2

I created a VPC in aws and added a NAT Gateway so my instances in the VPC can consume other resources on the internet. Some of these resources belong to a 3rd party and are behind a firewall for which my NAT Gateways IP addresses have to be added so that I can successfully connect. They claim to have added my ip addresses but they are unable to verify because in the true nature of the NAT Gateways they are not able to ping/telnet my NAT Gateway IP's with a response. Is there anyway for them to verify if they can establish a connection to my NAT Gateway IP's?

Improve this question
3
  • @Tim that isn't accurate. NAT Gateways have a single EIP. It doesn't change. docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html
    – Michael - sqlbot
    Sep 11, 2018 at 14:46
  • 1
    Oh ok, thanks @Michael-sqlbot . I'll delete my previous comment as it's incorrect. NAT Gateways are an outward communication mechanism, mostly for accessing resources on the internet, so any testing you need to do needs to be for your end.
    – Tim
    Sep 11, 2018 at 20:19
  • 1
    @Tim all the testing i do on my end shows that they havnt configured properlly. But sadly that is not enough for them.
    – Bubunyo Nyavor
    Sep 14, 2018 at 8:51

1 Answer 1

Reset to default
2

Is there anyway for them to verify if they can establish a connection to my NAT Gateway IP's?

Nope, they won't be able to connect to your resources. You must connect to them from inside of your VPC.

However are you positive that your routing through NAT actually works? For VPC NAT you generally need at least 2 subnets:

  1. DMZ (or public) one that has IGW (Internet Gateway) attached and where the resources have Public or Elastic IP address. The default route in the Route Table 0.0.0.0/0 points to the IGW. That's where you set up your NAT Gateway.

  2. Private subnet where the default route 0.0.0.0/0 points to the NAT Gateway and the resources (instances) don't have public IPs.

If you've got these 2 subnets create an EC2 instance in the Private subnet and try to connect to internet, e.g. do curl http://ifconfig.co - if it comes back with your NAT gateway's Elastic IP your routing works. If it times out it's not properly configured and you'll need to dig some more into it.

Only when you get your general internet access working then you can work with your 3rd party on making sure their is set up correctly.

Update

To verify on their end they will have to set up network traffic logging for your NAT IP and verify that

  1. traffic arrives from you to their external interface, and
  2. that traffic is being passed through their firewall to reach the target internal system.

In Linux they can use e.g. tcpdump to monitor the traffic, on Cisco or other HW routers they'll have their own tools. It's up to them to verify that your traffic is being passed through.

Improve this answer
4
  • @bubunyo did the answer help? If yes please accept it to reward the responder with reputation points. Thanks :)
    – MLu
    Sep 14, 2018 at 5:00
  • i had done and confirmed all of these. I can confirm by doing curl http://ifconfig.co on private instances inside the VPC that the right NAT GW ip are being used. My issue is if there is any way for them to verify from their end.
    – Bubunyo Nyavor
    Sep 14, 2018 at 8:50
  • @bubunyo updated the answer with some hints re the remote firewall. You'll need to colaborate with them to verify that.
    – MLu
    Sep 14, 2018 at 9:02
  • @bubunyo did my answers help? If yes please accept it as a reward for the time spent helping you. Thanks!
    – MLu
    Sep 20, 2018 at 3:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .