I created a VPC in aws and added a NAT Gateway so my instances in the VPC can consume other resources on the internet. Some of these resources belong to a 3rd party and are behind a firewall for which my NAT Gateways IP addresses have to be added so that I can successfully connect. They claim to have added my ip addresses but they are unable to verify because in the true nature of the NAT Gateways they are not able to ping/telnet my NAT Gateway IP's with a response. Is there anyway for them to verify if they can establish a connection to my NAT Gateway IP's?

  • @Tim that isn't accurate. NAT Gateways have a single EIP. It doesn't change. docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html – Michael - sqlbot Sep 11 '18 at 14:46
  • 1
    Oh ok, thanks @Michael-sqlbot . I'll delete my previous comment as it's incorrect. NAT Gateways are an outward communication mechanism, mostly for accessing resources on the internet, so any testing you need to do needs to be for your end. – Tim Sep 11 '18 at 20:19
  • 1
    @Tim all the testing i do on my end shows that they havnt configured properlly. But sadly that is not enough for them. – Bubunyo Nyavor Sep 14 '18 at 8:51

Is there anyway for them to verify if they can establish a connection to my NAT Gateway IP's?

Nope, they won't be able to connect to your resources. You must connect to them from inside of your VPC.

However are you positive that your routing through NAT actually works? For VPC NAT you generally need at least 2 subnets:

  1. DMZ (or public) one that has IGW (Internet Gateway) attached and where the resources have Public or Elastic IP address. The default route in the Route Table points to the IGW. That's where you set up your NAT Gateway.

  2. Private subnet where the default route points to the NAT Gateway and the resources (instances) don't have public IPs.

If you've got these 2 subnets create an EC2 instance in the Private subnet and try to connect to internet, e.g. do curl http://ifconfig.co - if it comes back with your NAT gateway's Elastic IP your routing works. If it times out it's not properly configured and you'll need to dig some more into it.

Only when you get your general internet access working then you can work with your 3rd party on making sure their is set up correctly.


To verify on their end they will have to set up network traffic logging for your NAT IP and verify that

  1. traffic arrives from you to their external interface, and
  2. that traffic is being passed through their firewall to reach the target internal system.

In Linux they can use e.g. tcpdump to monitor the traffic, on Cisco or other HW routers they'll have their own tools. It's up to them to verify that your traffic is being passed through.

  • @bubunyo did the answer help? If yes please accept it to reward the responder with reputation points. Thanks :) – MLu Sep 14 '18 at 5:00
  • i had done and confirmed all of these. I can confirm by doing curl http://ifconfig.co on private instances inside the VPC that the right NAT GW ip are being used. My issue is if there is any way for them to verify from their end. – Bubunyo Nyavor Sep 14 '18 at 8:50
  • @bubunyo updated the answer with some hints re the remote firewall. You'll need to colaborate with them to verify that. – MLu Sep 14 '18 at 9:02
  • @bubunyo did my answers help? If yes please accept it as a reward for the time spent helping you. Thanks! – MLu Sep 20 '18 at 3:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.