13

As I understand it, a public subnet is one that can route traffic to the internet via an Internet Gateway, and a private subnet is one that cannot (can't reach the internet nor it can be reached from it). In order to reach the internet, a private subnet needs to route traffic through a NAT Gateway.

I can confirm this because I am actually using this setup successfully.

But... the Amazon docs say otherwise (bold emphasis is mine): VPC with Public and Private Subnets (NAT)

The instances in the public subnet can receive inbound traffic directly from the Internet, whereas the instances in the private subnet can't. The instances in the public subnet can send outbound traffic directly to the Internet, whereas the instances in the private subnet can't. Instead, the instances in the private subnet can access the Internet by using a network address translation (NAT) instance that you launch into the public subnet.

Does it matter where the NAT gateway resides? If it does, what are the use cases of putting it in a private/public subnet?

5
  • 1
    NAT instance != NAT gateway. The gateway is a managed solution, but it's entirely possible to launch your own unmanaged NAT instances, which need to go in the public subnet to have access to the public internet.
    – ceejayoz
    Jun 7, 2017 at 17:34
  • @ceejayoz You are right, ooops! I updated the title to make my question more precise.
    – Julian
    Jun 7, 2017 at 17:37
  • I have changed "gateway" to "instance" for you in your question.
    – Tim
    Jun 7, 2017 at 19:14
  • @Tim that would be incorrect. I will roll back the change. I specifically mean gateway as in the particular service provided by Amazon called NAT Gateway. I'm not interested in generic networking answers but specifically an AWS specific answer (hence the tags).
    – Julian
    Jun 7, 2017 at 19:20
  • Ok, sorry about that. The comments above made it look like you were referring to a NAT instance. Note that a NAT Gateway is a managed product from AWS, a NAT instance is an EC2 instance you create that does NAT for your VPC.
    – Tim
    Jun 7, 2017 at 19:36

3 Answers 3

19

A NAT Gateway (as well as a NAT Instance, for what it's worth) must be in a public subnet because only devices on public subnets can actually use a public IP address.

That's what makes a public subnet a public subnet.

The pedantic definition of a public subnet is a subnet whose associated VPC route table has at least one route pointing to the Internet Gateway... but in practice, it's usually a subnet with its default route (in the VPC route table) pointing to the Internet Gateway.

By contrast, a private subnet is a subnet without such a route. Usually, the default route for a private subnet points to a NAT device, though it could point to a hardware VPN or Direct Connect connection.

If a NAT device isn't on a public subnet, it (by definition) has no routes by which the traffic it has translated can reach the Internet, because its outgoing traffic follows the route table for the subnet on which it is located... so the subnet the NAT Gateway is placed on -- again, by definition -- must be a public subnet.

There is no security implication of placing a NAT Gateway on a public subnet, since incoming connection attempts are never accepted under any circumstances. This is something you can't misconfigure.

If you're thinking in LAN terms, the natural assumption is that a NAT device needs to be "on" at least 2 subnets, the external (public addresses) subnet and the internal (private addresses) subnet -- but the VPC network is not the LAN it appears to be. It's a software-defined layer 3 network that emulates Ethernet very cleanly, but it isn't Ethernet.

6
  • @michaek - sqlbot What happens if I send a http request via this NAT gateway, will the response be dropped off at the NAT gateway? Since, you said " incoming connection attempts are never accepted under any circumstances". Afaik, it does accept, only in case, the connection was initiated from the private IPs. Could you please comment and correct me if I am wrong? Thank you. Jan 2, 2020 at 17:44
  • 1
    @SuhasChikkanna if the connection is initiated from a private IP behind the NAT Gateway then by definition it is not an incoming connection attempt -- that's an outgoing connection. Jan 2, 2020 at 21:46
  • Yes, you are right. So that would mean, an outgoing connection attempt from an application on private machine can receive the response and access the internet successfully?. Jan 6, 2020 at 12:45
  • 1
    @SuhasChikkanna that is correct. Jan 6, 2020 at 15:22
  • I'm wondering why in this example they put the NAT Gateway in the "Main route table" which is associated with the private subnet docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html
    – user345602
    Apr 22, 2021 at 15:33
1

The difference between public and private addressing is that ISPs have agreed not to route packets using the arbitrarily assigned private addressing. From the perspective of IP, there is actually no difference between private and public addresses, and addressing is done the same way with either.

The logical place for NAT is where you connect a private network to an ISP, which will not route packets with private addresses. This is usually at the edge of the private addressing zone, but that is not necessarily the best place. For example, many companies have both private and public addresses, and it isn't necessary to NAT between the public and private zones within the company, but it is required between the company and any ISPs the company uses for any traffic using private addresses to and from the public Internet. That location may be in a company's public zone if all the traffic with private addressing flows through the company's public zone to get to the public Internet.

0

NACLs and route-tables apply to a NAT-gateway, so you can consider NAT-gateway as another EC2 instance and hence it needs to be in public subnet to access internet-gateway and route traffic.

I dont see any other uses of NAT-gateway in AWS, which cant be solved by route-tables.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .