-2

There is a vpc on amazon that has two subnets. The outer one has internet access and the inner one using NAT server to connect to internet. Inner subnet have plenty of servers for development and testing. Now I need to use separated NAT server for development and test.

Is it possible? If yes then how?

1

2 Answers 2

1

Of course you can do that! You don't even have to create a new DHCP options set.

A NAT instance in EC2 is just the same as any other instance. It just happens to do NAT.

In your particular case, you'll also need to ensure the routing table associated with each of your subnets has got a static route for the "inner" network, via that NAT instance's RFC1918 IP address. It will need its own EIP as well, since talking between VPCs is like talking over the Internet.

It sounds like you might be trying to do NAT between different subnets in the same VPC, though. Don't do that; it's generally not a good idea and will be a waste of money.

If you're doing things intra-VPC but between subnets, the correct way to manage security isolation is to use security groups with ingress and egress rules to apply security constraints. Not that NAT gives you security, but many people abuse it for that. You don't need to use NAT, because your VPC's RFC1918 address space is routeable inside your VPC. Each subnet's default gateway knows to route RFC1918 IP addresses inside your VPC to the correct subnet.

0

You can have a similar set up using another NAT server.

Assuming you will be placing the new NAT in the same subnet as the original NAT, you can setup a new subnet exactly like the original (inner) subnet you have--just make sure to use the new NAT when setting up the route tables and security groups.

1
  • ok, so only solution is creating new subnet?
    – Bagi
    Nov 26, 2014 at 8:44

Not the answer you're looking for? Browse other questions tagged .