Can you have two NAT gateways in a route table for one or more subnets?

0
votes

I have the following scenario:

I have a Public and Private subnet in my VPC. The public subnet will send the traffic obviously through the internet gateway, and private goes through a separate NAT gateway.

The issue I am faced with - is we have a Mail Server/Exchanger inside our private subnet. Right now, the NAT gateway that is serving our other EC2 devices has an elastic IP address. We need to provide a separate Elastic IP address to the MX server. Can that be done by setting up another NAT gateway? If so, how do I set up the route tables/subnets to handle that?

I thought I may need to create a new subnet and place the MX in there, but am not entirely sure.

The main reason for this all being the use of rDNS (Reverse DNS) - when email is sent from our MX server, it will have an origin IP address, which -should- map back to your sending TLD (@emailaddress.com) for spam circumvention.

If I can get this MX server to route its outgoing traffic through the new NAT gateway, things will be great - because then I can just tell AWS to map the IP address provisioned to that rDNS arpa thing.

What is the best course to follow here?

2
amazon-web-servicesnetworkingamazon-ec2routingsubnet
Don't you need the mail server to accept incoming connections from the internet? A mail server would normally allow incoming access to imap or pop3 service from the internet. If it's on a private subnet, it cannot receive incoming connections. The nat gateway is for outgoing traffic only. – Rodrigo M
@RodrigoM It is load balanced. The incoming data works fine – Barry Chapman

2 Answers

2
votes

You are right - you should create another subnet(s) for the MX server(s) and assign routes to the route tables of those subnets to new NAT gateways.

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html

I'm assuming you are using a load balancer to receive traffic to the MX server? If so you shouldn't have any problems being on a private subnet.

You should be able to setup your DNS to point to the NAT Gateway for reverse lookups, though if you are using multiple MX servers, AZ's and NAT Gateways this will be tricky.

0
votes

One subnet can be associated with only one route table. One route table can route traffic to a destination through a single gateway.

So you need a need new private subnet and a new route table.

Then you can assign the destination to the route table. 

0.0.0.0 => NatGatewayForMx

hope this helps.