Understanding NAT Gateways - AWS Training

[@hritujbansod4019]

you sorted out so many things by relating them. great video

[@bharatchandrahanumanthavaj9430]

got a clear picture of NAT , feeling refreshed!!! .thank you

[@stuartscott6368]

Thank you Bharat1287!

[@jasper5016]

Wow this is the fantastic video. I have watched so many videos but this explanation was very precise and clear.

[@stuartscott6368]

Thank you Jasper5016!

[@jasper5016]

@@stuartscott6368 - Just to tell you, I cleared my SAA exam and your videos had a great contribution to it.

[@stuartscott6368]

@@jasper5016 Congratulations to you, that's an awesome achievement! Great work, and thank you for letting me know! 👍

[@readonlylogin]

Quite short and clear explanation! Well done!

[@Brownmumba8973]

Ok… wow. You gave context, a clear explanation and made it very easy to understand through reinforcement. Smashing instructor

[@stuartscott6368]

Thank you very much Fahad Ali, I appreciate the feedback

[@ohsquirrels3727]

Love it, so clear

[@smamind]

Short videos are always good for refreshing the concept.

[@juliansalas8513]

Thanks! finally, I got the reason why a NAT needs a public subnet to work. Very clear your explanation!.

[@stuartscott6368]

Hi Julian, thank you! I'm pleased to hear it cleared up any confusion you had!

[@synchronizingsynchronize3066]

you are my hero it is so helpful I'm doing project this content is really helpful and KZbin is really helpful since I found first since 2015

[@mikeycodes]

Fantastic explanation. This cleared things up for me. Thank you!

[@anilkommalapati6248]

No bullshit. Straight to the point. crystal clear.

[@shraddhasable5416]

thank you so much for making it so easy, very well explained

[@samk_jg]

Awesome tutorial👋

[@malang-aks]

why people dislike.. while there is no point of doing this.. excellent video

[@chris0628]

Excellent, to-the-point video!

[@stuartscott6368]

Thank you Chris, appreciate the feedback!

[@MeidanMeshulam]

Great stuff!

[@armena2866]

Amazing explanation - thanks!

[@stuartscott6368]

Thank you Armen!

[@rkotcher]

Wow you're very good at explaining things. subscribed.

[@stuartscott6368]

Thank you Robert, appreciate the feedback!

[@arithex]

Great walkthrough -- I got my answer before the 3min mark. For some reason I was thinking of the NAT gw's as belonging to the private subnet, not the public. The way my NAT router at home belongs to me, not my cable company. Subscribed!

[@stuartscott6368]

Happy to hear you got your answer arithex!

[@Mohcine3tt]

Well explained

[@Hackenbaker]

Very well explained!!! Thank you

[@stuartscott6368]

Thank you Mario

[@diegoandreeporrasrivas1155]

Very clear and well explained!

[@stuartscott6368]

Thank you Diego!

[@awaznipi2709]

Cloud Made easy! 👍

[@avisworld745]

What if I want a Internet traffic eg azure power apps traffic to reach Private subnet.. Will nat gw allow the inbound traffic cmng from the Internet gw to the private subnet ?

[@sergiodanielsaade4457]

thank you!!! Very clear... one question, can the EIP of the Nat gateway be reached from the internet, for example, can I ping it? or everything is denied from the Internet? Thank you in advance

[@Gionawii]

How is the software download being done to the ec2 instance in private subnet without Nat accepting traffic from the internet?

[@indian3197]

Great video. One question. While receiving the patch or update data from the Internet, will NAT gateway allow the return traffic towards the private subnet instances which originated the traffic to the Internet?

[@stuartscott6368]

Yes, the NAT Gateway will manage the communication

[@belfunkk]

What rules do you have to add to the security group of the private instances to allow for connectivity via the nat gateway?

[@stuartscott6368]

Hi belfunkk, this largely depends on what you want the private instances to access. For example, if the private instances are communicating using HTTP, then you would use port 80 as the port on the outbound ruleset, pointing to the Private IP of the NAT G/W as the destination.

[@scottscott232]

Fantastic explanation. A quick question though: if there is no inbound traffic allowed to the private subnet, then how are the instance OS's patched / updated?

[@stuartscott6368]

Hi Steve, the request has to be initiated from the instance requiring the update first. As long as the request comes from an internal resource first, in this case, the instance, the NAT will forward the request externally and then receive the reply and allow comms between the outside world and the private instance. The NAT just doesn't accept inbound connections being initiated to internal resources. Thank you for the positive feedback too! Much appreciated!

[@scottscott232]

@@stuartscott6368 That makes sense. Many many thanks.

[@susanrussel1409]

Does Cloud Academy have an AWS Sandbox to go along with their courses. I am currently using A Cloud Guru but your lecture is soooo much easier to understand.

[@QANorthAmerica]

Hey Susan, you can find here cloudacademy.com/search/?platform=amazon-web-services&product=lab&q=labs all of our AWS labs where you can practice your skills in a live AWS environment. If you prefer, you can register here info.cloudacademy.com/free-courses-list and start training for free with our selection of free content. Don’t hesitate to reach out if you have any other questions. Thanks, Cloud Academy Team.

