A server in a private subnet has no public address and no route to the internet gateway. That is the point of it. But it still has to fetch patches, call partner APIs or upload files. The usual answer is a NAT gateway, and most mistakes with it come down to one question: which route table does each hop use? Follow one packet out and its reply back.
What a NAT gateway is for
The Amazon VPC User Guide puts it in one sentence. You use a NAT gateway “so that instances in a private subnet can connect to services outside your VPC but external services can’t initiate a connection with those instances”. Out is allowed. In is not, unless it is a reply.
There are two connectivity types. A public NAT gateway, the default, gives private instances a way to the internet. A private NAT gateway connects them to other VPCs or to an on-premises network, and you can’t associate an Elastic IP address with it. For internet access you want the public kind, and that is the one this article follows.
The setup
Take one VPC with two subnets. Subnet A is public: its route table sends 0.0.0.0/0 to the internet gateway. Subnet B is private: its route table has only the local route. A batch server in Subnet B must upload files to a bank’s API on the internet.
The VPC guide’s routing for this case:
- The public subnet’s route table, where the NAT gateway lives: the local route, plus
0.0.0.0/0to the internet gateway (igw-...). - The private subnet’s route table, where the server lives: the local route, plus
0.0.0.0/0to the NAT gateway (nat-...).
The NAT gateway itself goes in the public subnet: “You create a public NAT gateway in a public subnet.”
Hop by hop
- The server sends the request. Its source is its private address. Subnet B’s route table matches
0.0.0.0/0and hands the packet to the NAT gateway in Subnet A. - The NAT gateway translates the source. In the guide’s words, it maps “the source private IPv4 address of the instances to the private IPv4 address of the NAT gateway”.
- The NAT gateway forwards the packet using its own subnet’s route table. It lives in Subnet A, so Subnet A’s table decides the next hop:
0.0.0.0/0to the internet gateway. - The internet gateway translates again. For a public NAT gateway, “the internet gateway then maps the private IPv4 address of the public NAT gateway to the Elastic IP address associated with the NAT gateway”. The bank sees the Elastic IP, never the server.
- The reply comes back the same way. It arrives at the Elastic IP, passes the internet gateway, and the NAT gateway “translates the address back to the original source IP address”.
Step 3 is where designs break. A NAT gateway placed in the private subnet has no route to the internet gateway, so the packet stops there.
The same walk explains why nothing gets in. The guide’s considerations state that “Connections must always be initiated from within the VPC containing the NAT gateway.” The batch server has no public address of its own, so there is nothing on the internet side to aim at.
One fixed address for an allowlist
Partners often accept traffic only from addresses they have registered. A NAT gateway helps twice. Every instance behind one NAT gateway reaches the internet from that gateway’s address, and that address is an Elastic IP, which the EC2 guide describes as “static; it does not change over time”. You can check it from inside: the VPC guide suggests a site that shows your source address, which “should be the Elastic IP address of the NAT gateway”.
Public addresses are not free: AWS charges for all public IPv4 addresses, including Elastic IPs and those on running instances. A server behind a NAT gateway that keeps its own public address pays for an address it never uses, and sits one route change away from being exposed.
Availability Zones, and the regional option
A standard NAT gateway is zonal. The comparison page says “NAT gateways in each Availability Zone are implemented with redundancy. Create a NAT gateway in each Availability Zone to ensure zone-independent architecture.” The pattern is one NAT gateway per zone, with each zone’s private subnets routed to the NAT gateway in the same zone. A partner that allowlists addresses then needs each zone’s Elastic IP. A single shared NAT gateway costs less, but every other zone loses its internet access if that gateway’s zone fails.
AWS now also offers regional NAT gateways, which expand and contract across Availability Zones “based on your workload’s presence”. A regional NAT gateway needs no public subnet: AWS gives it its own route table, with a route to the internet gateway already in place. It is not available in every Region, does not support private NAT, and can take up to 60 minutes to expand into a new zone. The walk above uses the zonal design, where placement in a public subnet matters.
What the exam guides ask
The SAA-C03 guide covers this under Task 1.2 “Design secure workloads and applications” and Task 4.4 “Design cost-optimized network architectures”. The SOA-C03 guide has Skill 5.1.1 “Configure a VPC”, Skill 5.3.1 “Troubleshoot VPC configurations” and Skill 5.1.4 “Optimize the cost of network architectures”.
Scenario questions on the topic usually say that instances must reach the internet but must not be reachable from it, often with “least operational overhead” or a partner that needs one fixed source IP. The wrong answers follow a pattern:
- A NAT instance. It works, but the comparison page says its maintenance is “Managed by you”, from operating system patches to a script for failover. A NAT gateway is “Managed by AWS”.
- An egress-only internet gateway. Outbound-only, but for IPv6, so it is not the way out for IPv4 traffic. The VPC guide offers it for “outbound-only internet communication over IPv6”.
- The instance in the public subnet with its own public address. It reaches the internet, and unless its security group and network ACL say otherwise, the internet can reach it.
- A NAT gateway in the private subnet. Its subnet has no route to the internet gateway.
- A security group on the NAT gateway. “You cannot associate security groups with NAT gateways.” You filter with the instances’ security groups and the network ACL of the NAT gateway’s subnet.
When you troubleshoot for real, walk the hops in order: the private subnet’s route to the NAT gateway, the NAT gateway’s subnet route to the internet gateway, then the security groups and network ACLs.
Play it
In Private but Connected, Tally Payroll runs its payslip portal on a locked web server in the public subnet of payroll-vpc. You launch a new batch server that must upload payment files to the bank every night. The bank accepts connections only from a fixed address that Tally registers, and company policy says the batch server must never be reachable from the internet. The palette holds more than you need. Send traffic and the packet stops exactly where your design breaks: at a NAT gateway with no way out, at the bank’s allowlist, or at an internet scanner that should never have got a reply. This stage will be free for everyone when the full game opens. Today’s public preview starts at the free stage Open for Business, which teaches the route table half of this story and plays the same way.