What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A NAT gateway lets instances in a private subnet, which have no public IP address, start outbound connections to the internet or to other services. Outside hosts cannot start a connection back to those instances through that path. The mechanism is a route-table entry: the private subnet’s internet-bound traffic goes to the gateway instead of to an internet gateway, and the gateway rewrites the source address so replies return to the right instance.
This answers the two questions the exact-title article on DEV uses to frame the topic: “how exactly are these two VMs communicating?” and “how a machine without a public IP can still access the internet.” The instance never becomes public. The gateway sits in a public subnet, uses an Elastic IP address for internet-facing traffic, and translates for the private instances behind it.
As an Amazon Associate I earn from qualifying purchases.
What the connection actually does
AWS describes the behavior in the Amazon VPC User Guide, “NAT gateways,” with this sentence: “You can use a NAT gateway so that instances in a private subnet can connect to services outside your VPC but external services can’t initiate a connection with those instances.”
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAn outbound request, hop by hop
Assume an instance at 10.0.2.15 in a private subnet calls an API on the internet. The example addresses below are illustrative, not from a live VPC.
#1 Best Overall
- The instance sends the packet with its private address as the source. Its subnet’s route table has a
0.0.0.0/0entry that targets the NAT gateway, so the packet goes to the gateway rather than being dropped. - The NAT gateway, which has its own private address in the public subnet, replaces the source address with its own. Its public subnet’s route table sends
0.0.0.0/0to the VPC internet gateway. - For a public NAT gateway, the internet gateway maps that address to the Elastic IP associated with the gateway. The remote service sees the Elastic IP as the caller.
- The reply arrives at the Elastic IP, is translated back to the NAT gateway and then to the originating instance.
Why unsolicited inbound traffic does not get through
The gateway keeps a translation for connections the instance started. An external host that sends a packet to the Elastic IP without a matching outbound connection has no mapping to deliver it to. The private instance therefore has no reachable public endpoint, even though it can reach the internet. AWS states that connections must be initiated from within the VPC that contains the NAT gateway. This is the distinction to keep in mind: the instance has outbound reach, not a public address.
Setting up public internet egress
The following sequence reflects AWS’s management procedure for a public NAT gateway. Confirm that the VPC already has an internet gateway attached before you start.
- Confirm the public subnet’s route table contains a
0.0.0.0/0route whose target is an internet gateway (igw-ID). - In the VPC console, choose NAT gateways, then Create NAT gateway.
- Set the connectivity type to Public, select the public subnet where the gateway will live, and select an existing Elastic IP or allocate a new one.
- Create the gateway and wait until its state shows Available.
- Open the route table associated with the private subnet, choose Edit routes, and add
0.0.0.0/0with the target set to the NAT gateway. Save the change.
AWS also documents a check that the public route works as expected, described in the next section.
Free tools Windows power users keep installed
One-click scans. No signup required.
Public versus private NAT gateway
Both gateway types translate source addresses, but they serve different destinations. Choosing the wrong one is a common source of confusion.
| Choice | Intended connectivity | Setup and limits |
|---|---|---|
| Public NAT gateway | Private-subnet instances to the internet. It can also be routed toward other VPCs or on-premises networks. | Create it in a public subnet, associate an Elastic IP, and route the public subnet to the VPC internet gateway. |
| Private NAT gateway | Private-subnet instances to other VPCs or on-premises networks. | Uses a transit gateway or virtual private gateway path. It has no Elastic IP. An internet gateway drops traffic routed from a private NAT gateway, so it cannot provide internet egress. |
Source: AWS NAT gateways, Amazon VPC User Guide.
Verifying that traffic uses the gateway
AWS’s use-case documentation suggests two checks from a private instance. These are AWS-documented test suggestions, and the Amazon VPC User Guide pages do not show a date on them.
- Trace the path. Run
traceroute(Linux) ortracert(Windows) to a public host. The trace should include the NAT gateway’s private IP address as a hop. - Check the source address. Use a public service that echoes the caller’s IP address. For the public internet route, it should show the gateway’s Elastic IP, not the instance’s private address.
If the trace does not pass the gateway, the most common causes are a missing or misdirected 0.0.0.0/0 route on the private subnet, or a gateway still in a state other than Available. The AWS pages describe the route-table configuration in detail in the AWS NAT gateway use cases documentation, and the procedure for managing gateways is in AWS work with NAT gateways.
Availability Zones and resilience
A NAT gateway is created in one Availability Zone and is redundant within that zone. It is not redundant across zones. AWS notes that if workloads occupy several AZs and share one gateway, a failure in the gateway’s AZ can remove internet access for resources in the other AZs.
The per-AZ pattern
AWS recommends creating a NAT gateway in each AZ that contains relevant resources and routing each subnet’s internet-bound traffic to the gateway in its own AZ. This keeps traffic in-zone and removes the cross-zone dependency. The trade-off is one gateway per zone to create, route, and pay for, which is why the choice should follow the actual resilience requirement rather than being made by default.
Service limits
AWS’s NAT gateway basics page lists these figures. The page does not show a publication date, so confirm them against the current documentation before relying on them, because limits can change.
- Bandwidth: 5 Gbps baseline, scaling automatically up to 100 Gbps.
- Packets: one million packets per second, scaling up to 10 million.
- Connections: up to 55,000 simultaneous connections per IPv4 address to each unique destination.
Source: AWS NAT gateway basics.
Cost drivers
AWS bills for each hour a NAT gateway is available and for each gigabyte it processes. The AWS pricing page describes these billing dimensions but does not give dollar rates in the content we could confirm, and rates vary by Region. Check the AWS pricing for NAT gateways page for the Region you intend to use.
- Data processing dominates high-volume workloads. Every gigabyte passing through the gateway is billed, so the amount of traffic matters as much as the number of gateways.
- Keep traffic in the same AZ. AWS suggests placing high-volume resources in the same AZ as the gateway, or creating a gateway in each AZ.
- Consider endpoints for AWS services. When most traffic goes to supported AWS services, interface or gateway endpoints may be a better path. Compare endpoint pricing separately, since it has its own billing.
Security boundaries
A NAT gateway is a translation point, not a firewall policy. AWS states that security groups cannot be attached to a NAT gateway. Instance traffic is controlled by security groups on the instances, and network ACLs on the NAT gateway’s subnet control traffic at that subnet level. Describe NAT as a path for outbound connections, and keep your access rules in security groups and network ACLs.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteIPv6 and other egress paths
NAT gateways handle IPv4. AWS describes separate options for other cases, and these should not be treated as drop-in replacements for the IPv4 example above.
Best Value
- Egress-only internet gateway provides outbound-only internet communication for IPv6 workloads.
- NAT64 with DNS64 lets IPv6 workloads reach IPv4 resources.
Each has its own route and configuration requirements, documented in the AWS NAT gateways pages.
NAT instances and the DEV article’s framing
The exact-title article on DEV presents NAT instances as an older, self-managed comparison and points readers toward VPC endpoints and routing strategies. Those are the author’s explanations, not AWS statements. A NAT instance is not automatically cheaper or equivalent to a managed gateway; the right comparison depends on the service needs, the operational effort you are prepared to own, where the data flows, and current regional pricing. The original post is at the exact-title DEV article.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
