Lecture 18: NAT Gateway
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：09:54
- 来源：Udemy Lecture 24112500
- Slide 数量：4
- 画面切换：约 05:04、07:21、09:28
扫描说明
按页面英文 transcript 的 228 个时间点逐一定位并检查视频画面。第一张架构图中的私有实例、NAT、互联网和数据包地址逐步出现视为同一幻灯片的动画构建；其余三张讲义页分别单列。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Outbound Internet Access from a Private Subnet
时间范围：00:00–05:04
总结 / Summary
中文
私有子网中的实例没有公有 IP，也没有直接指向互联网网关（Internet Gateway, IGW）的路由，因此需要网络地址转换（Network Address Translation, NAT）设备提供出站互联网访问。私有子网路由表把 0.0.0.0/0 指向 NAT；NAT 把数据包的私有源地址转换为自己的公有地址，通过 IGW 发出，并把返回包映射回原实例。外部客户端不能借此主动建立到私有实例的入站连接。
English
Instances in a private subnet have no public IP and no direct route to an Internet Gateway (IGW), so they need a Network Address Translation (NAT) device for outbound Internet access. The private subnet route table sends 0.0.0.0/0 to NAT, which translates the packet's private source address to its own public address, forwards it through the IGW, and maps the response back to the original instance. External clients cannot use this path to initiate inbound connections to private instances.
Transcript
00:00 Hello and welcome
00:01 to this lecture where we are going to see
00:03 how to use a NAT gateway
00:06 inside VPC.
00:07 So in the earlier lecture,
00:09 what we have seen is a VPC with a public and private subnet.
00:12 And we also did a exercise where we
00:16 launched EC2 instance A into public subnet,
00:19 EC2 instance B in a private subnet.
00:21 And then from A we connected to B.
00:24 And then we also see while we logged into instance B,
00:27 we could not connect to internet.
00:29 We could not do, being to amazon.com or google.com
00:34 simply because there is no outbound internet connectivity.
00:37 Now, obviously one option is to make instance B
00:41 also public and also put it into a public subnet,
00:45 but that's not the way
00:48 anyone would want to have that, right?
00:50 Maybe you have an application server,
00:52 which needs to be only accessed from the web server,
00:55 but on the application server you want to
00:57 download certain packages or it needs to access
01:01 external websites.
01:02 Now, in that case,
01:03 you only need an outbound internet connectivity
01:05 from the instances in the private subnet, like here,
01:08 you don't need the other way or the other way
01:11 around the connectivity,
01:12 like from internet,
01:13 no one should be able to reach to our instance directly.
01:16 And that's the purpose of private subnet,
01:18 as we learned earlier.
01:20 So what is the solution?
01:21 Of course, the solution is something called a
01:24 NAT (network address translation).
01:26 So what does NAT do is basically,
01:28 you send all your outbound internet traffic to the NAT,
01:32 and then NAT will talk to outside world
01:35 and will exchange a packet for you,
01:37 and will give you the packet back.
01:40 So NAT act as a network address translation unit.
01:44 And how natting work is something like this.
01:47 You need to have this NAT into the public subnet
01:51 because it has to talk to internet directly.
01:54 So that make sense.
01:55 You can launch it in our existing public subnet,
01:57 but ideal is to have a dedicated subnets for NAT as well.
02:02 Now, the scope of NAT is also a AZ level.
02:06 That means when you create a public subnet,
02:09 it will be in either of the AZ and your NAT gateway
02:12 will be in that AZ only.
02:15 But it is very well possible that instances
02:17 from multiple subnet in across different availability zones
02:21 can route their traffic to internet
02:24 through the same NAT gateway.
02:27 And shortly,
02:28 we will also discuss about some highly available
02:31 architecture for the NAT here.
02:35 So, when you create a NAT,
02:36 it should be in a public subnet.
02:38 And of course, you need to modify the route table
02:41 now for your private subnet
02:43 and you need to say,
02:44 if the traffic is going to the internet IP address,
02:48 it has to now go through the NAT, right?
02:52 And this is the device ID for the NAT that we have.
02:56 So once you do that, your traffic should go out
02:59 from this instance to the internet.
03:02 So, what does essentially NAT mean is,
03:05 NAT is network address translation.
03:09 That's how it is said,
03:12 but what exactly it does?
03:13 So, when this instance wants to talk to say a google.com,
03:17 it sends one IP packet, right?
03:20 In that IP packet,
03:22 there is at least these two things,
03:23 source address and the destination address.
03:26 Now, source address is its own private IP address.
03:30 And the destination address is, say Google service,
03:33 a public IP address, which for example,
03:36 we are taking again, an example 1.2.3.4.
03:39 Now, this packet now reaches to the NAT
03:42 and what NAT does is, it does this source natting.
03:45 That is SNAT, right?
