{"id":48452,"date":"2017-12-11T13:09:23","date_gmt":"2017-12-11T13:09:23","guid":{"rendered":"https:\/\/www.whizlabs.com\/?p=48452"},"modified":"2020-08-31T18:11:08","modified_gmt":"2020-08-31T18:11:08","slug":"nat-gateway","status":"publish","type":"post","link":"https:\/\/www.whizlabs.com\/blog\/nat-gateway\/","title":{"rendered":"Implementation of NAT Gateway"},"content":{"rendered":"<p style=\"text-align: justify;\"><b>Exam Objective<\/b><\/p>\n<p style=\"text-align: justify;\">The topic &#8220;NAT Gateway&#8221; addresses the Design and Implementation of AWS Networks as highlighted in the AWS Blueprint for the exam guide<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/d1.awsstatic.com\/training-and-certification\/docs-advnetworking-spec\/AWS_Certified_Advanced_Networking_Blueprint.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/d1.awsstatic.com\/training-and-certification\/docs-advnetworking-spec\/AWS_Certified_Advanced_Networking_Blueprint.pdf<\/a><\/p>\n<h2 style=\"text-align: justify;\">What is NAT Gateway?<\/h2>\n<p style=\"text-align: justify;\">This is an appliance which is used to connect instances in your private subnet to the internet. So rather than exposing the private instances in the private subnet directly via the Internet gateway, all the traffic can be routed via the NAT gateway.<\/p>\n<p><em>Now one can also use the NAT instance to drive traffic from private instances. But using the NAT gateway over NAT instances has the following advantages:<\/em><\/p>\n<p><strong>1) High availability &#8211;<\/strong> NAT gateways in each Availability Zone are implemented with redundancy. Hence it can always be ensured that it will be up and running. With the NAT instance, you have the additional maintenance overhead to ensuring the NAT instance is always up and running.<\/p>\n<p><strong>2) Bandwidth &#8211;<\/strong> By default, the NAT gateway supports bursts of up to 10 Gbps. For NAT Instances, this will depend on the Instance type of the Instance.<\/p>\n<p><strong>3) Maintenance &#8211;<\/strong> All of the maintenance of the NAT gateway is performed by AWS. In comparison, if you had a NAT instance, you would need to perform all the maintenance<\/p>\n<p>Some of the reasons why you would want to use a NAT instance are in situations where you would want<\/p>\n<p>1) The NAT instance to also be a Bastion Host<\/p>\n<p>2) For the NAT instance to also provide port forwarding<\/p>\n<p>[divider \/]<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/blog\/aws-certified-advanced-networking-specialty-certification-preparation\/\" target=\"_blank\" rel=\"noopener noreferrer\"><img decoding=\"async\" class=\"aligncenter size-full wp-image-48589\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/Get-40-OFF-on-Spark-Certification-3.jpg\" alt=\"AWS Certified Advanced Networking Speciality\" width=\"728\" height=\"90\" \/><\/a><\/p>\n<p>[divider \/]<\/p>\n<h4 style=\"text-align: justify;\"><b>Implementation of NAT Gateway<\/b><\/h4>\n<p style=\"text-align: justify;\">Step 1) Firstly let\u2019s ensure we have a custom VPC defined for this exercise. If you don\u2019t have one, go ahead and create a custom VPC.<\/p>\n<p>\u00a0\u00a0\u00a0\u00a0 \u00a0 \u00a0 \u00a0<a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY1.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48456 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY1.png\" alt=\"NAT Gateway\" width=\"626\" height=\"174\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">In our example, we have created a Custom VPC which has a CIDR block of 10.0.0.0\/16<\/p>\n<p style=\"text-align: justify;\">Step 2) Next let\u2019s ensure we have defined 2 subnets in this VPC. One will be a public subnet and the other will be a private subnet.<\/p>\n<p style=\"text-align: justify;\">So below is the snapshot of the private subnet<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY2.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48457 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY2.png\" alt=\"Private Subnet\" width=\"632\" height=\"165\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">And below is the definition of the public subnet<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_Gateway3.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48458 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_Gateway3.png\" alt=\"Public Subnet\" width=\"640\" height=\"162\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Step 3) We will also ensure that we define a custom route table a shown below and attach it to the Public Subnet<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/nat_gateway4.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48459 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/nat_gateway4.png\" alt=\"Public Subnet - NAT Gateway\" width=\"631\" height=\"217\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">And below will be the Main route table which will be attached to the VPC and Private subnet<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_gateway5.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48460 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_gateway5.png\" alt=\"Private Subnet - NAT Gateway\" width=\"630\" height=\"202\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Step 4) Next let\u2019s go ahead and define 2 EC2 Instances. One in the private subnet and the other in the public subnet.<\/p>\n<p style=\"text-align: justify;\">We will use the AMI type of Ubuntu and the Instance Type of t2.micro.<\/p>\n<p style=\"text-align: justify;\">Here are both of the servers in the up and running state<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY6.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48461 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY6.png\" alt=\"NAT Instance\" width=\"627\" height=\"130\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">For the Private server, ensure the Security Group allows for incoming requests from the public server and the NAT gateway.<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY7.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48462 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY7.png\" alt=\"NAT Gateway Private IP\" width=\"633\" height=\"204\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Here we mention the private IP of the public server for Internal SSH and the private IP of the NAT gateway for Internet access.<\/p>\n<p style=\"text-align: justify;\">Step 5) Next we need to create the NAT gateway<\/p>\n<p style=\"text-align: justify;\">Go ahead to the VPC section and create the NAT gateway.<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY8.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48463 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY8.png\" alt=\"VPC Dashboard\" width=\"819\" height=\"465\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">In the definition, just choose the Subnet which is the public subnet. If you don\u2019t have an Elastic IP, you can create a new one via this screen.<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY9.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48464 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATEWAY9.png\" alt=\"Create NAT Gateway\" width=\"632\" height=\"160\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Initially, the NAT gateway will be in the pending state as it is being provisioned.<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/nat_gateway11.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48466 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/nat_gateway11.png\" alt=\"NAT Gateway ID\" width=\"632\" height=\"137\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Once the NAT gateway has been provisioned it will be in the available state.<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATWAY10.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48465 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_GATWAY10.png\" alt=\"NAT Gateway \" width=\"626\" height=\"124\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Step 6) Now we need to modify the Route tables so that the Route in the main route table has a route via the NAT gateway.<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/nat_gateway12.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48467 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/nat_gateway12.png\" alt=\"NAT Gateway Routes\" width=\"642\" height=\"224\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Step 7) Now let\u2019s connect to the server in the public subnet. Ensure the pem key file is copied to the server so that we can connect to the private server from the public server.<\/p>\n<p style=\"text-align: justify;\">Also, ensure the right permissions are given to the key pair.<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_Gateway13.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48468 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/NAT_Gateway13.png\" alt=\"NAT Gateway\" width=\"628\" height=\"365\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Now go ahead and connect to the private server from the public server via the following command<\/p>\n<p style=\"text-align: justify;\">ssh -i &#8220;awsireland.pem&#8221; ubuntu@10.0.2.19<\/p>\n<p style=\"text-align: justify;\">Step 8) To confirm that the private server can connect to the internet, update the packages on the private server<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/nat_gateway14.png\"><img decoding=\"async\" class=\"aligncenter wp-image-48469 size-full\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/nat_gateway14.png\" alt=\"NAT Gateway\" width=\"626\" height=\"362\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">You will see that this works and this is because the private server is now connecting to the internet via the NAT gateway.<\/p>\n<p>[divider \/]<\/p>\n<p><a href=\"https:\/\/www.whizlabs.com\/aws-advanced-networking-speciality\/\" target=\"_blank\" rel=\"noopener noreferrer\"><img decoding=\"async\" class=\"aligncenter size-full wp-image-48472\" src=\"https:\/\/www.whizlabs.com\/wp-content\/uploads\/2017\/12\/Get-40-OFF-on-Spark-Certification-2.jpg\" alt=\"AWS Certified Advanced Networking Speciality\" width=\"728\" height=\"90\" \/><\/a><\/p>\n<p>[divider \/]<\/p>\n<h4 style=\"text-align: justify;\"><b>Important Points to Remember<\/b><\/h4>\n<ul>\n<li style=\"text-align: justify;\">You cannot associate Security Groups with a NAT gateway. You can associate security groups with your resources behind it to control inbound and outbound traffic.