Does an inter-region NAT Gateway work with an AWS Transit Gateway ?

Question

Hello,
I have set up two VPCs in Paris and Ireland with a Transit Gateway because VPC peering, as indicated in the documentation [here](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html#vpc-peering-limitations), does not allow using the NAT device of the Paris VPC from Ireland:
```
If VPC A has a NAT device that provides internet access to subnets in VPC A, resources in VPC B can't use the NAT device in VPC A to access the internet.
```
I opted for a TGW as there is no such restriction. However, when implemented, I am able to successfully communicate between privates resources in the Paris VPC and Ireland VPC, but the Ireland VPC cannot reach the internet through the NAT Gateway located in the Paris VPC. The VPC Reachability Analyzer shows success, but only unidirectionally. The ACLs and Security Groups are properly configured.

Note that resources in the Paris VPC can access the internet without issues, and the NAT Gateway has an Elastic IP (EIP) attached. 
My primary requirement is to maintain the same public IP address for resources in both the Paris and Ireland VPCs.

So, does an inter-region NAT Gateway work with an AWS Transit Gateway ?

Riku_Kobayashi · Accepted Answer

Hello.

Even if your VPC is in a different region, you should be able to use TransitGateway for public communication using NAT Gateway.  
Is the default route (0.0.0.0/0) added to the route table connected to the TransitGateway attachment?

* Ireland VPC

* Paris VPC

Brettski · Answer

While you can do this I would argue that you will incur additional cost and network latency by sending the traffic to another region to egress to the internet. Of course, having a second NAT Gateway also incurs cost so I can understand why you might do this; but in general we try to discourage customers from building inter-region dependencies - if there is some sort of failure it is good to keep your applications that are running in different regions independent of each other.

EXPERT

Brettski

answered 2 years ago

EXPERT

Tushar Jagdale

reviewed 2 years ago

qko · Answer

Thank you for your responses. I have already had the opportunity to review these links, and I will look at them again. I will keep you updated.
To answer you, Brettski-AWS, as mentioned earlier, the issue is due to the need to maintain the same public IP address through the NAT Gateway.

qko · Answer

Great, it works now!
The issue was the missing route on the public subnet with the Ireland VPC CIDR.
That makes sense, thank you!

Didier Durand · Answer

Hi,

You have a very close to what you're willing to achieve in this fully detailled example: https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-nat-igw.html

Best,

Didier

Does an inter-region NAT Gateway work with an AWS Transit Gateway ?

Add your answer

Relevant content

CIDR	Target
0.0.0.0/0	TransitGateway attachment
Paris VPC CIDR	TransitGateway attachment
VPC CIDR	Local

CIDR	Target
0.0.0.0/0	NAT Gateway
Ireland VPC CIDR	TransitGateway attachment
VPC CIDR	Local

CIDR	Target
0.0.0.0/0	Internet Gateway
Ireland VPC CIDR	TransitGateway attachment
VPC CIDR	Local