Lecture 25: Egress-only Internet Gateway (IPv6)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：03:49
- 来源：Udemy Lecture 50976121
- Slide 数量：5
- 画面切换：00:18、00:54、01:19、02:33
扫描说明
按 Udemy Transcript 的 55 个时间点逐一定位并截取缩略帧，比较相邻画面后确认 4 次主要 Slide 切换。标题、IPv4 NAT 路径、VPC 的 IPv6 模式、私有子网 IPv6 路径和仅出站互联网网关架构分别作为独立小节；同一架构页中的箭头与路由逐步出现视为动画构建。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Why IPv6 Needs a Different Egress Pattern
时间范围：00:00–00:18
总结 / Summary
中文
讲师从上一节的 NAT 网关（NAT Gateway）回顾切入：NAT 网关让私有子网（Private Subnet）中的 IPv4 实例访问互联网。本讲将比较 IPv4 NAT 路径与 IPv6 的出站需求，并引出仅出站互联网网关（Egress-only Internet Gateway）。
English
The lecture begins by recalling how a NAT Gateway gives IPv4 instances in private subnets outbound Internet access. It then contrasts that IPv4 pattern with IPv6 egress requirements and introduces the Egress-only Internet Gateway.
Transcript
00:00 Okay.
00:00 So in the earlier section that is VPC fundamentals.
00:03 We talked about AWS managed Nat gateways, which allows the internet access to the instances in the
00:11 private subnets.
00:12 Right.
00:13 And in that case the traffic goes something like this where you have the VPC and then you have the route
2. IPv4 Private-Subnet Internet Access
时间范围：00:18–00:54
总结 / Summary
中文
在 IPv4 架构中，公有子网（Public Subnet）的路由表把默认路由指向互联网网关（Internet Gateway, IGW），NAT 网关位于公有子网并拥有由 AWS 管理的公有或弹性 IP（Elastic IP）。私有子网的默认路由指向 NAT 网关，因此源和目标均为 IPv4 时可获得仅出站互联网访问。
English
In the IPv4 design, the public subnet route table sends its default route to an Internet Gateway (IGW), while the NAT Gateway sits in the public subnet with an AWS-managed public or Elastic IP. The private subnet sends its default route to the NAT Gateway, providing outbound access when both source and destination use IPv4.
Transcript
00:18 table for the public subnet where the traffic goes to the internet through the igw.
00:24 And in the public subnet you have the Nat gateway which has the public IP or the elastic IP managed
00:29 by AWS.
00:30 And then in the private subnet you have EC2 instance.
00:33 And in the route table you says that all the internet traffic should go through this Nat gateway.
00:38 So this is IPv4 to IPv4 traffic.
00:41 That means the source is IPv4 address and the destination is also the IPv4 address.
00:48 And in that case Nat gateway is useful.
00:51 But as you know VPC also support IPv6 traffic.
3. IPv6 Addressing in a VPC
时间范围：00:54–01:19
总结 / Summary
中文
VPC 支持双栈模式（Dual-stack Mode），子网可以是仅 IPv4、双栈或仅 IPv6。VPC 中的资源可以使用 IPv4、IPv6 或两者通信，且 VPC 的 IPv4 支持不能关闭。由于 IPv6 地址默认具有公网可路由性，关键问题是如何让持有 IPv6 地址的实例仍保持私有、只允许其主动出站。
English
A VPC supports dual-stack operation, and subnets may be IPv4-only, dual-stack, or IPv6-only. Resources can communicate over IPv4, IPv6, or both, and IPv4 support cannot be disabled for the VPC. Because IPv6 addresses are publicly routable by default, the challenge is keeping IPv6 instances private while still allowing them to initiate outbound connections.
Transcript
00:54 And it supports dual stack mode where you could have the subnets which are IPv4 only, or dual stack
01:02 or IPv6 only subnet.
01:05 Also, you know, IPv6 addresses are public by default.
01:09 But what if you need EC2 instances with IPv6 IP address to remain private wait inside your private subnet.
