According to the AWS docs it is possible to setup HA between two EC2 instances, however I would like to use only a single EIP.

If you scroll down the page to the section related to elastic ips, the tutorial mentions that we will need 3 EIPs. I am configuring each NAT instance to reside in a different availability zone, but within the same VPC. With this config I should only need 1 EIP as the VIP, then use internal IPs to facilitate communication between NAT-1 and NAT-2 correct? Using 3 EIPs in this situation seems like overkill.

Goal is to be able to ssh to gateway.sn3.domain.com (via single EIP) and gain access even if the primary NAT (NAT-1) is down.


Looks like I may have to but an ELB in front of the NATs in order to support this.

aws ec2 elastic ip to multiple instance

  • 1
    ELB won't help you on a NAT instance. It's a layer 4/7 service, only for delivering inbound TCP connections to a pool of instances on specific configured ports. But, there'a this: docs.aws.amazon.com/AWSEC2/latest/UserGuide/… ... as a side note, I just upgraded a NAT instance today that had been working for 35 months with no intervention. Oct 13, 2015 at 22:56

1 Answer 1


According to the AWS notes:

Note: Because the set of IP addresses associated with a LoadBalancer can change over time, you should never create an "A" record with any specific IP address. If you want to use a friendly DNS name for your load balancer instead of the name generated by the Elastic Load Balancing service, you should create a CNAME record for the LoadBalancer DNS name, or use Amazon Route 53 to create a hosted zone. For more information, see Using Domain Names With Elastic Load Balancing.

So I did what they recommended, and it works great! I did notice that under-the-hood they associated two public IPS as they are visible when I dig the dns entry, but via the AWS console, the instances associated to the loadbalancer do NOT have public ips.

Setup ended up like this:

CNAME    gateway.sn3.example.com   lb-nat.somecrazy-dns-entry-aws-creates

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.