [ "NatGatewaySettingsForNotCommon", "NatGatewayAZC" ] }
    }
}

NatGatewaySettingForNotCommon is my Custom lambda-backed resource which helps me to get list of Nat Gateways per availability zone.

Is there any way how to achieve this setup? I will have about 10 VPCs per region, 3 private subnets in each of them and I really don't want to setup (and pay for) 30 Nat Gateways. This looks like regular "non-cloudy" network setup so there should be no problem to realize it in cloud. Or is it?