NAT Instances

• NAT Gateways are more recommended.

• You can use a NAT instance in a public subnet in your VPC to do the following:

  • Enable instances in the private subnet to initiate outbound IPv4 traffic to the internet.

  • Prevent the instances from receiving inbound traffic initiated by someone on the internet.

Disabling source/destination checks

• The instance must be the source or destination of any traffic it sends or receives unless you disable it.

• However, a NAT instance must be able to send and receive traffic when the source or destination is not itself, so you must disable source/destination checks.

NAT instance basics

• Main route table is associated with the private subnet and sends the traffic from the instances in the private subnet to the NAT instance in the public subnet.

• NAT instance then sends the traffic to the internet gateway for the VPC.

• Traffic is attributed to the Elastic IP address of the NAT instance.

• NAT instance specifies a high port number for the response; if a response comes back, the NAT instance sends it to an instance in the private subnet based on the port number for the response.

• Private subnet traffic is routed to the NAT instance, which then communicates with the internet.

• So, the NAT instance must have internet access.

• It must be in a public subnet (a subnet that has a route table with a route to the internet gateway).

• It must have a public IP address or an Elastic IP address.