AWS : VPC (Virtual Private Cloud) 3 - VPC Wizard with NAT

bogotobogo.com site search:

Set Up a VPC with NAT

The picture below shows the NAT instance basics (Scenario 2: VPC with Public and Private Subnets (NAT)).

Here are the setup specifics of our VPC with NAT:

The virtual private cloud (VPC) is of size /16 (example CIDR: 10.0.0.0/16) provides 65,536 private IP addresses.
The public subnet is of size /24 (example CIDR: 10.0.0.0/24) provides 256 private IP addresses.
The private subnet of size /24 (example CIDR: 10.0.1.0/24) provides 256 private IP addresses.
The Internet gateway connects the VPC to the Internet and to other AWS products.

The main route table sends the traffic from the instances in the private subnet to the NAT instance in the public subnet.

The NAT instance sends the traffic to the Internet gateway for the VPC. The traffic is attributed to the Elastic IP address of the NAT instance. The NAT instance specifies a high port number for the response. If a response comes back, the NAT instance sends it to an instance in the private subnet based on the port number for the response.

The instances in the public subnet can receive inbound traffic directly from the Internet, whereas the instances in the private subnet can't.

The instances in the public subnet can send outbound traffic directly to the Internet, whereas the instances in the private subnet can't.

Instead, the instances in the private subnet can access the Internet by using a network address translation (NAT) instance that you launch into the public subnet.

Let's create a VPC using the VPC Wizard in the VPC Console with NAT in public subnet.

A network address translation (NAT) instance has its own Elastic IP address. This enables instances in the private subnet to send requests to the Internet. In other words, it will act as the gateway for all the instance(s) inside the private subnet (10.0.1.0/24).

Here is the summary for the created VPC:

Private subnet and route table:

The picture below shows the main route table.

The main route table is associated with our private subnet. The route table contains an entry that enables instances in the subnet to communicate with other instances in the VPC, and an entry that enables instances in the subnet to communicate with the Internet through the NAT instance.

The first row describes the entry for local routing in the VPC. This entry enables the instances in the VPC to communicate with each other.

The second row describes the entry that sends all other subnet traffic to the NAT instance, which is specified using its AWS-assigned identifiers (for example, network interface eni-* and instance i-*).

Public subnet and route table:

The custom route table shown below is associated with our public subnet.

This route table contains an entry that enables instances in the subnet to communicate with other instances in the VPC, and an entry that enables instances in the subnet to communicate directly with the Internet.

The first row describes the entry for local routing in the VPC. This entry enables the instances in this VPC to communicate with each other.

The second row describes the entry for routing all other subnet traffic to the Internet over the Internet gateway, which is specified using its AWS-assigned identifier (for example, igw-*).

Security group for NAT

Setup rules to the NATSG security group:

Let's change the security group of the NAT instance.

In the navigation pane, click Network Interfaces, then select the network interface for the NAT instance from the list, and then select Change Security Groups from the Actions list.

In the Change Security Groups dialog box, select the NATSG security group that we created from the Security groups list.