Creating NAT Gateways in AWS

Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal

​

Overview

​

Lab details

1. This lab guides you through the process of setting up a NAT Gateway to enable internet access for instances in a private subnet within Amazon Web Services (AWS). The lab aims to familiarize users with Network Address Translation (NAT) and provides a step-by-step demonstration of configuring the required resources to establish internet connectivity for instances in a private subnet.
2. Duration: 1 hour 30 minutes
3. AWS Region: US East (N. Virginia) us-east-1.

​

Introduction

​

What is NAT Gateways?

• NAT stands for Network Address Translation.
• A NAT Gateway is a device used to enable instances in a private subnet to connect to the internet or other AWS services.
• It prevents the internet from initiating connections with the instances present in the private subnet.
• It forwards traffic from the instance in the private subnet to the internet or other AWS services, and then sends the response back to the instances.
• Changes the instances IP address with the NAT device’s address when the traffic goes to the Internet.
• We have 2 kinds of NAT devices:
• NAT Instance
• NAT Gateway
• NAT Instance uses Amazon Linux AMIs.
• NAT Instance limit depends on your instance type limit for the region.
• NAT Instance does not support IPv6 traffic.
• NAT Gateway usage is charged to the customer on an hourly basis.
• NAT Gateway does not support IPv6 traffic.
• AWS recommends the usage of NAT Gateway, since they provide better availability and bandwidth over NAT Instances.

​

Architecture diagram

​

Task details

1. Sign into AWS Management Console.
2. Create a VPC.
3. Create public and private subnets.
4. Create an Internet Gateway
5. Create Public route table and configure
6. Launch an EC2 instance in Public subnet.
7. Launch an EC2 instance in Private subnet.
8. SSH into Public and Private EC2 instance and Test Internet Connectivity
9. Create a NAT Gateway
10. Update Route table and configure NAT Gateway
11. Test Internet connection from Instance inside Private Subnet
12. Validation of the lab.

​

Launching the lab environment

1. To launch the lab environment, Click on the Launch lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM username, Password, Access Key, and Secret Access Key.

​

Lab guide

​

Lab steps

​

Task 1: Sign in to AWS Management Console

1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,

• Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
• Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button.

3. Once Signed In to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.

​

#### Task 2 : Create a VPC

In this task, we are going to create a Virtual Private Cloud (VPC), which provides a logically isolated section of the AWS cloud where users can launch resources such as instances, subnets, and gateways.

1. Make sure you are in the US East (N. Virginia) us-east-1 region.
2. Navigate to VPC under the services menu. Click on Your VPCs.
3. Click on Create VPC button.

• Resources to create : Select VPC Only
• Name Tag : Enter MyVPC
• IPv4 CIDR block : Enter 10.0.0.0/16 (You can also put any other CIDR range)
• IPv6 CIDR block : Select No IPv6 CIDR Block
• Tenancy : Default

• Click on Create VPC.

4. The VPC is now created.

​

Task 3 : Create Public and Private Subnets

In this task, we are going to create both public and private subnets within the VPC. Public subnets have internet connectivity, while private subnets do not have direct internet access.

1. Navigate to Subnets in the left panel of the VPC page.
2. Let’s create a Public subnet. Click on Create Subnet button.

• VPC ID : select MyVPC
• Subnet Name : Enter MyPublicSubnet
• Availability Zone : No Preference
• IPv4 CIDR block : Enter 10.0.0.0/24
• Click on Create subnet button.

3. Let’s enable Auto Assign public IP to Instances created within this subnet,
   • Select MyPublicSubnet , Click on Actions.
   • Click on Edit subnet settings.
   • Enable auto-assign public IPv4 address : Check
   • Click on Save.
4. Now, the Instances launched inside the MyPublicSubnet will have Public IPs assigned to them by default.
5. Let’s create a private subnet. Click on Create subnet.
   • VPC ID : select MyVPC
   • Subnet Name : Enter MyPrivateSubnet
   • Availability Zone : No Preference
   • IPv4 CIDR block : Enter 10.0.1.0/24
   • Click on Create subnet button.
6. Now, two subnets are created.

​

Task 4 : Create Internet Gateway

In this task, we are going to create an Internet Gateway, which acts as a bridge between the VPC and the internet, allowing instances in the VPC to communicate with the internet.

1. Navigate Internet Gateways in the left panel of the VPC page.
2. Click on Create Internet gateway button.

• Name tag : Enter MyIGW
• Click on Create internet gateway button.

3. An Internet Gateway is now created.
4. To attach an Internet Gateway to a VPC,
   • Click on Actions, Select Attach to VPC.
   • VPC : Select MyVPC
   • Click on Attach internet gateway.
5. Now MyIGW is attached to MyVPC.

​

Task 5 : Create Public Route Table and Configure

In this task, we are going to create a public route table and configure it to associate with the public subnet. The public route table defines how traffic is routed between the VPC and the internet.

1. Navigate to Route Table in the left panel of the VPC page.
2. Click on Create route table button
   • Name tag : Enter PublicRouteTable
   • VPC : Select MyVPC
   • Click on Create route table button.
3. A route table by name PublicRouteTable will be created.
4. To attach an Internet Gateway, select PublicRouteTable.
5. In the Routes tab below:
   • Click on Edit routes.
   • On the next page, click on Add route
   • Destination : Enter 0.0.0.0/0
   • Target : Select Internet Gateway, and once the internet gateways have been created, select MyIGW
   • Click on Save changes.
6. To associate the Public Subnet to the route table, Select PublicRouteTable.
   • Click on the Subnet Associations tab.
   • Click on Edit subnet associations.
   • On the next page, select MyPublicSubnet from the list displayed.
   • Click on Save associations.
7. Once all the configurations are completed, it should look like below:

8. Now the Instances launched within MyPublicSubnet will have access to the Internet.
9. As you can see, there is another existing route table already available for MyVPC. It is a main route table created at the time the VPC was created. We will use it while creating the NAT Gateway.

​

Task 6 : Launch an EC2 Instance in Public Subnet

In this task, we are going to launch an EC2 instance in the public subnet. This allows users to have a publicly accessible instance that can directly communicate with the internet.

1. Make sure you are in the N.Virginia region.
2. Navigate to the Services menu in the top, click on EC2 in the Compute section.
3. Navigate to Instances on the left panel and click on Launch instances button

4. Name : Enter MyPublicServer

5. For Amazon Machine Image (AMI): Search for Amazon Linux 2023 AMI in the search box and click on the select button.
6. For Instance Type: select t2.micro
7. For Key pair: Select Create a new key pair Button
   • Key pair name: MyKey
   • Key pair type: RSA
   • Private key file format: .pem
8. Select Create key pair Button.
9. In Network Settings Click on Edit:
10. VPC : Select MyVPC
11. Subnet : Select MyPublicSubnet
12. Auto-assign public IP: Enable
13. Select Create new Security group
14. Security group name : Enter MyEC2Server_SG
15. Description : Enter Security Group to allow traffic to EC2
    • To add SSH
      • Choose Type:
      • Select SSH
      • Source: Select Anywhere
16. Keep Rest thing Default and Click on Launch Instance Button.
17. Select View all Instances to View Instance you Created
18. Launch Status: Your instance is now launching, Select the instance and wait for it to change status to Running.

​

Task 7 : Launch an EC2 Instance in Private Subnet

In this task, we are going to launch an EC2 instance in the private subnet. This demonstrates the concept of a private subnet, which does not have direct internet access.

1. Click on Launch instances.
2. Name : Enter MyPrivateServer

3. For Amazon Machine Image (AMI): Search for Amazon Linux 2023 AMI in the search box and click on the select button.
4. For Instance Type: select t2.micro
5. For Key pair: Select the key pair you created before
6. In Network Settings Click on Edit:
   • VPC : Select MyVPC
   • Subnet : Select MyPrivateSubnet
   • Auto-assign public IP: Disable
   • Select Select existing security group
   • Select MyEC2Server_SG
7. Keep Rest thing Default and Click on Launch Instance Button.
8. Select View all Instances to View Instance you Created
9. Launch Status: Your instance is now launching, Select the instance and wait for it to change status to Running.
10. Note the Private IP Address of MyPrivateServer : Example 10.0.1.45

​

Task 8 : SSH into Public and Private EC2 Instance and Test Internet Connectivity

In this task, we are going to establish SSH connections to both the public and private EC2 instances. By testing internet connectivity from both instances, users can verify if the public instance has internet access and the private instance does not.

1. SSH into MyPublicServer Instance. Follow the below steps
2. Once the instance is created. Select the instance MyPublicServer.Click on connect button
3. Now select the EC2 instance connect option. You can see there are four options for connecting to EC2. You can use any of the given options to get in the console but for our lab, we are using EC2 instance connect.

