Lecture 21: NAT EC2 Instance and Demo
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：10:27
- 来源：Udemy Lecture 24112520
- Slide / 操作阶段数量：7
- 画面切换：约 02:59、03:42、05:46、06:45、07:30、07:49
扫描说明
按页面英文 transcript 的 94 个时间点逐一定位并检查视频画面。静态原理图、AWS 控制台中的关键配置阶段、终端验证和最终对比表分别单列；同一控制台步骤中的短暂加载画面不单独计为小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. NAT Instance Architecture and Required Configuration
时间范围：00:00–02:59
总结 / Summary
中文
NAT 实例（NAT Instance）是在公有子网中运行、承担网络地址转换的普通 EC2 实例。与托管 NAT 网关（NAT Gateway）相比，它需要使用合适的 NAT AMI 或自行配置转发软件、拥有公有 IP 或弹性 IP（Elastic IP），并关闭源/目标检查（Source/Destination Check）。私有子网路由表（Private Route Table）的默认路由应指向该实例的弹性网络接口（Elastic Network Interface, ENI）。这类实例可安装入侵检测/防御系统（IDS/IPS）等自定义软件，但运维责任也由用户承担。
English
A NAT Instance is a regular EC2 instance in a public subnet that performs network address translation. Unlike a managed NAT Gateway, it requires a suitable NAT AMI or custom forwarding software, a public or Elastic IP, and disabled Source/Destination Check. The private subnet's default route targets the instance's Elastic Network Interface (ENI). It can host custom software such as IDS/IPS, but the customer owns the operational burden.
Transcript
00:00 Hello and welcome to this lecture. So in the earlier lecture, we saw how NAT gateways work
00:04 and it is a managed NAT service from AWS. But in certain cases, as I said, you might
00:09 need your own EC2 instance set up as NAT, maybe for cost reason, or you need to have
00:16 certain softwares on that EC2 instance like IPS intrusion detection system and intrusion
00:22 prevention systems. And in that case, you can also use your own EC2 instance and configure
00:28 it as a NAT. So for this, you need to do some additional configurations, like in NAT gateway,
00:35 there is hardly anything we did, we just launched NAT gateway in a public subnet and modified the
00:40 route tables for private subnet. Here, while we launch our own EC2 instance, we need to make sure
00:47 that the instance has been launched using NAT EMIs, which are there publicly available to be
00:54 used. Then we also need to disable the source destination check. Now that is important to
01:00 understand when you have your own EC2 instance, right? And you want to configure it as a NAT.
01:07 Now understand that other EC2 instance, which has to access the internet will send the traffic to
01:13 this instance and it will send this traffic to internet, right? And from there, the traffic
01:18 will come back and it will come back to originating EC2 instance. Now for this instance,
01:25 by default, it only accepts the traffic where the destination packet is its own IP address.
01:32 That means by default, EC2 can only accept the traffic where the packet destination address
01:38 is itself. But if you look at this, this EC2 is accepting the traffic, which is for say a
01:45 google.com, right? And then forwarding the traffic here. So at instance level, there is a
01:51 setting called source destination check. And you have to disable that in order to configure an EC2
01:57 instance as a NAT so that it can also accept the packet where the destination is not itself,
02:03 right? So remember, this is very important. Again, this EC2 must be in a public subnet
02:09 like shown here. And again, you need to modify your route table. But this time, the
02:15 destination of the route table won't be a NAT gateway, but it would be an ENI,
02:22 which is attached to this instance. And during the demo, I will show you how this route entry
02:27 looks like. Now before we move forward, just one thing to notice that AWS has discontinued
02:33 supporting the NAT AMIs that we are going to use during this demo. So which means you
02:39 won't be able to do this exercise on your own. And that's where I'm just demoing this to you.
02:45 And as you know, the purpose is to just understand how can you configure EC2 instance
02:50 as a NAT instance. Alright, so let's get started. And for this, let me go back to my earlier setup.
2. Remove the NAT Gateway and Identify a Blackhole Route
时间范围：02:59–03:42
总结 / Summary
中文
演示先删除此前创建的 NAT 网关（NAT Gateway）。由于私有路由表仍引用已删除的目标，默认路由显示为黑洞（Blackhole）。这是一种常见故障排查信号：路由存在，但下一跳资源已不存在或不可用。继续配置前需要删除该失效路由。
English
The demo first deletes the previously created NAT Gateway. Because the private route table still references the deleted target, its default route becomes a Blackhole. This is a common troubleshooting signal: the route exists, but the next-hop resource is gone or unavailable. The invalid route must be removed before proceeding.
Transcript
02:58 So this is my NAT gateway. Let's do one thing, let's delete this NAT gateway because we need to
03:05 have the NAT instance instead of this. So I'm just deleting this. And also let's modify the
03:05 route tables and remove the route which we had added for the route table. Now you see this,
03:18 right? This is interesting. When your NAT gateway is deleted, you see there is a black hole here
03:23 because we say the traffic has to go through this, but this device does not exist, right?
