Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →To give EC2 instances in a private subnet outbound IPv4 internet access, create a public NAT Gateway in a public subnet, assign it an Elastic IP address, and route the private subnet’s 0.0.0.0/0 traffic to it. The public subnet must itself route to an internet gateway. Once the NAT Gateway is Available, instances can initiate internet connections and receive replies without being directly reachable through unsolicited inbound internet connections.
How the routing works
A NAT Gateway translates the source IPv4 address of traffic from private instances so it can travel out through the internet gateway. Return traffic is sent back through the NAT Gateway to the originating instance. The gateway does not, by itself, create routes: both the public subnet’s route table and the private subnet’s route table must be configured. See AWS’s NAT device overview.
As an Amazon Associate I earn from qualifying purchases.
- Public subnet: Its route table sends
0.0.0.0/0to the VPC’s attached internet gateway. - Private subnet: Its associated route table sends
0.0.0.0/0to the NAT Gateway.
This setup allows outbound IPv4 connections and their responses; it is not a way to publish a private instance as an internet-facing server.
What to prepare
- A VPC with an internet gateway attached.
- A public subnet for the NAT Gateway and a private subnet for the EC2 instances.
- Route tables associated with the intended subnets.
- An Elastic IP address for each public NAT Gateway, plus sufficient service quotas and address availability.
For a two-Availability-Zone production-oriented design, AWS’s CLI tutorial uses two public subnets, two private subnets, and one NAT Gateway in each AZ. The sample resource IDs and names in the tutorial are illustrative; replace them with IDs for your own VPC and region. Follow AWS’s CLI VPC and NAT Gateway tutorial for the full topology.
#1 Best Overall
Create the public NAT Gateway and routes
The following command sequence shows the essential AWS CLI operations. Use the IDs returned by each command in subsequent commands, and substitute your actual VPC, subnet, route-table, and gateway IDs.
- Create and attach an internet gateway:
aws ec2 create-internet-gateway aws ec2 attach-internet-gateway --internet-gateway-id igw-... --vpc-id vpc-... - Set the public route table’s default route to the attached internet gateway:
aws ec2 create-route --route-table-id rtb-public --destination-cidr-block 0.0.0.0/0 --gateway-id igw-... - Allocate an Elastic IP address:
aws ec2 allocate-address --domain vpc - Create a public NAT Gateway in the public subnet, using the allocation ID returned for the Elastic IP:
aws ec2 create-nat-gateway --subnet-id subnet-public --allocation-id eipalloc-... - Wait for the NAT Gateway to become available:
aws ec2 wait nat-gateway-available --nat-gateway-ids nat-... - Route the private subnet’s default IPv4 traffic to the NAT Gateway:
aws ec2 create-route --route-table-id rtb-private --destination-cidr-block 0.0.0.0/0 --nat-gateway-id nat-...
Ensure the private subnet is associated with the route table you update. A command that succeeds against a different route table will not change the EC2 subnet’s effective routing.
Console alternative
In the AWS console, open VPC → NAT gateways and create a NAT Gateway in the public subnet. Set Connectivity type to Public, then select or allocate an Elastic IP. After creation, wait until its state is Available. Update the public subnet route table so 0.0.0.0/0 targets the internet gateway, then update the route table associated with the private subnet so 0.0.0.0/0 targets the NAT Gateway. AWS documents this workflow in its NAT Gateway guide.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the right NAT Gateway type
| Choice | Use it for | Key distinction |
|---|---|---|
| Public NAT Gateway | Private-subnet instances that need direct public internet egress over IPv4. | Uses an Elastic IP and routes through an internet gateway. |
| Private NAT Gateway | Private communication through a transit gateway or virtual private gateway, such as connectivity to another VPC or an on-premises network. | It is not the choice for direct public internet access. |
AWS’s CreateNatGateway API reference says the connectivity type defaults to public if omitted. In scripts, set or verify the intended type explicitly rather than relying on a default. For a public gateway, the Elastic IP’s network border group must match the Availability Zone’s network border group or creation can fail.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Plan for Availability Zones, capacity, and cost
Resilience and AZ routing
AWS recommends considering a NAT Gateway in each AZ. Route private-subnet traffic through a NAT Gateway in the same AZ where practical: this reduces reliance on another AZ and can avoid cross-AZ data transfer charges. AWS’s private-subnet NAT example illustrates per-AZ gateways and routes.
Connections and monitoring
AWS states that each NAT Gateway IPv4 address can support up to 55,000 simultaneous connections to each unique destination, where a destination is the combination of destination IP address, port, and protocol. AWS documents up to eight associated IPv4 addresses per gateway; for a public NAT Gateway, the default limit is two Elastic IP addresses and may be adjustable. These are AWS-documented limits, not independent test results. If you suspect connection pressure, check the CloudWatch metrics ErrorPortAllocation and PacketsDropCount.
Rank #4
Regional mode
The EC2 API reference describes both zonal and regional NAT Gateway availability modes. Zonal is the default; regional mode is described as a single gateway that can work across multiple AZs, with automatic AZ expansion unless explicit AZ addresses disable that behavior. Availability and options can vary by Region and change over time, so confirm current support for your target Region in the API reference and console before designing around regional mode.
Charges and alternatives
AWS bills for each hour a NAT Gateway is available and for each gigabyte it processes. The CLI tutorial displays an illustrative estimate of approximately $0.045 per hour plus data-processing charges, but it does not establish a current, universal rate. Check AWS NAT Gateway pricing for your Region and estimate using your expected traffic and other applicable resources.
Best Value
For supported AWS services, a VPC endpoint may keep service traffic off the NAT Gateway. AWS’s tutorial shows an S3 gateway endpoint; the example notes that this gateway endpoint option has no cost, but that should not be generalized to other endpoint types or Regions without checking current pricing. In a dual-stack design, IPv4 and IPv6 use separate routes: the example routes IPv4 default traffic through the NAT Gateway and IPv6 ::/0 through an egress-only internet gateway.
Quick Recap
Troubleshoot failed outbound connections
- Verify the NAT Gateway is public, is in the intended public subnet, has an Elastic IP, and has reached
Available. - Check that the Elastic IP network border group matches the gateway’s AZ.
- Inspect the public subnet’s effective route table for
0.0.0.0/0to the VPC’s attached internet gateway. - Confirm the EC2 subnet is associated with the intended private route table and that its
0.0.0.0/0route targets the NAT Gateway ID. - If routes are correct, check security group egress rules and network ACL egress and return-traffic rules. NAT does not override these controls.
- If AWS service traffic is substantial, check whether an appropriate VPC endpoint can handle it; if connections are failing under load, inspect
ErrorPortAllocationandPacketsDropCount.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
