Why can't I use NAT to connect my EC2 instance in a private subnet to the internet?

Resolution

Verify destination reachability and NAT gateway status

Check whether the destination is reachable from another source through a public IP address. Confirm that the NAT gateway is in the Available state. If the NAT gateway is in the Failed state, then see NAT gateway creation fails.

Note: A NAT gateway that is in the Failed state automatically deletes after about one hour.

Confirm your subnet and route table configurations

Verify that you created your NAT gateway in a public subnet. Confirm that the public route table has a default route that directs traffic to an internet gateway. Also, confirm that the private subnet's route table has a default route that directs traffic to the NAT gateway.

Important: Make sure that you don't use the same route table for both the private and the public subnet. When you use the same route table, traffic doesn't route to the internet.

To prevent DNS resolution failures, set the enableDnsSupport attribute to true in your virtual private cloud (VPC). For more information, see View and update DNS attributes for your VPC.

Check firewall and port settings

Verify that firewalls allow traffic over ports 80 for HTTP traffic and port 443 for HTTPS traffic on the source and destination host. To check connectivity, run the following command:

telnet PUBLIC_IP TCP_PORT

Review security group settings

Make sure that the security group attached to the instance's elastic network interface allows outbound traffic to ports 80 and 443. For more information, see Amazon EC2 security groups for your EC2 instances.

Check the network access control list (ACL) associated with the NAT gateway subnet. To give your EC2 instances access to an HTTPS website, the network ACL associated with the NAT gateway subnet must have the following rules:

Inbound rules

Source	Protocol	Port range	Allow/Deny
VPC CIDR	TCP	443	ALLOW
PUBLIC_IP	TCP	1024-65535	ALLOW

Outbound rules

Destination	Protocol	Port range	Allow/Deny
PUBLIC_IP	TCP	443	ALLOW
VPC CIDR	TCP	1024-65535	ALLOW

For more information on how to configure network ACLs, see Control subnet traffic with network access control lists.

Related information

NAT gateways

Configure route tables