Internet Gateway vs NAT Gateway: Key Differences and Usage

An Internet Gateway allows resources in a public subnet to connect directly to the internet with public IPs. A NAT Gateway enables resources in private subnets to access the internet securely without exposing their private IPs by translating them to a public IP.

Quick Comparison

This table summarizes the main differences between an Internet Gateway and a NAT Gateway in AWS.

Feature	Internet Gateway	NAT Gateway
Purpose	Connects public subnet resources directly to the internet	Allows private subnet resources to access the internet securely
Subnet Type	Used with public subnets	Used with private subnets
IP Addressing	Requires public IPs on instances	Instances keep private IPs; NAT Gateway has a public IP
Inbound Traffic	Allows inbound and outbound internet traffic	Allows only outbound internet traffic; blocks inbound unsolicited traffic
Use Case	Web servers, public-facing services	Private backend servers needing internet access (e.g., updates)
Cost	No additional hourly charge	Charged hourly plus data processing fees

Key Differences

An Internet Gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between instances in your VPC and the internet. It is attached to your VPC and routes traffic from public subnets that have instances with public IP addresses. This gateway supports both inbound and outbound traffic, meaning internet users can reach your public-facing resources directly.

In contrast, a NAT Gateway is used to enable instances in private subnets to initiate outbound internet traffic while preventing inbound connections from the internet. It translates private IP addresses to its own public IP address, allowing secure internet access for updates or external API calls without exposing the private instances. NAT Gateways only allow outbound traffic and block unsolicited inbound traffic, enhancing security for private resources.

Another key difference is cost and management: Internet Gateways are free and managed by AWS, while NAT Gateways incur hourly and data processing charges. Also, NAT Gateways require placement in a public subnet and must be associated with an Elastic IP address.

Internet Gateway Code Example

terraform

resource "aws_internet_gateway" "example" {
  vpc_id = aws_vpc.example.id
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.example.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.example.id
  }
}

resource "aws_route_table_association" "public_assoc" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}

Output

Creates an Internet Gateway attached to the VPC and routes public subnet traffic to the internet.

NAT Gateway Equivalent

terraform

resource "aws_eip" "nat_eip" {
  vpc = true
}

resource "aws_nat_gateway" "example" {
  allocation_id = aws_eip.nat_eip.id
  subnet_id     = aws_subnet.public.id
}

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.example.id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.example.id
  }
}

resource "aws_route_table_association" "private_assoc" {
  subnet_id      = aws_subnet.private.id
  route_table_id = aws_route_table.private.id
}

Output

Creates a NAT Gateway with an Elastic IP in the public subnet and routes private subnet traffic through it for internet access.

When to Use Which

Choose an Internet Gateway when you want your instances to be directly reachable from the internet, such as for web servers or public APIs. These instances must have public IP addresses and reside in public subnets.

Choose a NAT Gateway when you want to keep your instances private and secure but still allow them to access the internet for updates, patches, or external services. This is common for backend servers, databases, or application servers that should not be exposed publicly.

Using both together is common: Internet Gateway for public subnets and NAT Gateway for private subnets, ensuring a secure and functional network architecture.

Key Takeaways

Internet Gateways connect public subnet instances directly to the internet with public IPs.

NAT Gateways enable private subnet instances to access the internet securely without public IPs.

Internet Gateways allow inbound and outbound traffic; NAT Gateways allow only outbound traffic.

NAT Gateways incur additional costs; Internet Gateways are free.

Use Internet Gateway for public-facing resources and NAT Gateway for private backend resources.