amazon-aws: How to enable outbound internet connectivity for AWS VPC with only a private subnet?

Question

Currently in our setup, we have a private and public subnet in VPC A that is peered to VPC B. VPC A has outbound connectivity routed through an internet gateway and a NAT gateway (for enabling internet access for ec2 instances in our private subnet). VPC B only has a private subnet that has no internet access to it's local ec2 instances. According this documentation, it seems hopping internet connectivity between the two VPC's isn't supported across a peered connection: https://docs.aws.amazon.com/vpc/latest/peering/invalid-peering-configurations.html

This leads me to my question: Is it possible to enable internet connectivity with only a private subnet utilizing a NAT gateway? Or can this only be done in conjunction with a public subnet associated with an internet gateway, similar to VPC A? If this possible through other means, what are my options?

Answer 1

Your Private-only VPC can't have NAT gateway as NAT requires a public IP.

You can however give the instances in VPC B access to internet indirectly if you set up an Outbound Proxy in your VPC A. You can use for example Squid Proxy. That proxy will accept requests from VPC B instances and relay them to the internet.

Your instances in VPC B can then set http_proxy=http://proxy.vpc-a:3128 and https_proxy=http://proxy.vpc-a:3128 and that way can reach the internet.

The added benefit is that your Proxy can log all the traffic and also restrict access to websites according to a whitelist. That may be required in some regulated environments.

Hope that helps :)

Answer 2

You cannot connect to the internet through VPC peering. So for a VPC to access the internet, it must do so directly on it's own.

As for how to get access to the internet, only resources in public subnets can access the internet directly:

• The subnet must have a route to an Internet Gateway, and
• The EC2 instance/NAT must have a public (or Elastic) IP address.

For a resource in a private subnet to access the internet, the private subnet must have a route routing through a NAT, which would need to be in a public subnet. It can be a NAT gateway, or an EC2 instance functioning as a NAT.