03:28 So many times it happens during troubleshooting, you will find this kind of black holes. And then
03:33 you need to remove that and save the routes. Okay. In that case, let's go and create our own
3. Launch and Secure the NAT EC2 Instance
时间范围：03:42–05:46
总结 / Summary
中文
讲师从社区 AMI（Community AMI）中选择 NAT AMI，使用小型实例规格并把实例放入公有子网（Public Subnet），同时确保它具有公网地址。由于 NAT 实例需要接收来自私有子网的转发流量，还要配置安全组（Security Group），允许 VPC CIDR 中所需的 ICMP、HTTP 和 HTTPS 等协议。与 NAT 网关不同，NAT 实例的流量策略由用户自行控制。
English
The instructor selects a NAT AMI from Community AMIs, launches a small instance in the public subnet, and ensures that it has a public address. Because the NAT Instance receives forwarded traffic from private subnets, its Security Group must permit the required protocols from the VPC CIDR, such as ICMP, HTTP, and HTTPS. Unlike a NAT Gateway, the customer controls these instance-level traffic rules.
Transcript
03:42 NAT EC2 instance. I'm going to my EC2 console now and launching the instance, but this time I'll
03:50 search for a NAT AMI here. So I'll just search for NAT and I will search in the community AMIs.
04:01 And you see here, I see this NAT AMI. I'll just select that is a NAT. I will select T2 micro.
04:09 Now, as you know, NAT needs to be in a public subnet. So I'm making sure it is in my public
04:15 subnet. It also has a public IP. Now you can also attach an elastic IP, but for me, it is okay.
04:22 I'm not going to running this setup for long. So I'm just using the public IP storage. I'm going
04:29 with default tag. Definitely. I want to add a tag, say NAT EC2. Now security group. This is
04:38 interesting. Now, again, look at this diagram. This instance will accept the traffic from all
04:44 the instances in a private subnet. And that traffic could be anything for that matter.
04:49 It could be HTTP, HTTPS, ping. So mostly you want to allow all the traffic from your private
04:56 instances, not SSH for sure, because we are not doing the SSH outbound, but let's open other
04:56 traffic. Let's open ICMP. That is for sure we need it. And we need it for VPCC IDR so that any
05:11 instance can access that using the NAT. Also, let me add maybe HTTP traffic and HTTPS traffic.
05:23 So I'm just, I'll just go and add that.
05:29 Also, let me add HTTPS so that we can pull some content from the internet.
05:39 Okay. So that's a security group for NAT and we'll just go with the default and we'll launch
4. Disable Source/Destination Check
时间范围：05:46–06:45
总结 / Summary
中文
EC2 默认执行源/目标检查（Source/Destination Check），只接受源地址或目标地址与本实例相关的流量。NAT 实例必须代表其他主机转发数据包，因此要在实例或弹性网络接口（Elastic Network Interface, ENI）级别关闭此检查。否则，即使路由表正确，转发流量也会被 EC2 平台丢弃。
English
EC2 enables Source/Destination Check by default, accepting traffic whose source or destination is associated with the instance. A NAT Instance forwards packets on behalf of other hosts, so this check must be disabled at the instance or ENI level. Otherwise, the EC2 platform drops forwarded traffic even when the route table is correct.
Transcript
05:46 the instance. Okay. So instance has been launched, but as you know, we need to do additional settings
05:53 the very first thing you need to make sure is you disable the source and destination checks
05:58 for this instance. So let's do that. Let's go to this NAT EC2 instance and let's go to instance
06:06 settings, sorry, actions. And in the networking, we would have this setting called change source
06:14 destination check, and we need to just disable these settings. So let's wait for some more time.
06:28 Okay. So as of now, you can see that the, it is at the network instance level ENI level. So
06:37 let's stop this and save.
5. Update the Private Route Table
时间范围：06:45–07:30
总结 / Summary
中文
在修改路由前，私有 EC2 仍无法访问互联网。随后编辑私有路由表（Private Route Table），把 0.0.0.0/0 的目标从 NAT 网关改为 NAT EC2 实例（控制台实际选择其网络接口/实例目标）。这样私有子网的互联网流量会交给 NAT 实例转发。
English
Before the route change, the private EC2 instance still cannot reach the Internet. The private route table is then edited so 0.0.0.0/0 targets the NAT EC2 instance (represented by its instance or network-interface target in the console). Internet-bound traffic from the private subnet is now handed to the NAT Instance.
Transcript
06:45 So let's wait for some time for this instance to be functioning. And by that time, let's go to our
06:51 root tables and now just verify if I can access the google.com like earlier. I cannot, this is
06:56 from my private EC2 instance. I still cannot. Now let's go back and modify the root tables for this
07:05 particular private subnet, edit the roots and say, if the traffic is going to internet,
07:12 I want to rather use my instance, which is my NAT EC2 instance. So it will just
07:21 give me the dropdown. Let's pick our NAT. Okay. And save the routes. Okay. Let's go back and
6. Verify Internet Access Through the NAT Instance
时间范围：07:30–07:49
总结 / Summary
中文
保存路由后，私有 EC2 对公网域名的测试成功，证明流量已经通过 NAT 实例（NAT Instance）发出。完整路径为：私有实例 → 私有路由表（Private Route Table）→ NAT EC2/ENI → 互联网网关（Internet Gateway, IGW）→ 互联网。
English
After saving the route, the public-domain connectivity test from the private EC2 instance succeeds, proving that traffic is flowing through the NAT Instance. The full path is private instance → private route table → NAT EC2/ENI → Internet Gateway (IGW) → Internet.