03:47 In that case what it does,
03:48 it replaces this packet and instead of this source address,
03:52 it puts its own public IP address
03:55 or Elastic IP address, right?
03:57 So NAT needs Elastic or a public IP address.
04:00 And then it will put its own IP address.
04:02 Let's take an example, say 10.11.12.13,
04:06 and the destination address is same as 1.2.3.4.
04:10 Now, as NAT can talk to internet,
04:12 now this packet from here
04:15 goes to the internet gateway,
04:16 and it will go to the Google's server,
04:19 which is 1.2.3.4
04:22 and Google knows that it has to return the traffic
04:26 or reply to the message.
04:28 And it sends the response
04:31 back to the
04:32 NAT instance here.
04:34 So once the NAT receives the packet,
04:37 it knows that this packet originally I had received from
04:40 this instance,
04:41 it again,
04:42 sends that packet back to this instance.
04:45 So in this whole flow,
04:47 this server neighbor knows about this private IP or this
04:50 EC2 instance, right?
04:51 Only it knows about this NAT IP address
04:55 and that's called the source NAT.
04:57 So, in order to have this NAT functionality,
05:00 there are a couple of options in a VPC.
2. NAT Gateway and NAT Instance
时间范围：05:04–07:21
总结 / Summary
中文
NAT 网关（NAT Gateway）是 AWS 托管服务，应部署在公有子网（public subnet）并具备弹性 IP（Elastic IP, EIP），由 AWS 管理可用性和扩展。NAT 实例（NAT Instance）是自行管理的 EC2，需要使用相应镜像、关闭源/目标检查（source/destination check）、配置 EIP、容量和高可用性。两者都为私有子网执行 VPC 内的数据包地址转换。
English
A NAT Gateway is an AWS-managed service deployed in a public subnet with an Elastic IP (EIP); AWS manages its availability and scaling. A NAT Instance is a customer-managed EC2 instance that requires an appropriate image, disabled source/destination checking, an EIP, capacity planning, and high-availability design. Both perform packet address translation for private subnets within a VPC.
Transcript
05:04 So, first thing is you could have AWS managed NAT,
05:08 which is called NAT gateways.
05:10 And this is what is recommended
05:12 for your production workloads.
05:14 So NAT gateway is a managed AWS service, right?
05:17 You create a NAT gateway into a public subnet,
05:20 you allocate an Elastic IP to that,
05:22 and you modify your route tables
05:24 for your private subnets to send the
05:27 outbound internet traffic through that NAT gateway.
05:30 Now, a good thing is that it is highly available
05:32 within that AZ.
05:33 You don't need to worry about availability of,
05:36 you don't need to really monitor those,
05:38 you don't need to really scale those NAT gateways.
05:41 So, that's given
05:43 by AWS itself.
05:45 But many times you don't want to do that,
05:48 you don't want to use managed NAT gateway.
05:50 There could be multiple reasons.
05:51 One, maybe a cost, that is you see that NAT gateway
05:56 has a little higher cost than
05:58 if you launch your own EC2 instance
06:00 and manage it as a NAT
06:02 or configure it as a NAT,
06:03 probably it has a lesser cost.
06:05 So maybe for your dev and QA,
06:07 you don't need to pay for NAT gateways.
06:09 You can very well do that using
06:11 your own EC2 instance, as well.
06:14 Again, it has to be in a public subnet,
06:16 similar to the NAT gateway.
06:18 There could be other reasons like maybe
06:20 on this particular instance
06:23 you want to put additional IPS and IDS system
06:27 so that you can very well use those software
06:30 to block certain traffic, right?
06:32 So, there could be this kind of reasons
06:35 where you don't want to go with a NAT gateway,
06:37 but otherwise, it is always recommended
06:40 to go with the NAT gateway.
06:42 So, the placement of NAT gateway again,
06:45 it should be in a public subnet like shown here.
06:47 It should also have the Elastic IP address.
06:50 So if you are using NAT gateway, it must have Elastic IP.
06:53 If you are using NAT instance,
06:55 that means you own EC2 instance,
06:57 which acts as a NAT,
06:59 you can have either Elastic IP or Public IP,
07:02 anything is okay.
07:04 There are a few more things
07:06 to consider when you configure
07:07 your own EC2 instance as a NAT,
07:09 and we'll talk about that shortly,
07:12 but so far, let's keep our discussion
07:16 for NAT gateway only.
