网络课程笔记

Lecture 19: Hands On: Create NAT Gateway

• 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
• 视频时长：03:34
• 来源：Udemy Lecture 24112506
• Slide / 操作阶段数量：5
• 画面切换：约 01:05、01:29、01:41、03:26

扫描说明

按页面英文 transcript 的 79 个时间点逐一定位并检查视频画面。静态架构图、操作步骤页、终端验证以及 VPC 控制台中的关键配置阶段分别单列。

Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。

1. Demo Architecture and NAT Placement

时间范围：00:00–01:05

总结 / Summary

中文

现有架构包含公有子网（Public Subnet）、私有子网（Private Subnet）和两台 EC2 实例。要让私有 EC2-B 获得出站互联网访问，需要在公有子网创建 NAT 网关（NAT Gateway），为其绑定弹性 IP（Elastic IP, EIP），再把私有子网路由表（Route Table）的默认路由指向该 NAT 网关。生产环境更适合为 NAT 使用专用子网（Dedicated Subnet）。

English

The existing design contains a public subnet, a private subnet, and two EC2 instances. To give private EC2-B outbound Internet access, create a NAT Gateway in the public subnet, associate an Elastic IP (EIP), and point the private subnet's default route to that gateway. A dedicated NAT subnet is preferable in production.

2. Exercise Plan

时间范围：01:05–01:29

总结 / Summary

中文

实验分为三个核心步骤：为 NAT 网关（NAT Gateway）分配弹性 IP（Elastic IP）、在公有子网中创建 NAT 网关并等待其状态变为 Available，随后修改私有路由表（Private Route Table）。NAT 网关创建和就绪通常需要几分钟。

English

The exercise has three core steps: allocate an Elastic IP for the NAT Gateway, create the gateway in the public subnet and wait until it becomes Available, then update the private route table. Provisioning and readiness can take several minutes.

3. Baseline – Private Instance Has No Internet

时间范围：01:29–01:41

总结 / Summary

中文

配置前先建立基线：从私有 EC2 实例（Private EC2 Instance）执行对公网域名的 ping 失败。这验证了当前私有子网没有默认出站路径，后续成功结果才能明确归因于 NAT 网关和路由修改。

English

The demo first establishes a baseline by pinging a public domain from the private EC2 instance. The failure confirms that the private subnet currently has no default outbound path, making the later success attributable to the NAT and routing changes.

4. Create the NAT Gateway and Update the Private Route

时间范围：01:41–03:26

总结 / Summary

中文

在 VPC 控制台（VPC Console）创建 NAT 网关（NAT Gateway），选择现有公有子网并现场分配弹性 IP（Elastic IP）。随后编辑私有路由表（Private Route Table），把互联网目标 0.0.0.0/0 的下一跳设为 NAT 网关。NAT 网关本身不关联安全组（Security Group）；配置完成后只需等待状态从 Pending 变为 Available。

English

In the VPC Console, the instructor creates a NAT Gateway in the existing public subnet and allocates an Elastic IP. The private route table is then edited so 0.0.0.0/0 targets the NAT Gateway. NAT Gateways do not have Security Groups; after configuration, the remaining step is to wait for the state to change from Pending to Available.

5. Verification – Outbound Connectivity Works

时间范围：03:26–03:34

总结 / Summary

中文

NAT 网关状态变为 Available 后，私有 EC2-B 对公网域名的 ping 成功。这验证了完整出站链路：私有实例 → 私有路由表（Private Route Table）→ NAT 网关（NAT Gateway）→ 互联网网关（Internet Gateway, IGW）→ 互联网。

English

After the NAT Gateway becomes Available, the private EC2-B instance successfully pings a public domain. This validates the complete outbound path: private instance → private route table → NAT Gateway → Internet Gateway (IGW) → Internet.

整讲总结 / Overall Summary

中文

本讲完成了 NAT 网关（NAT Gateway）的实际部署：先确认私有 EC2 无法访问互联网，再在公有子网中创建带弹性 IP（Elastic IP）的 NAT 网关，把私有路由表（Private Route Table）的 0.0.0.0/0 指向它，并等待资源可用。最终 ping 成功证明私有实例能够通过 NAT 和互联网网关（Internet Gateway）发起出站通信，同时仍不需要公有 IP。

English

This lecture completes the practical NAT Gateway deployment: first confirming that the private EC2 instance cannot reach the Internet, then creating a NAT Gateway with an Elastic IP in the public subnet, pointing the private route table's 0.0.0.0/0 route to it, and waiting for the resource to become available. The successful ping proves that the private instance can initiate outbound communication through NAT and the Internet Gateway without requiring a public IP.