> ## Documentation Index
> Fetch the complete documentation index at: https://cloud-architect.ipoint-labs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Creating NAT Gateways in AWS
> Hands-on lab · 30m
Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console.
Open IP Lab Portal
## Overview
### Lab details
1. This lab guides you through the process of setting up a NAT Gateway to enable internet access for instances in a private subnet within Amazon Web Services (AWS). The lab aims to familiarize users with Network Address Translation (NAT) and provides a step-by-step demonstration of configuring the required resources to establish internet connectivity for instances in a private subnet.
2. Duration: **1 hour 30 minutes**
3. AWS Region: **US East (N. Virginia) us-east-1.**
### Introduction
#### What is NAT Gateways?
* NAT stands for Network Address Translation.
* A NAT Gateway is a device used to enable instances in a private subnet to connect to the internet or other AWS services.
* It prevents the internet from initiating connections with the instances present in the private subnet.
* It forwards traffic from the instance in the private subnet to the internet or other AWS services, and then sends the response back to the instances.
* Changes the instances IP address with the NAT device's address when the traffic goes to the Internet.
* We have 2 kinds of NAT devices:
* NAT Instance
* NAT Gateway
* NAT Instance uses Amazon Linux AMIs.
* NAT Instance limit depends on your instance type limit for the region.
* NAT Instance does not support IPv6 traffic.
* NAT Gateway usage is charged to the customer on an hourly basis.
* NAT Gateway does not support IPv6 traffic.
* AWS recommends the usage of NAT Gateway, since they provide better availability and bandwidth over NAT Instances.
### Architecture diagram
### Task details
1. Sign into AWS Management Console.
2. Create a VPC.
3. Create public and private subnets.
4. Create an Internet Gateway
5. Create Public route table and configure
6. Launch an EC2 instance in Public subnet.
7. Launch an EC2 instance in Private subnet.
8. SSH into Public and Private EC2 instance and Test Internet Connectivity
9. Create a NAT Gateway
10. Update Route table and configure NAT Gateway
11. Test Internet connection from Instance inside Private Subnet
12. Validation of the lab.
### Launching the lab environment
1. To launch the lab environment, Click on the **Launch lab** button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with **IAM username**, **Password**, **Access** **Key**, and **Secret** **Access** **Key**.
## Lab guide
### Lab steps
#### Task 1: Sign in to AWS Management Console
1. Click on the **Open console** button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
* Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
* Now copy your **User Name** and **Password** in the Lab Console to the **IAM Username and Password** in AWS Console and click on the **Sign in** button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as **US East (N. Virginia) us-east-1.**
If you face any issues, please go through [**FAQs and Troubleshooting**](/aws-cp/support/faqs-and-troubleshooting).
#### #### Task 2 : Create a VPC
In this task, we are going to create a Virtual Private Cloud (VPC), which provides a logically isolated section of the AWS cloud where users can launch resources such as instances, subnets, and gateways.
1. Make sure you are in the **US East (N. Virginia) us-east-1** region.
2. Navigate to **VPC** under the services menu. Click on **Your VPCs**.
3. Click on **Create VPC** button.
* Resources to create : Select **VPC Only**
* Name Tag : Enter **MyVPC**
* IPv4 CIDR block : Enter **10.0.0.0/16** (You can also put any other CIDR range)
* IPv6 CIDR block : Select **No IPv6 CIDR Block**
* Tenancy : **Default**
* Click on **Create VPC**.
4. The VPC is now created.
#### Task 3 : Create Public and Private Subnets
In this task, we are going to create both public and private subnets within the VPC. Public subnets have internet connectivity, while private subnets do not have direct internet access.
1. Navigate to **Subnets** in the left panel of the VPC page.
2. Let's create a Public subnet. Click on **Create Subnet** button.
* VPC ID : select **MyVPC**
* Subnet Name : Enter **MyPublicSubnet**
* Availability Zone : **No Preference**
* IPv4 CIDR block : Enter **10.0.0.0/24**
* Click on **Create subnet** button.
