1

I have a VPC with several ec2 instances. Each one has a public ip + is able to communicate with each other over local 10.0.0.0 network + have internet access over internet gateway.

I need to put only several of those instances behind NAT Gateway with Elastic IP assigned to it, so when they connect to a certain outside service, they have the same public ip.

The problem is that I can't find a way to put only certain members of VPC behind this NAT Gateway. I can edit routing table for the VPC in general & that's it.

I couldn't find a way to create another VPC & include only certain members of the first VPC into it.

So what is the best way to do that?

P.S. it is a NAT Gateway, not a NAT instance.

So i have created a new subnet for the VPC, created a new network interface & attached it to one of the instances: The instance got the new ip from this subnet & the new route was created automatically:

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         ip-10-0-1-1.ec2 0.0.0.0         UG    0      0        0 eth0
default         ip-10-0-200-1.e 0.0.0.0         UG    10001  0        0 eth1
10.0.1.0        *               255.255.255.0   U     0      0        0 eth0
10.0.200.0      *               255.255.255.0   U     0      0        0 eth1
instance-data.e *               255.255.255.255 UH    0      0        0 eth0
Improve this question
1

1 Answer 1

Reset to default
0

You will needs to create a 2nd Subnet in your VPC. You would then deploy the EC2 instances that need NAT to that subnet. They will pick up private IPs from that subnet. Next create a new Route table and associate it with the new subnet. finally adjust the new route table and add a default route of 0.0.0.0/0 that uses your NAT Gateway.

The NAT Gateway should be deployed to your existing public subnet so that it can take advantage of the Internet gateway.

Hope this helps.

Mike.

Improve this answer
26
  • when I create a NAT Gateway I must select the subnet it is attached to. So I choose the new subnet 10.0.200.0/24, right? The Internet Gateway is "attached" to VPC, not the subnet.
    – GTXBxaKgCANmT9D9
    Jul 4, 2017 at 11:19
  • Hi there, no choose the public subnet to deploy your NAT Gateway to(the original subnet). NAT Gatways need to be deployed to public subnets so they can use the Internet Gateway to get to the internet. the EC2 instances that you deploy to the new subnet, with the new route table will be able to use the NAT Gateway
    – Michael Brown
    Jul 4, 2017 at 11:25
  • OK, so the original subnet with access to internet gateway is 10.0.1.0/24. I have created a new NAT Gateway & attached it to this subnet & it received an 10.0.1.104 address. I'm confused about the purpose of creation of the second 10.0.200.0/24 subnet, but if it's supposed to work like that - ok. Now if I go to the "VPC Dashboard->Route tables" I can see only 1 route table for the VPC & if I edit it, then every instance in the VPC will be affected. If I edit it & replace "igw-fd92" for 0.0.0.0/0 with "nat-01ed" then I'll lose connection to all instances in it,right? How do I avoid it?
    – GTXBxaKgCANmT9D9
    Jul 4, 2017 at 11:45
  • OK, you've got the second subnet, now you need to create a new Route table, associate the new route table with the new subnet and add the default route 0.0.0.0/0 with nat-01ed to that. then deploy EC2 instance to the new subnet and they will be able to use the NAT Gateway
    – Michael Brown
    Jul 4, 2017 at 11:48
  • Here is a link to details on AWS NAT Gateways: docs.aws.amazon.com/AmazonVPC/latest/UserGuide/…
    – Michael Brown
    Jul 4, 2017 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.