[@carlitos081]

perfect

[@keyntankeye]

This is very well explained. Thanks a bunch

[@stuartscott6368]

A pleasure, thank you Keyntankeye

[@EwertonSilveira]

Tks 🎉

[@TheTravelingMonkey]

Nice tutorial! Quick question though. The NAT Gateway sends a request to an internet resource. Hence it allows response from that resource only?

[@stuartscott6368]

Correct, the NAT GW will contact the resource requested from the source client, in this example, the private EC2 instance

[@viskal-cg1dd]

Wow what is the tool u used for drawing crystal clear drawings

[@stuartscott6368]

Thank you, I just used a GAOMON digital drawing board with a drawing app

[@jota.8868]

Thank you!

[@cselphenator]

AWSome job thanks!

[@stuartscott6368]

Thank you Christopher!

[@debabhishek]

you are suggesting 1 net gateway per public subnet , per availability zone,, as route tables does not take duplicate entries for same entry . we need separate route table for each private subnet in each availability zone. Correct me I am wrong.

[@stuartscott6368]

Hi Abhishek, you are correct, so if you have a multi-AZ infrastructure with more than one public subnet, then to maintain high availability you should create a NAT Gateway in each of the public AZs and update the routing accordingly for each of the private subnets.

[@luismora1017]

whats the difference between a NAT gateway and a NAT instance? (is it that a NAT gateway is manage by AWS?)

[@stuartscott6368]

Hi Luis - You can find a summary table comparing the 2 here: docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-comparison.html

[@alexoteg7536]

How many Ec2 can be in one subnet

[@nivincp]

Nice tutorial! Thank you. What's the drawing pad program you are using?

[@stuartscott6368]

Thank you Nivin - I was using Sketchbook by Autodesk with a Gaomon digital drawing tablet.

[@k7babu555999]

Nice video 👍 thanks for sharing

[@vinayreddy4728]

Is there a way to use NAT gateway between 2 different VPC's...

[@stuartscott6368]

Hi Vinay, a NAT gateway is used to allow instances in a private subnet to initiate a connection to the internet, while preventing connections being made inbound. NAT Gateways are not used to connect or exchange data flow between 2 VPCs. If you want to route connect to VPCs together, consider using VPC Peering or the AWS Transit Gateway. One point to remember is that NAT Gateways are not able to route any traffic through a VPC peering connection, a Site-to-Site VPN connection, or AWS Direct Connect. Even when you have 2 or more VPCs connected via peering or Transit gateway, the NAT gateway can't be used by resources on the other side of these connections by other VPCs.

[@vinayreddy4728]

@@stuartscott6368 Thanks a lot ... Explained clearly..

[@SYEDFERHANHAIDER]

Can't we get this done by a network ACL rule simply(rule that allows all outbound traffic but denies all inbound traffic)? why do we need the NAT gateway?

[@luismora1017]

that is if your looking at it from the network layer rules, but the function of the NAT gateway is also to translate the private IP address into Public IP adress (At least thats what the theory says)

[@sthoyyeti]

1. Security Groups of EC2 instances has to allow outbound traffic 2. ACL also has to allow which ports and CIDR block are allowed to be reached at Subnet level. 3) Now How your private subnet is connected to internet which is addressed by NAT instance or NAT gateway in public subnet, which gives you a public IP. which inturn talks to Internet Gateway.

[@rakesh4642]

NACL is managed by aws and all the traffics are allowed by default,,,,u cant change that

[@stuartscott6368]

@syed Farhan Haider. If you created a NACL and associated it with the private Subnet that blocked ALL inbound traffic, then no communication could be made to any resource within that Subnet from outside of that subnet. All the traffic will be blocked at the network layer. This would essentially isolate your subnet from every other subnet in your VPC, obviously, this is not ideal. NACLs control network traffic using ports and protocols at the subnet level. Luis is also correct in stating that the NAT will perform translation as well.

[@stuartscott6368]

@@rakesh4642 Hi Rakesh, that is not strictly true. AWS will create a default NACL for your VPC that does not have any restrictions configured at all and effectively allows ALL traffic. However, you can create your own NACLs that contain far more restrictive controls, and this is recommended. You can then associate different restricted NACLs to different Subnets within your VPC. Only 1 NACL can be associated with 1 subnet, however, you can associate the same NACL to multiple subnets

[@jonathankohn9231]

why does a NAT gateway need an elastic IP?

[@prakash2179]

Very useful 👍

[@fooked1]

So why are they so expensive?

[@TheSidhussain]

too good !!!

[@QANorthAmerica]

Glad you like this video TheSidhussain!

[@stuartscott6368]

Thank you TheSidhussain

[@antwanwimberly1729]

USA 🇺🇸

[@joanale609]

so expensive.... $50 per month

[@lesmonsaluta]

Amazing explanation! Thank you so much!

[@danishuddin9752]

Thank you!

[@singhamita]

Very well explained Thank you !!

[@stuartscott6368]

A pleasure, thank you Amita!