3. Let's enable Auto Assign public IP to Instances created within this subnet,
* Select **MyPublicSubnet** , Click on **Actions**.
* Click on **Edit subnet settings.**
* Enable auto-assign public IPv4 address : **Check**
* Click on **Save**.
4. Now, the Instances launched inside the **MyPublicSubnet** will have Public IPs assigned to them by default.
5. Let’s create a private subnet. Click on **Create subnet.**
* VPC ID : select **MyVPC**
* Subnet Name : Enter **MyPrivateSubnet**
* Availability Zone : **No Preference**
* IPv4 CIDR block : Enter **10.0.1.0/24**
* Click on **Create subnet** button.
6. Now, two subnets are created.
#### Task 4 : Create Internet Gateway
In this task, we are going to create an Internet Gateway, which acts as a bridge between the VPC and the internet, allowing instances in the VPC to communicate with the internet.
1. Navigate **Internet Gateways** in the left panel of the VPC page.
2. Click on **Create Internet gateway** button.
* Name tag : Enter **MyIGW**
* Click on **Create internet gateway** button.
3. An Internet Gateway is now created.
4. To attach an Internet Gateway to a VPC,
* Click on **Actions,** Select **Attach to VPC**.
* VPC : Select **MyVPC**
* Click on **Attach internet gateway**.
5. Now **MyIGW** is attached to **MyVPC**.
#### Task 5 : Create Public Route Table and Configure
In this task, we are going to create a public route table and configure it to associate with the public subnet. The public route table defines how traffic is routed between the VPC and the internet.
1. Navigate to Route Table in the left panel of the **VPC** page.
2. Click on **Create route table** button
* Name tag : Enter **PublicRouteTable**
* VPC : Select **MyVPC**
* Click on **Create route table** button.
3. A route table by name **PublicRouteTable** will be created.
4. To attach an Internet Gateway, select **PublicRouteTable**.
5. In the **Routes** tab below:
* Click on **Edit routes.**
* On the next page, click on **Add route**
* Destination : Enter **0.0.0.0/0**
* Target : Select **Internet Gateway**, and once the internet gateways have been created, select **MyIGW**
* Click on **Save changes**.
6. To associate the Public Subnet to the route table, Select **PublicRouteTable**.
* Click on the **Subnet Associations** tab.
* Click on **Edit subnet associations**.
* On the next page, select **MyPublicSubnet** from the list displayed.
* Click on **Save associations**.
7. Once all the configurations are completed, it should look like below:
8. Now the Instances launched within **MyPublicSubnet** will have access to the Internet.
9. As you can see, there is another existing route table already available for **MyVPC**. It is a main route table created at the time the VPC was created. We will use it while creating the **NAT Gateway**.
#### Task 6 : Launch an EC2 Instance in Public Subnet
In this task, we are going to launch an EC2 instance in the public subnet. This allows users to have a publicly accessible instance that can directly communicate with the internet.
1. Make sure you are in the **N.Virginia** region.
2. Navigate to the **Services** menu in the top, click on **EC2** in the **Compute** section.
3. Navigate to **Instances** on the left panel and click on **Launch instances** button
4. Name : Enter **MyPublicServer**
5. **For Amazon Machine Image (AMI):** Search for **Amazon Linux 2023 AMI** in the search box and click on the **select** button.
6. **For Instance Type:** select **t2.micro**
7. **For Key pair:** Select **Create a new key pair** Button
* Key pair name: **MyKey**
* Key pair type: **RSA**
* Private key file format: **.pem**
8. Select **Create key pair** Button.
9. In Network Settings Click on **Edit**:
10. VPC : Select **MyVPC**
11. Subnet : Select **MyPublicSubnet**
12. Auto-assign public IP: **Enable**
13. Select **Create new Security group**
14. Security group name : Enter **MyEC2Server\_SG**
15. Description : Enter **Security Group to allow traffic to EC2**
* To add **SSH**
* Choose Type:
* Select **SSH**
* Source: Select **Anywhere**
16. Keep Rest thing Default and Click on **Launch Instance** Button.
17. Select **View all Instances** to View Instance you Created
18. Launch Status: Your instance is now launching, Select the instance and wait for it to change status to **Running.**
#### Task 7 : Launch an EC2 Instance in Private Subnet
In this task, we are going to launch an EC2 instance in the private subnet. This demonstrates the concept of a private subnet, which does not have direct internet access.
