Lecture 26: Hands-on: Egress-only internet gateway for IPv6 outbound traffic
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：11:23
- 来源：Udemy Lecture 50976129
- Slide 数量：10
- 画面切换：02:11、02:24、03:14、04:22、05:44、07:29、09:11、09:58、11:07
扫描说明
按 Udemy Transcript 的 177 个时间点逐一定位并比较视频画面。架构说明、步骤清单以及 AWS 控制台和终端中的 8 个关键操作阶段分别单列；最终 10 张截图均在关闭 Transcript 自动滚动、隐藏播放器控件并校准真实视频边界后取得。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Exercise Architecture and Expected Result
时间范围：00:00–02:11
总结 / Summary
中文
练习目标是在双栈 VPC（Dual-stack VPC）中创建公有子网（Public Subnet）和私有子网（Private Subnet）。堡垒主机（Bastion Host）位于公有子网并使用公有 IPv4，私有 EC2 同时持有私有 IPv4 和 IPv6。基线架构没有 NAT 网关（NAT Gateway），因此私有实例的 IPv4/IPv6 出站均失败；加入仅出站互联网网关（Egress-only Internet Gateway, EIGW）后，应只有 IPv6 出站成功。
English
The exercise builds public and private subnets in a dual-stack VPC. A bastion host in the public subnet has a public IPv4 address, while the private EC2 instance has both private IPv4 and IPv6 addresses. With no NAT Gateway, both IPv4 and IPv6 outbound tests initially fail. After adding an Egress-only Internet Gateway (EIGW), only IPv6 egress should succeed.
Transcript
00:00 Okay, so let's do this.
00:02 Hands on exercise for egress only.
00:04 Internet gateway.
00:06 So in this exercise, what we need to do is create a VPC.
00:09 And this time we'll create a VPC with both IPv4 and IPv6 Cidr range.
00:15 Once we create the VPC let's create the internet gateway.
00:19 And then let's create a public subnet.
00:21 And I will explain why we need public subnet.
00:24 And as we create a public subnet there should be the Cidr range also for IPv4 and IPv6 cidrs.
00:32 And the route table for this public subnet should have entry for internet traffic through this internet
00:37 gateway.
00:39 Then we will also create a private subnet.
00:41 And again we'll have the Cidr ranges for both IPv4 and IPv6.
00:47 And it will also have the route table where it will have these two local routes by default.
00:53 Now after this we will launch just a bastion host because we want to get access to the EC2 instance
01:00 in the private subnet.
01:01 So we will have bastion host with, say, a public IP that is IPv4 address.
01:06 And then we will have a private EC2 instance which has the private IP and IPv6 address.
01:13 Right now after that we will ssh into the bastion host.
01:17 And from there we will ssh into this EC2 instance.
01:22 Now if you see this architecture it does not have Nat gateway which means now from this EC2 instance,
01:29 if I try to reach to say ping google.com on IPv4 address, it won't work.
01:35 And at the same time, even if I do IPv6 ping to google.com, it will also won't work because there
01:42 is no outbound connectivity for this instance to the internet.
01:47 And in order to do that, we will then create egress only internet gateway.
01:52 We will update this route table for IPv6 traffic.
01:56 And then from this instance we should only be able to reach to IPv6 address and not IPv4 address.
02:03 So this traffic should work.
02:06 So that's the goal of this exercise and all the steps for this exercise.
2. Twelve-step Exercise Plan
时间范围：02:11–02:24
总结 / Summary
中文
步骤清单覆盖完整实施顺序：创建双栈 VPC、互联网网关（Internet Gateway, IGW）、公有/私有子网和路由表；启动堡垒与私有实例；通过 SSH 跳转；分别测试 ping -4 与 ping6；创建 EIGW；把私有路由表的 ::/0 指向 EIGW；最后再次验证 IPv6 成功而 IPv4 仍失败。
English
The plan covers the full sequence: create the dual-stack VPC, IGW, public/private subnets, and route tables; launch bastion and private instances; SSH through the bastion; test ping -4 and ping6; create the EIGW; route ::/0 to it; and confirm that IPv6 succeeds while IPv4 still fails.
Transcript
02:11 I have also listed in the slides.
02:13 So you can also refer to these steps.
02:17 So with that now let's go back to this architecture and let me create that in my AWS account.
3. Create the Dual-stack VPC and Internet Gateway
时间范围：02:24–03:14
总结 / Summary
中文
在 Mumbai 区域创建 demo VPC，分配 10.0.0.0/16 IPv4 CIDR，并选择由 AWS 提供 IPv6 CIDR（Amazon-provided IPv6 CIDR）。随后创建普通互联网网关（Internet Gateway, IGW）并附加到该 VPC，为公有 IPv4 路径做准备。
English
In the Mumbai Region, the instructor creates demo VPC with IPv4 CIDR 10.0.0.0/16 and an Amazon-provided IPv6 CIDR. A normal Internet Gateway (IGW) is then created and attached to the VPC to support the public IPv4 path.
