How do I set up a public NAT gateway to access the internet from a private subnet in Amazon VPC?

Short description

You can use a NAT gateway to establish an outbound connection from your Amazon Elastic Compute Cloud (Amazon EC2) instances to resources on the internet. EC2 instances can't use their assigned Private IP addresses to communicate over the internet. NAT gateways use Elastic IP addresses to help private resources communicate with the internet.

Resolution

To set up a NAT gateway for a private Amazon VPC subnet, complete the following steps:

1. Create a public subnet to host your NAT gateway.
2. Create and attach an internet gateway to your Amazon VPC.
3. Create a custom route table for your public subnet with a route to the internet gateway.
4. Verify that the network access control list (ACL) for your public subnet allows inbound traffic from the private subnet. For more information, see Control subnet traffic with network access control lists.
5. Create a public NAT gateway in the public subnet. Then allocate and associate your new or existing Elastic IP addresses to your instance as needed.
6. Update the route table of your private subnet to direct internet traffic to your NAT gateway.
7. Test your public NAT gateway.

Note: Data that's transferred between Amazon EC2 and elastic network interfaces in the same Availability Zone is free. However, you're charged for data that's transferred to and from Amazon EC2 and network interfaces across multiple Availability Zones in the same AWS Region. The charges depend on the data transfer rates for the Region.

Best practices

If your resources span multiple Availability Zones, then create one NAT gateway per Availability Zone to avoid a single point of failure and zone data transfer charges.

Use AWS Trusted Advisor to check whether you configured your NAT gateways with Availability Zone independence. For resources in a specific Availability Zone, use a NAT gateway in the same Availability Zone. For more information, see NAT Gateway AZ Independence.

Related information

Monitor NAT gateways with Amazon CloudWatch