I'm trying to configure outgoing internet access over "NAT Gateway" for several EC2 instances, so that f.e. curl ifconfig.co returns the same ip for all instances & the outside statistics server they connect to show the same ip.

At the same time these instances must be still accessible over their public IPs (each ec2 instance has it own public ip), be accessible for ssh , serve web content & be accessible for each other on their private ips.

Instances had only eth0 interfaces with subnet addresses on it (www1). I cannot see the interface for the public ip with ifconfig, but I guess it's an expected behavior for ec2 instances. They are all behind the Elastic Load Balancer.

I've created a second subnet www2 with CIDR block =

I've created a NAT Gateway & assigned an Elastic ip to it & chose the subnet www2. The private ip of the NAT Gateway is shown correctly as

I've created the network interface in EC2->Network interfaces for one of the instances with the subnet selected + private ip auto assign + security group same as for other instances which has SSH TCP 22 for inbound rules & all traffic 0-65535 for outbound traffic.

The instance indeed got the second eth1 interface after with the correct ip= auto-assigned to it. Here's the ip route show from that instance:

ip route show
default via dev eth0
default via dev eth1  metric 10001 dev eth0  proto kernel  scope link  src dev eth1  proto kernel  scope link  src dev eth0

Here's the ifconfig:

eth0      Link encap:Ethernet  HWaddr 0A:65:1C:28:80:7E
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::865:1cff:fe28:807e/64 Scope:Link
          inet6 addr: 2600:1f18:4328:e200:4f10:db4d:6a56:d900/64 Scope:Global
          RX packets:10978429 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8536463 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:26095196998 (24.3 GiB)  TX bytes:2202490320 (2.0 GiB)

eth1      Link encap:Ethernet  HWaddr 0A:9D:28:92:38:0E
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::89d:28ff:fe92:380e/64 Scope:Link
          RX packets:262217 errors:0 dropped:0 overruns:0 frame:0
          TX packets:197708 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:237017161 (226.0 MiB)  TX bytes:50706247 (48.3 MiB)

lo        Link encap:Local Loopback
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:420172 errors:0 dropped:0 overruns:0 frame:0
          TX packets:420172 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:1399654528 (1.3 GiB)  TX bytes:1399654528 (1.3 GiB)

After that if I go to VPC dashboard->Route tables->Edit routes for the appropriate routing table for all of my instances & set "nat-06931899c65346b40" instead of igw-fd92cc9a for in destination I get disconnected from the ssh session & the website hosted on the instance becomes unavailable. I guess it's expected as it is behind NAT now.

BTW it didn't look good to me that the security group of the NAT Gateway in the EC2->Network interfaces is empty, but when I try to set it to the same as the other instances (or any other at all) with "change security groups" I get "You do not have permission to access the specified resource."

So I'd like my instances to be accessible over their public ips over http & ssh, but to report the same ip with curl ifconfig.co.

The goal is not to edit the routing table on each instance manually as we prepare for auto-scaling & use the aws web console provided options.

But even if I do it manually, how exactly do I edit the routes to achieve my goal?

The general network scheme before adding the NAT Gateway was: VPC Internet gateway <-> ELB <-> ec2 instances (with public ips accessible). The web content from the instances is served through the ELB, but the instances themselves are available for ssh over their public ips directly.

Thanks in advance!

  • When you say you created a NAT gateway, do you mean you created a NAT instance? NAT instance is an EC2 instance you create and maintain yourself. A NAT Gateway is an AWS provided NAT. This is an important distinction.
    – Tim
    Jul 3, 2017 at 17:29
  • It was a NAT Gateway, not an instance. Jul 3, 2017 at 23:08

1 Answer 1


I don't see a way to do this without changing your routing tables.

You need two route tables (RT1 and RT2):

RT1 associated with the subnet: Destination:, Target igw-fd92cc9a
RT2 associated with the subnet: Destination:, Target nat-06931899c65346b4

Change your instance's routing table to give the default route via a lower (more preferred) metric.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.