AWS VPC NAT Not Working

Question

I've setup a VPC on AWS and I'm trying to make one of my subnets private. I have:

1. Created my private subnet.
2. Created my NAT Gateway and associated my subnet to it.
3. Created a Route Table dest: 0.0.0.0/0 target: NAT Gateway
4. Created an Instance in my private subnet.

I can get to the instance in #4 by going to a different instance with a public IP then SSHing to its private IP. Once on the instance it has no internet connectivity.

Am I expected to update the route tables on the instance anything?

Answer 1

Turns out I was creating my NAT Gateway in my private subnet; should have been done in my public subnet. When I was creating it I assumed the subnet I was providing was the one I wanted to be NATed not where to create it.

Re-reading the docs here helped discover my error:

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-gateway.html#nat-gateway-creating

thx.

Answer 2

Had an issue with my NAT instance as well.

It ends up I didn't set up the security group of the NAT instance correctly. My NAT instance security group was allowing port 22 only.

Once I add port 80 (HTTP) and port 443 (HTTPS) to the security group, my instance in private subnet can connect to the internet.

Some points to be noted when creating a NAT instance:

1. The NAT instance needs to be in the public subnet.
2. The source and destination check of the NAT instance must be disabled.
3. At least allow port 80/443 on the security group of the NAT instance.
4. Associate outbound route of private subnet to NAT instance in route table.

Answer 3

Did you follow all the instructions here? In particular make sure you disable Source/Destination checks on the NAT instance.

Alternatively, AWS now has Managed NAT Gateways.

Answer 4

In my case it wasn't working because I had the NAT in the private subnet instead of the public one.