NAT Gateway for private subnet internet in AWS - Step-by-Step Execution

Process Flow - NAT Gateway for private subnet internet

Private Subnet Instance

↓

Route Table: directs 0.0.0.0/0 to NAT Gateway

↓

NAT Gateway in Public Subnet

↓

Internet Gateway

↓

Internet

Traffic from private subnet instances goes to NAT Gateway via route table, then to Internet Gateway, enabling internet access without exposing private instances.

Execution Sample

AWS

1. Create NAT Gateway in public subnet
2. Update private subnet route table to send 0.0.0.0/0 to NAT Gateway
3. Private instances send internet traffic to NAT Gateway
4. NAT Gateway forwards traffic to Internet Gateway
5. Responses return back through NAT Gateway to private instances

This setup allows private subnet instances to access the internet securely via the NAT Gateway.

Process Table

Step	Action	Source	Destination	Route Used	Result
1	Instance sends request to internet	Private Subnet Instance	Internet IP	Route to NAT Gateway	Traffic sent to NAT Gateway
2	NAT Gateway receives traffic	NAT Gateway	Internet IP	Uses Internet Gateway	Traffic forwarded to Internet
3	Internet responds	Internet IP	NAT Gateway	Internet Gateway	Response received by NAT Gateway
4	NAT Gateway forwards response	NAT Gateway	Private Subnet Instance	Internal routing	Instance receives response
5	Instance processes response	Private Subnet Instance	Internal	N/A	Internet access successful
6	Instance tries direct internet access	Private Subnet Instance	Internet IP	No direct route	Fails - no direct internet access

💡 Private subnet instances cannot access internet directly; all traffic must go through NAT Gateway.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Instance Internet Access	No	Request sent	Request forwarded	Response received	Response forwarded	Yes

Key Moments - 3 Insights

Why can't private subnet instances access the internet directly?

Because their route table directs internet traffic to the NAT Gateway, not directly to the Internet Gateway, as shown in execution_table row 6.

What role does the NAT Gateway play in internet access?

It acts as a middleman forwarding traffic between private instances and the internet, enabling responses to return, as seen in execution_table rows 2, 3, and 4.

Why is the NAT Gateway placed in the public subnet?

Because it needs direct access to the Internet Gateway to forward traffic, which private subnets do not have, as shown in concept_flow.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does the NAT Gateway forward the internet request to the Internet Gateway?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Check the 'Action' and 'Result' columns in execution_table row 2.

According to variable_tracker, when does the instance first receive the internet response?

A After Step 2

B After Step 3

C After Step 4

D After Step 5

💡 Hint

Look at the 'Instance Internet Access' variable changes in variable_tracker after each step.

If the private subnet route table was changed to point 0.0.0.0/0 directly to the Internet Gateway, what would happen?

A Instances would lose internet access

B Instances would access internet directly

C NAT Gateway would still be used

D Internet Gateway would block traffic

💡 Hint

Refer to key_moments about routing and direct internet access.

Concept Snapshot

NAT Gateway for private subnet internet:
- Place NAT Gateway in public subnet with Elastic IP
- Private subnet route table directs 0.0.0.0/0 to NAT Gateway
- Private instances send internet traffic to NAT Gateway
- NAT Gateway forwards traffic via Internet Gateway
- Enables internet access without exposing private instances

Full Transcript

This visual execution shows how a NAT Gateway enables internet access for instances in a private subnet. The private subnet's route table sends all internet-bound traffic to the NAT Gateway located in a public subnet. The NAT Gateway then forwards this traffic to the Internet Gateway, which connects to the internet. Responses from the internet return through the Internet Gateway and NAT Gateway back to the private instances. Direct internet access from private instances fails because their route table does not point to the Internet Gateway. This setup secures private instances by not exposing them directly to the internet while allowing outbound internet connectivity.