4. Why NAT Gateway Is Not the IPv6 Solution
时间范围：01:19–02:33
总结 / Summary
中文
当 VPC、子网和实例都具有 IPv6 前缀与地址时，路由表会包含 IPv6 本地路由（IPv6 Local Route）。但传统 NAT 网关（NAT Gateway）不支持 IPv6 到 IPv6 的转换路径；若直接通过普通 IGW 暴露实例，就失去了私有子网的入站保护语义。因此需要一种既允许 IPv6 出站、又拒绝互联网端主动入站连接的网关。
English
When the VPC, subnet, and instance have IPv6 prefixes and addresses, the route table includes an IPv6 local route. A traditional NAT Gateway does not provide an IPv6-to-IPv6 path, while routing directly through a normal IGW would remove the private-subnet inbound protection model. AWS therefore needs a gateway that permits IPv6 egress but rejects Internet-initiated inbound connections.
Transcript
01:19 Okay.
01:20 So now let's say we also have a VPC with IPv6 addresses.
01:25 And from this instance we want to reach to IPv6 address on the internet.
01:30 And in that case we also will have the VPC Cidr range for IPv6 and same for the subnet.
01:36 And which means this instance will also have IPv6 address.
01:41 And in that case the route tables for this subnet will be something like this where there will be additional
01:47 route for the VPC IPv6 Cidr range and the target will be local.
01:51 And similarly for the private subnet there will be this route.
01:55 Now if you see this setup, if you want to communicate using IPv6 address from this instance to this
02:02 particular IPv6 address on the internet, the traffic cannot go through the Nat gateway because Nat
02:08 gateway does not support IPv6 to IPv6 traffic.
02:12 Now, if you want this communication to happen, you would have to put this instance in the public subnet.
02:19 But you don't want that.
02:20 You want similar behavior that you get with IPv4 address.
02:25 Right.
02:26 So what do you do?
02:27 Now for that AWS also supports something called egress only internet gateway.
5. Egress-only Internet Gateway Routing
时间范围：02:33–03:49
总结 / Summary
中文
仅出站互联网网关（Egress-only Internet Gateway, EIGW）只允许 VPC 内资源发起到互联网的 IPv6 连接，并阻止外部主机直接向 VPC 内 IPv6 地址发起连接。配置时，在私有子网路由表中把 ::/0 指向 EIGW。一个 VPC 可以同时附加普通互联网网关（Internet Gateway, IGW）和 EIGW，分别满足不同的 IPv4/IPv6 公网访问模式。
English
An Egress-only Internet Gateway (EIGW) allows resources inside the VPC to initiate IPv6 connections to the Internet while blocking outside hosts from initiating connections to those IPv6 addresses. The private subnet route table points ::/0 to the EIGW. A VPC can have both a normal Internet Gateway and an EIGW to support different IPv4 and IPv6 access patterns.
Transcript
02:33 So.
02:34 Which means it only supports the egress traffic.
02:37 That means the outbound traffic from the VPC to the internet, and it doesn't allow outside hosts to
02:43 communicate directly to your IPv6 address inside the VPC.
02:48 So basically you create another internet gateway but of type egress only.
02:54 And then you have to modify the route table for the private subnet.
02:58 And there you say if the traffic is going to colon colon slash zero which is all IPv6 addresses then
03:05 it should go through egress only.
03:07 Internet gateway.
03:09 And now from this host, if you try to go to the internet over IPv6 address then traffic will go something
03:17 like this.
03:18 So that is what egress only internet gateway is.
03:22 So for your VPC you can have both internet gateway and egress only internet gateway as well.
03:29 So that's about egress only internet gateway which is used for host IPv6 addresses to communicate outside.
03:35 Similar to the Nat.
03:37 And in the next lecture, let's do a quick exercise where we will see this in action.
03:43 So that's it for this lecture.
03:45 And now let's do an exercise.
03:47 Thank you.
整讲总结 / Overall Summary
中文
仅出站互联网网关（Egress-only Internet Gateway）为 IPv6 提供与私有 IPv4 工作负载经 NAT 出站相似的安全语义，但它不执行 NAT：IPv6 地址保持不变，网关通过状态化的方向控制允许内部发起连接并阻止外部主动入站。考试重点是私有子网的 ::/0 → EIGW 路由，以及它与普通 IGW、NAT 网关适用协议和流量方向的区别。
English
The Egress-only Internet Gateway gives IPv6 workloads security semantics similar to private IPv4 workloads using NAT, but it does not perform address translation. IPv6 addresses remain unchanged; the gateway permits internally initiated connections and blocks unsolicited inbound initiation. Key exam points are the private subnet route ::/0 → EIGW and how EIGW differs from a normal IGW and a NAT Gateway in protocol support and traffic direction.