<\/li>\n<li style=\"text-align: justify;\">You can use a network ACL to control the traffic to and from the subnet in which your NAT gateway resides.<\/li>\n<li style=\"text-align: justify;\">The NAT gateway must be created in the public subnet<\/li>\n<li style=\"text-align: justify;\">After creation, you must update the route table associated with one or more of your private subnets to point Internet-bound traffic to the NAT gateway. This enables instances in your private subnets to communicate with the internet.<\/li>\n<li style=\"text-align: justify;\">A NAT gateway supports the following protocols: TCP, UDP, and ICMP.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Exam Objective The topic &#8220;NAT Gateway&#8221; addresses the Design and Implementation of AWS Networks as highlighted in the AWS Blueprint for the exam guide https:\/\/d1.awsstatic.com\/training-and-certification\/docs-advnetworking-spec\/AWS_Certified_Advanced_Networking_Blueprint.pdf What is NAT Gateway? This is an appliance which is used to connect instances in your private subnet to the internet. So rather than exposing the private instances in the private subnet directly via the Internet gateway, all the traffic can be routed via the NAT gateway. Now one can also use the NAT instance to drive traffic from private instances. But using the NAT gateway over NAT instances has the following advantages: 1) High [&hellip;]<\/p>\n","protected":false},"author":13,"featured_media":48592,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[4],"tags":[195,205,290,1117,1118],"class_list":["post-48452","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aws-certifications","tag-aws-certification","tag-aws-certified-advanced-networking-specialty","tag-aws-nat-instance","tag-nat-gateway-cloudformation","tag-nat-gateway-vs-internet-gateway"],"uagb_featured_image_src":{"full":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",560,315,false],"thumbnail":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To-150x150.png",150,150,true],"medium":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To-300x169.png",300,169,true],"medium_large":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",560,315,false],"large":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",560,315,false],"1536x1536":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",560,315,false],"2048x2048":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",560,315,false],"profile_24":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",24,14,false],"profile_48":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",48,27,false],"profile_96":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",96,54,false],"profile_150":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",150,84,false],"profile_300":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",300,169,false],"tptn_thumbnail":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To-250x250.png",250,250,true],"web-stories-poster-portrait":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",560,315,false],"web-stories-publisher-logo":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",96,54,false],"web-stories-thumbnail":["https:\/\/www.whizlabs.com\/blog\/wp-content\/uploads\/2017\/12\/An-Introduction-To.png",150,84,false]},"uagb_author_info":{"display_name":"Pavan Gumaste","author_link":"https:\/\/www.whizlabs.com\/blog\/author\/pavan\/"},"uagb_comment_info":1,"uagb_excerpt":"Exam Objective The topic &#8220;NAT Gateway&#8221; addresses the Design and Implementation of AWS Networks as highlighted in the AWS Blueprint for the exam guide https:\/\/d1.awsstatic.com\/training-and-certification\/docs-advnetworking-spec\/AWS_Certified_Advanced_Networking_Blueprint.pdf What is NAT Gateway? This is an appliance which is used to connect instances in your private subnet to the internet. So rather than exposing the private instances in the&hellip;","_links":{"self":[{"href":"https:\/\/www.whizlabs.com\/blog\/wp-json\/wp\/v2\/posts\/48452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.whizlabs.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.whizlabs.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.whizlabs.com\/blog\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.whizlabs.com\/blog\/wp-json\/wp\/v2\/comments?post=48452"}],"version-history":[{"count":1,"href":"https:\/\/www.whizlabs.com\/blog\/wp-json\/wp\/v2\/posts\/48452\/revisions"}],"predecessor-version":[{"id":71703,"href":"https:\/\/www.whizlabs.com\/blog\/wp-json\/wp\/v2\/posts\/48452\/revisions\/71703"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.whizlabs.com\/blog\/wp-json\/wp\/v2\/media\/48592"}],"wp:attachment":[{"href":"https:\/\/www.whizlabs.com\/blog\/wp-json\/wp\/v2\/media?parent=48452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.whizlabs.com\/blog\/wp-json\/wp\/v2\/categories?post=48452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.whizlabs.com\/blog\/wp-json\/wp\/v2\/tags?post=48452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}