I'm trying to hook up my private subnet postgres cluster to have internet access without being publicly accessible. My setup is as follows:

I have a VPC with 4 subnets:

Postgres Subnet with security group allow all ports dest. I have then attached NAT Gateway to my subnet and I allocated and associated an EIP to that NAT.

Then I created a route table that associates with my subnet that is:

  • local
  • My-NAT

I've checked that status of my NAT Gateway and EIP and everything is active and public.

After tunneling and connecting to my private ec2 postgres instance, I cannot ping my NAT Gateway -> Private IP Address where my postgres server is

I am at my wits end. If you need the cloudformation file to help debug, let me know and I will provide that.


  • I cannot ping my NAT Gateway -> Private IP Address where my postgres server is Please consider rewriting this section to explain what you are trying to do, from where. As it stands, it is very difficult to discern what's what and where. Mar 29, 2016 at 10:05

2 Answers 2


Do you have an internet gateway attached to your VPC? Also, put the NAT gateway in a separate subnet.

This is the usual setup:

  • a public subnet with the NAT gateway. The public subnet routing table should redirect to the internet gateway. Make sure your NAT gateway has an EIP.
  • a private subnet for your postgres instance. Make sure the private subnet routs to the NAT gateway.

Amazon restricts icmp traffic by default, be sure you have that enabled on the security group if you want to be able to ping.

If you want to access the Internet via NAT you also have to disable the src/destination checks on the NAT instance.

  • I think he's using the AWS-managed NAT gateway, not an EC2 instance. So src/dest checking doesn't apply here. Mar 29, 2016 at 8:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.