1. Click on **Launch instances**.
2. Name : Enter **MyPrivateServer**
3. **For Amazon Machine Image (AMI):** Search for **Amazon Linux 2023 AMI** in the search box and click on the **select** button.
4. **For Instance Type:** select **t2.micro**
5. **For Key pair:** Select the key pair you created before
6. In Network Settings Click on **Edit**:
* VPC : Select **MyVPC**
* Subnet : Select **MyPrivateSubnet**
* Auto-assign public IP: **Disable**
* Select **Select existing security group**
* Select **MyEC2Server\_SG**
7. Keep Rest thing Default and Click on **Launch Instance** Button.
8. Select **View all Instances** to View Instance you Created
9. Launch Status: Your instance is now launching, Select the instance and wait for it to change status to **Running**.
10. Note the Private IP Address of **MyPrivateServer** : Example 10.0.1.45
#### Task 8 : SSH into Public and Private EC2 Instance and Test Internet Connectivity
In this task, we are going to establish SSH connections to both the public and private EC2 instances. By testing internet connectivity from both instances, users can verify if the public instance has internet access and the private instance does not.
1. SSH into **MyPublicServer** Instance. Follow the below steps
2. Once the instance is created. Select the instance **MyPublicServer**.Click on connect button
3. Now select the EC2 instance connect option. You can see there are four options for connecting to EC2. You can use any of the given options to get in the console but for our lab, we are using EC2 instance connect.
4. A new tab would be opened in your browser where we can see the console.
5. Switch to root user:
```
sudo su
```
6. Run the updates using the following command:
```
yum -y update
```
7. Since the Internet Gateway **MyIGW** is connected to **MyPublicSubnet**, updates will be completed successfully.
8. Let’s SSH into **MyPrivateEC2Server** from **MyPublicEC2Server**.
9. In order to SSH into **MyPrivateEC2Server,** first, we need to create the PEM file in the public EC2 ie, **MyPublicEC2Server,** and copy the data from our **MyKey.pem** in the local machine.
10. We need **MyKey.pem** in order to SSH. We shall copy key details from the **MyKey.pem** from your local machine (which was downloaded earlier while launching EC2 instances).
11. To copy the contents of the **MyKey.pem**, open the file in a text editor and copy the whole content.
12. To create the MyKey.pem in **MyPublicEC2Server**, run
```
vi MyKey.pem
```
13. Now press the following for inserting the data(**You can see insert popped at the last then you can paste the key**).
* Click **i**
In the editor, copy and paste the key that looks similar to the example below.
14. Save the File
* click **esc**
```
:wq
```
15. Check that the file was created correctly.
```
ls
```
16. Update Permissions for the MyKey.pem
```
chmod 400 MyKey.pem
```
17. Use the Private IP address of **MyPrivateEC2Server** to SSH.
```
ssh ec2-user@ -i MyKey.pem
```
Incase if this message shows **Are you sure you want to continue connecting (yes/no)?** : Enter **yes**
18. Switch to root user
```
sudo su
```
19. Run the updates using the following command:
```
yum -y update
```
20. Since no internet access is provided for EC2 instances in a private subnet, you will not be able to get updates.
#### Task 9 : Create a NAT Gateway
In this task, we are going to create a NAT Gateway, which provides internet access to instances in the private subnet. The NAT Gateway acts as a middleman to forward traffic between the private subnet and the internet.
1. Navigate to the VPC Page.
2. Make sure you are still in the **N.Virginia** Region.
3. In the Left Panel, click on **NAT Gateways**.
4. Click on **Create NAT gateway** button.
* Name : Enter **MyNATGateway**
* VPC: Choose **MyVPC**
* Connectivity type: **Public** and Method of Elastic IP: **Automatic**.
