I have a public subnet with ec2 instnaces. The route table has IGW (Internet Gateway) as default.

I tested adding a public IP address to my instance ( as reported by curl ifconfig.co) and when I ssh to that ec2 it returns this IP address, which I expected.

1) My question is since NAT is only for outbound traffic, how they communicate when it sends request or quote to other sites?

2) If I switch IGW (internet gateway) to NAT for public subnet will it mask all outbound traffic to NAT IP address and still able to communicate with other sites?


Generally you will have 2 kinds of subnets in a VPC:

  1. Public subnet

    • has IGW and optionally NAT
    • there points to the IGW
    • hosts (EC2 instances) must have public IP or elastic IP attached as they go directly to the internet
    • hosts can be contacted from the internet on this public/elastic IP (if Security Group permits)
  2. Private subnet

    • has no IGW or NAT
    • the points to the NAT in the public subnet above
    • hosts only have private IP and all outbound access is "masked" to the NAT gateway IP
    • hosts can initiate connections to the internet but can't be contacted from outside as they are "hidden" behind the NAT (Network Address Translation gateway).
    • without NAT configured hosts won't have internet access

Hope that explains it :)

  • I see Thanks! I have another question related with 1-3 If one instance(with EIP) in public subnet associated with a route table with ( to NAT) can communication simultaneously? EIP and NAT IP is different for sure but I am not sure how other clients can communicate. Since they send request to IP A(EIP or can be ELB) and received response from IP B(NAT). Thank you so much
    – tk0221
    Oct 11 '18 at 1:27
  • @TKim yes they can all communicate simultaneously - NAT GW keeps track of the source and dest TCP ports and forwards the packets to the appropriate hosts.
    – MLu
    Oct 11 '18 at 1:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.