07:18 So, a NAT
3. NAT Gateway Characteristics
时间范围：07:21–09:28
总结 / Summary
中文
NAT 网关按使用时间和处理带宽收费，创建于特定可用区（Availability Zone, AZ）并使用 EIP。课程列出的性能从 5 Gbps 自动扩展到 100 Gbps。NAT 网关本身不能关联安全组（Security Group）；其子网仍受网络 ACL（Network ACL）控制。它支持 TCP、UDP 和 ICMP，并使用 1024–65535 端口建立出站连接。为提高跨 AZ 的容错能力，通常每个 AZ 单独部署 NAT 网关并让该 AZ 的私有子网使用它。
English
A NAT Gateway is billed by usage time and processed bandwidth, is created in a specific Availability Zone, and uses an EIP. The lecture lists automatic scaling from 5 Gbps up to 100 Gbps. A NAT Gateway itself cannot have a Security Group, although the subnet's Network ACL still applies. It supports TCP, UDP, and ICMP and uses ports 1024–65535 for outbound connections. For fault isolation across AZs, a NAT Gateway is commonly deployed per AZ and used by private subnets in that AZ.
Transcript
07:20 gateway is AWS managed,
07:22 It provides higher bandwidth,
07:24 better availability, and there is no administrative work.
07:28 High availability is taken care by AWS.
07:31 As it's a managed service,
07:33 there is a per hour charges and there are two kinds
07:35 of charges for the NAT.
07:37 One is per hour running cost
07:39 and then how much data it really processes.
07:42 So if you are uploading and downloading,
07:44 say 5GB or 10GB of data, that is per GB charges
07:48 for the NAT for processing that data.
07:52 Now, as you see from the diagram,
07:54 NAT is created in a specific AZ,
07:56 and it uses the Elastic IP address.
07:59 Now, this also means that for some reason,
08:02 if your AZ goes down in which you have the NAT gateway,
08:06 maybe you lose the outbound internet connectivity
08:09 for other instances,
08:10 if you are routing all traffic to the single NAT gateway,
08:14 and we will shortly see how to handle this.
08:16 And now with respect to the bandwidth,
08:19 NAT scales from 5 Gbps
08:22 up to 100 Gbps.
08:24 And as I said, it automatically does that,
08:27 you don't need to configure anything
08:28 on the NAT gateway site.
08:31 Other thing to remember is that NAT gateway
08:33 does not have any security group.
08:35 That means you can't really control
08:38 what traffic flows in and out of your NAT gateway.
08:41 It is completely managed by AWS,
08:43 however, whatever Network ACL you apply
08:47 at the subnet level,
08:48 also applies to your NAT gateways.
08:50 Because if you, again,
08:51 look at the network diagram
08:54 a NAT gateway sits inside your subnet,
08:57 so it follows all the Network ACL rules,
09:00 which you set at the subnet level.
09:03 As a protocol it supports TCP, UDP and ICMP.
09:08 And for outbound internet connection as we saw,
09:11 typically our system uses the ephemeral port range,
09:14 but the NAT uses the port range from 1024-65535.
09:19 So, these are the thing you need to remember for the NAT.
09:23 Shortly, we'll also do the exercise around this,
4. Demo – NAT Gateway Design
时间范围：09:28–09:54
总结 / Summary
中文
演示架构要求在公有子网创建 NAT 网关并为其分配 EIP；公有子网依靠互联网网关（Internet Gateway）连接互联网。私有子网路由表把 0.0.0.0/0 的目标设为 NAT 网关，同时保留 VPC 本地路由。这样私有 EC2-B 可以发起互联网访问，但仍不会暴露为可从互联网直接访问的实例。
English
The demo design creates a NAT Gateway in the public subnet and assigns it an EIP, while the public subnet reaches the Internet through the Internet Gateway. The private subnet route table targets the NAT Gateway for 0.0.0.0/0 while retaining the VPC local route. This allows private EC2-B to initiate Internet access without becoming directly reachable from the Internet.
Transcript
09:28 in which we are going to see
09:29 how to set up a NAT gateway
09:31 and how to route traffic from my private subnet
09:35 using the NAT to the internet.
09:37 So, if you see,
09:39 we have already set up to at least this public subnet,
09:44 private subnet, and two instances.
09:45 And in the next lecture,
09:47 we will see how to add a NAT gateway with the same setup.
09:50 So stay tuned.
09:52 Thank you.
整讲总结 / Overall Summary
中文
NAT 网关（NAT Gateway）让没有公有 IP 的私有子网实例发起互联网连接，同时避免互联网主动连接这些实例。它必须位于公有子网、使用弹性 IP（Elastic IP），私有子网路由表则把默认路由指向 NAT。NAT 网关由 AWS 管理扩展和可用性，但仍是可用区级资源（AZ-scoped resource），高可用设计通常按 AZ 部署。它与互联网网关（Internet Gateway）、路由表和网络 ACL 共同构成完整出站路径。
English
A NAT Gateway lets instances without public IPs initiate Internet connections while preventing Internet clients from initiating connections to them. It must reside in a public subnet and use an Elastic IP, while private subnet route tables send their default route to NAT. AWS manages scaling and availability, but the gateway remains an AZ-scoped resource, so resilient designs commonly deploy one per AZ. It works together with the Internet Gateway, route tables, and Network ACLs to form the outbound path.
返回顶部 ↑