I have a VPC "VPC with Public and Private Subnets" created via the VPC wizard which should include NAT for the private subnet VPCs however it's not working. They are unable to browse the internet, resolve internet names and ping internet IPs.

This is a stock standard conf, I am very sure of that so I am unsure why it's not working. Perhaps there was something additional I am supposed to do that I don't know about?

Thank you,



with default vpc, amazon dhcp gives the instances a private ip, which cannot be routed out from the aws internet gateway (this device looks like IGW-xxxxxxx via console). so unless the aws instances route to the internet thru the ipsec tunnel gateway (looks like VGW-xxxxxx), there are two ways to allow connectivity out to the internet.

1) give vpc instances public elastic ip's, ensure a default route to the amazon internet gateway, then add a route for your private lan to the ipsec termination gateway

2) set up a second instance with iptables masquerading, and then have default route to that device, while keeping the private lan route to the ipsec termination point (back to your offic)

with #1, if instances have public eip, then may be connected to from the internet, if you are not careful with security groups.

with #2, all traffic is limited by the masquarading instance, which is then a point of failure. (by using amazons internet gateway, im sure they use VRRP/HSRP/CARP/ETC, so its HA). also, although it has not happened to me personally, the private ip of the masq'ing box could change, and so you would need to update dhcp lease info, and then force/wait to renew instance leases.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.