4. A new tab would be opened in your browser where we can see the console.

5. Switch to root user:
   sudo su
   
6. Run the updates using the following command:
   yum -y update
   
7. Since the Internet Gateway MyIGW is connected to MyPublicSubnet, updates will be completed successfully.

8. Let’s SSH into MyPrivateEC2Server from MyPublicEC2Server.
9. In order to SSH into MyPrivateEC2Server, first, we need to create the PEM file in the public EC2 ie, MyPublicEC2Server, and copy the data from our MyKey.pem in the local machine.
10. We need MyKey.pem in order to SSH. We shall copy key details from the MyKey.pem from your local machine (which was downloaded earlier while launching EC2 instances).
11. To copy the contents of the MyKey.pem, open the file in a text editor and copy the whole content.
12. To create the MyKey.pem in MyPublicEC2Server, run
    vi MyKey.pem
    
13. Now press the following for inserting the data(You can see insert popped at the last then you can paste the key).

• Click i

14. Save the File
    • click esc
      :wq
      

15. Check that the file was created correctly.
    ls
    

16. Update Permissions for the MyKey.pem
    chmod 400 MyKey.pem
    
17. Use the Private IP address of MyPrivateEC2Server to SSH.
    ssh  ec2-user@<Private IP of MyPrivateEC2Server> -i MyKey.pem
    

18. Switch to root user
    sudo su
    
19. Run the updates using the following command:
    yum -y update
    
20. Since no internet access is provided for EC2 instances in a private subnet, you will not be able to get updates.

​

Task 9 : Create a NAT Gateway

In this task, we are going to create a NAT Gateway, which provides internet access to instances in the private subnet. The NAT Gateway acts as a middleman to forward traffic between the private subnet and the internet.

1. Navigate to the VPC Page.
2. Make sure you are still in the N.Virginia Region.
3. In the Left Panel, click on NAT Gateways.
4. Click on Create NAT gateway button.

• Name : Enter MyNATGateway
• VPC: Choose MyVPC
• Connectivity type: Public and Method of Elastic IP: Automatic.
• Once the new Elastic IP is allocated, click on Create NAT gateway.

5. Note that NAT Gateway is always created in a public subnet.
6. NAT Gateway will be created in a few minutes. Once created, the status will change to available.

​

Task 10 : Update Route table and configure NAT Gateway

In this task, we are going to update the route table associated with the private subnet to include the NAT Gateway as the target for internet-bound traffic. This ensures that traffic from the private subnet is directed through the NAT Gateway for internet access.

1. Navigate to Route Tables in the left panel.
2. You can see two Route Tables available for MyVPC

3. To attach Nat Gateway, select the Main Route Table (which is different from the one created by you).
4. In the Routes tab below,
   • Click on Edit routes.
   • In the next page, Click on Add route
   • Destination: Enter 0.0.0.0/0
   • Target: Select NAT Gateway, and once the internet gateways have loaded, select the NAT Gateway you created.
   • Click on Save changes.
5. Once all the configurations are completed, it should look like below.

6. Now the Instances launched within MyPrivateSubnet can access the Internet through the NAT Gateway.

​

Task 11 : Test Internet connection from Instance inside Private Subnet

In this task, we are going to validate that the instance in the private subnet can successfully establish an internet connection by accessing the internet through the NAT Gateway.

1. SSH back into MyPublicEC2Server .
2. Switch to root user
   sudo su
   
3. SSH into MyPrivateEC2Server
   ssh  ec2-user@<Private IP of MyPrivateEC2Server> -i MyKey.pem
   
4. Switch to root user
   sudo su
   
5. Run the updates using the following command:
   yum -y update
   
6. You can see that the updates have been completed successfully in the terminal.

7. This shows that MyPrivateEC2Server has internet access.
8. Use exit command to close the private server connection.

​

Task 12 : Validation Test

1. Once the lab steps are completed, please click on the Check my work button on the left side panel.
2. This will validate the resources in the AWS account and shows you whether you have completed this lab successfully or not.
3. Sample output :

​

Completion and conclusion

• You have successfully created a new VPC from scratch and created both public and private subnets.
• You have created an Internet Gateway and configured a new route table.
• You have launched 1 EC2 instance each of the Public and Private subnets and tested Internet access from them.
• To provide Internet access to the EC2 instance in the Private subnet, you created a NAT Gateway and configured a Route table.
• You confirmed that the instance in the private subnet is able to connect to the internet.

​

End lab

1. Sign out of AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps, click on End lab in the IP Lab Portal.

​

What gets checked

When you press Check my work, the platform verifies each of these:

• Create Amazon Custom VPC — Check whether a Custom VPC is created or not.
• Create Amazon Custom VPC Subnet — Check whether a Subnet is created for the Custom VPC or not.
• Create Amazon Custom VPC Public Route Table — Check whether a Custom VPC Public Route Table is created and an Internet Gateway route is added or not.
• Create Internet Gateway — Check whether an Internet Gateway is created and attached to the Custom VPC or not.
• Create NAT Gateway — Check whether a NAT Gateway is created or not.
• Launch an EC2 Instance — Check whether an EC2 Instance is launched or not.
• Validate EC2 Instance Type t2.micro — Check whether the EC2 instance type is t2.micro.
• Launch EC2 AMI type Amazon Linux — Check whether the EC2 instance is launched using an Amazon AMI.

​

Related help

• FAQs and Troubleshooting
• SSH into EC2 Instance