I created a VPC in aws and added a NAT Gateway so my instances in the VPC can consume other resources on the internet. Some of these resources belong to a 3rd party and are behind a firewall for which my NAT Gateways IP addresses have to be added so that I can successfully connect. They claim to have added my ip addresses but they are unable to verify because in the true nature of the NAT Gateways they are not able to ping/telnet my NAT Gateway IP's with a response. Is there anyway for them to verify if they can establish a connection to my NAT Gateway IP's?
Is there anyway for them to verify if they can establish a connection to my NAT Gateway IP's?
Nope, they won't be able to connect to your resources. You must connect to them from inside of your VPC.
However are you positive that your routing through NAT actually works? For VPC NAT you generally need at least 2 subnets:
DMZ (or public) one that has IGW (Internet Gateway) attached and where the resources have Public or Elastic IP address. The default route in the Route Table
0.0.0.0/0points to the IGW. That's where you set up your NAT Gateway.
Private subnet where the default route
0.0.0.0/0points to the NAT Gateway and the resources (instances) don't have public IPs.
If you've got these 2 subnets create an EC2 instance in the Private subnet and try to connect to internet, e.g. do
curl http://ifconfig.co - if it comes back with your NAT gateway's Elastic IP your routing works. If it times out it's not properly configured and you'll need to dig some more into it.
Only when you get your general internet access working then you can work with your 3rd party on making sure their is set up correctly.
To verify on their end they will have to set up network traffic logging for your NAT IP and verify that
- traffic arrives from you to their external interface, and
- that traffic is being passed through their firewall to reach the target internal system.
In Linux they can use e.g.
tcpdump to monitor the traffic, on Cisco or other HW routers they'll have their own tools. It's up to them to verify that your traffic is being passed through.