Transcript
07:29 check if it is working. And yes, you can see the traffic now is flowing through the NAT
07:35 EC2 instance and I'm able to access the internet. So basically what we did is just made this setup
07:41 available for us. So that's in short is a NAT EC2 instance. And just to make sure we understand the
7. NAT Gateway vs NAT Instance
时间范围：07:49–10:27
总结 / Summary
中文
NAT 网关（NAT Gateway）由 AWS 托管、单 AZ 内高可用、可自动扩展到更高吞吐量，按运行时间和数据处理量计费，但不能绑定安全组，也不适合作端口转发或堡垒机（Bastion Host）。NAT 实例（NAT Instance）的性能、可用性、补丁和故障转移均由用户管理，成本取决于实例类型；它能使用安全组、安装自定义软件、执行端口转发或兼任堡垒机。考试通常优先选择 NAT 网关，只有明确要求更多实例级控制或自定义软件时才考虑 NAT 实例。
English
A NAT Gateway is AWS-managed, highly available within one AZ, and capable of automatically scaling to higher throughput. It charges for running time and processed data, but it cannot use Security Groups and is not intended for port forwarding or bastion-host duties. A NAT Instance leaves performance, availability, patching, and failover to the customer, with cost based on the EC2 type; it can use Security Groups, run custom software, forward ports, or act as a bastion. Exams generally favor NAT Gateway unless the requirement explicitly calls for deeper instance-level control or custom software.
Transcript
07:49 differences. So NAT gateway, if you see it is highly available within the AZ and it is,
07:56 you have to create multiple NAT gateways in multiple AZs to make sure it is resilient to
08:02 AZ failure. NAT EC2 instance, you can manage the failover using the scripts where all the
08:10 traffic is routed through one EC2 instance. And if it fails, your route table gets modified and
08:15 the traffic can be routed through other NAT instance as well. With respect to the performance,
08:21 NAT gateway can scale up to 100 Gbps bandwidth. When it comes to the NAT instance, it depends on
08:27 basically instance configuration. Typically it is 5 Gbps and that too also depends on the
08:33 NAT EC2 instance type. Maintenance as you know, NAT gateway is completely managed versus NAT
08:39 EC2 instance. You need to manage the high availability, any patching or anything you
08:43 want to do on that instance. So for performance software is optimized for handling the NAT
08:49 traffic and it is now in case of NAT instance, a generic Amazon Linux AMI is used to perform the
08:56 NAT. Cost perspective, I would say NAT gateway is having two kind of charges, one per hour running
09:02 cost as well as how much data it processes. And NAT instance charges are typically based on the
09:07 instance type that you select. Again IP addresses, NAT gateway should only have the elastic IP
09:15 addresses. Now NAT instance can have elastic as well as public IP address. Security wise, NAT
09:22 gateway does not have security groups. That means you can't really control the traffic there,
09:27 but again you can use network ACL as I said. However for NAT instance as it is nothing but
09:32 another EC2 instance inside your subnet, you can apply both the security group as well as
09:37 network ACL rules there. You can't do port forwarding or you can't use NAT gateway as a
09:43 bastion host. But being an EC2 instance again, you can do same thing with NAT EC2 instance as well.
09:50 So these are all the differences between the NAT gateway and NAT EC2 instance that you should know.
09:56 And from your exam perspective, typically the choice should be mostly NAT gateway because it's
10:01 a fully managed AWS service and AWS want you to use NAT gateway over the NAT EC2 instance.
10:07 But just in case if it ask about having more control over the EC2 instance, adding more
10:14 software on top of that and then configuring it as a NAT, at that time you should think about
10:19 NAT EC2 instance. Alright, so I hope it is clear and with that now let's go to the next lecture.
整讲总结 / Overall Summary
中文
本讲展示了如何用 EC2 实例构建自管理 NAT：选择 NAT AMI、部署在公有子网、配置安全组（Security Group）、关闭源/目标检查（Source/Destination Check），再让私有路由表（Private Route Table）指向该实例。它提供比托管 NAT 网关（NAT Gateway）更多的流量与软件控制，但也要求用户负责扩展、高可用、故障转移、补丁和监控。实际架构与考试场景中，应默认优先选择托管 NAT 网关，除非需求明确需要 NAT 实例才能提供的能力。
English
This lecture demonstrates a self-managed NAT built on EC2: select a NAT AMI, deploy it in a public subnet, configure its Security Group, disable Source/Destination Check, and point the private route table to the instance. It offers more traffic and software control than a managed NAT Gateway, but the customer must handle scaling, high availability, failover, patching, and monitoring. In production designs and exam scenarios, prefer the managed NAT Gateway unless a requirement explicitly needs capabilities that only a NAT Instance provides.
返回顶部 ↑