* Once the new Elastic IP is allocated, click on **Create NAT gateway**.
5. Note that NAT Gateway is always created in a public subnet.
6. NAT Gateway will be created in a few minutes. Once created, the status will change to **available**.
#### Task 10 : Update Route table and configure NAT Gateway
In this task, we are going to update the route table associated with the private subnet to include the NAT Gateway as the target for internet-bound traffic. This ensures that traffic from the private subnet is directed through the NAT Gateway for internet access.
1. Navigate to **Route Tables** in the left panel.
2. You can see two Route Tables available for **MyVPC**
3. To attach Nat Gateway, select the Main Route Table (which is different from the one created by you).
4. In the **Routes** tab below,
* Click on **Edit routes**.
* In the next page, Click on **Add route**
* Destination: Enter **0.0.0.0/0**
* Target: Select **NAT Gateway**, and once the internet gateways have loaded, select the NAT Gateway you created.
* Click on **Save changes**.
5. Once all the configurations are completed, it should look like below.
6. Now the Instances launched within **MyPrivateSubnet** can access the Internet through the NAT Gateway.
#### Task 11 : Test Internet connection from Instance inside Private Subnet
In this task, we are going to validate that the instance in the private subnet can successfully establish an internet connection by accessing the internet through the NAT Gateway.
1. SSH back into **MyPublicEC2Server** .
2. Switch to root user
```
sudo su
```
3. SSH into **MyPrivateEC2Server**
```
ssh ec2-user@ -i MyKey.pem
```
4. Switch to root user
```
sudo su
```
5. Run the updates using the following command:
```
yum -y update
```
6. You can see that the updates have been completed successfully in the terminal.
7. This shows that **MyPrivateEC2Server** has internet access.
8. Use **exit** command to close the private server connection.
**Do you know?**
NAT Gateway allows for high scalability and can handle thousands to tens of thousands of concurrent connections per second. It is designed to handle significant traffic loads and provides automatic scaling based on the demand. This means that as your network traffic increases, AWS automatically scales up the NAT Gateway capacity to accommodate the higher workload. This scalability feature ensures that your instances in the private subnet can maintain reliable and efficient internet connectivity, even during periods of high demand or traffic spikes.
#### Task 12 : Validation Test
1. Once the lab steps are completed, please click on the **Check my work** button on the left side panel.
2. This will validate the resources in the AWS account and shows you whether you have completed this lab successfully or not.
3. Sample output :
### Completion and conclusion
* You have successfully created a new VPC from scratch and created both public and private subnets.
* You have created an Internet Gateway and configured a new route table.
* You have launched 1 EC2 instance each of the Public and Private subnets and tested Internet access from them.
* To provide Internet access to the EC2 instance in the Private subnet, you created a NAT Gateway and configured a Route table.
* You confirmed that the instance in the private subnet is able to connect to the internet.
### End lab
1. Sign out of AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps, click on **End lab** in the IP Lab Portal.
## What gets checked
When you press **Check my work**, the platform verifies each of these:
* **Create Amazon Custom VPC** — Check whether a Custom VPC is created or not.
* **Create Amazon Custom VPC Subnet** — Check whether a Subnet is created for the Custom VPC or not.
* **Create Amazon Custom VPC Public Route Table** — Check whether a Custom VPC Public Route Table is created and an Internet Gateway route is added or not.
* **Create Internet Gateway** — Check whether an Internet Gateway is created and attached to the Custom VPC or not.
* **Create NAT Gateway** — Check whether a NAT Gateway is created or not.
* **Launch an EC2 Instance** — Check whether an EC2 Instance is launched or not.
* **Validate EC2 Instance Type t2.micro** — Check whether the EC2 instance type is t2.micro.
* **Launch EC2 AMI type Amazon Linux** — Check whether the EC2 instance is launched using an Amazon AMI.
## Related help
* [FAQs and Troubleshooting](/aws-cp/support/faqs-and-troubleshooting)
* [SSH into EC2 Instance](/aws-cp/support/ssh-into-ec2-instance)