Transcript
02:24 Okay.
02:24 As you can see here I'm in my Mumbai region VPC console.
02:28 So let's create a new VPC and let's call it say demo VPC.
02:33 And let's give some IP address range say ten 000 slash 16.
02:39 That is IPv4 range.
02:41 And as you know IPv6 range will be provided by AWS itself.
02:46 So let's take this option here.
02:48 And that's it.
02:50 Rest of the things will be as default.
02:53 So let's create this VPC okay.
02:56 Next thing let's create the internet gateway.
02:59 And let's create a new internet gateway.
03:03 And let's give it a name as demo.
03:06 And let's attach this to the demo VPC.
03:10 So this is a very regular thing that we always do.
03:14 Okay.
03:14 Now let's create the subnet.
4. Create Public and Private Subnets
时间范围：03:14–04:22
总结 / Summary
中文
公有子网使用 10.0.0.0/24，本次练习不需要为它分配 IPv6；私有子网使用 10.0.1.0/24，并从 VPC IPv6 前缀中分配 /64 子网 CIDR。这样堡垒主机只需 IPv4，而私有实例可获得实验所需的 IPv6 地址。
English
The public subnet uses 10.0.0.0/24 and does not need IPv6 for this exercise. The private subnet uses 10.0.1.0/24 plus a /64 IPv6 subnet CIDR derived from the VPC prefix. This lets the bastion use IPv4 while the private instance receives the IPv6 address needed for testing.
Transcript
03:15 So let's first create the public subnet in the demo VPC.
03:19 And let's call it say demo public.
03:25 And so here we only need IPv4 address.
03:29 So let's give it ten 000 slash 24.
03:34 And basically we don't need IPv6 Cidr at least for the public subnet.
03:38 Right.
03:39 So let's create this subnet.
03:41 And now let's also create private subnet.
03:44 So that's again the demo VPC.
03:47 And let's call it demo private.
03:52 And again let's give the cider range 10.0.1.0 24.
03:58 And this time we also want the IPv6 Cidr range for the subnet.
04:04 So this is my VPC Cidr range.
04:06 And the subnet Cidr range should be slash 64.
04:10 So sometime UI doesn't work as expected.
04:12 So you have to just try a couple of times or something like this.
04:17 Okay.
04:18 So that's done.
04:20 And let's create the subnet.
04:22 And the next thing we have to now create the route tables and associate those with subnets.
5. Configure and Associate Route Tables
时间范围：04:22–05:44
总结 / Summary
中文
公有路由表（Public Route Table）添加 0.0.0.0/0 → IGW 并关联公有子网。私有路由表（Private Route Table）最初仅保留 IPv4 与 IPv6 的本地路由（Local Route）并关联私有子网；此时没有 NAT 或 EIGW 默认路由，因此私有实例没有公网出口。
English
The public route table adds 0.0.0.0/0 → IGW and is associated with the public subnet. The private route table initially contains only the IPv4 and IPv6 local routes and is associated with the private subnet. With neither a NAT route nor an EIGW route, the private instance has no Internet egress.
Transcript
04:28 Right.
04:30 Let's filter with the demo.
04:32 Let's go to the route tables.
04:34 Let's create the route table.
04:36 So let's create the public route table.
04:43 And in that let's add the route for internet.
04:50 And this should go through the internet gateway.
04:59 And we have to associate that with the subnet.
05:02 So don't forget this step.
05:06 Similarly let's create another route table for the private subnet.
05:12 Let's call it demo private.
05:19 And here there will be these two default routes which is okay.
05:24 This is what we want.
05:25 And we want to associate that with the private route table subnet.
05:30 Sorry.
05:31 Okay.
05:32 So everything is done.
05:33 And now we have public subnet private subnet.
05:36 So let's go to the EC2 and let's launch those two instances one bastion host and one in the private
05:43 subnet.
6. Launch the Bastion and Private EC2 Instances
时间范围：05:44–07:29
总结 / Summary
中文
堡垒主机（Bastion Host）部署在公有子网，启用自动分配公有 IPv4，并允许 SSH。私有 EC2 部署在私有子网，关闭公有 IPv4、启用 IPv6；其安全组（Security Group）只允许来自 VPC IPv4 CIDR 的 SSH，以便通过堡垒主机访问。
English
The bastion host is launched in the public subnet with an auto-assigned public IPv4 address and SSH access. The private EC2 instance is launched in the private subnet with no public IPv4 but with IPv6 enabled. Its Security Group permits SSH only from the VPC IPv4 CIDR so access can flow through the bastion.
Transcript
05:44 So let's go to the EC2 instances and let's launch the instance.
05:53 Let's call it bastion host.
05:58 Key pair whichever you have.
06:01 And in the settings VPC should be the demo one.
06:06 The subnet should be the public.
06:08 And it should have auto assign public IP which is by default disabled at the subnet level.
06:14 But let's enable that.
06:16 And in the security group we just want SSH.
06:20 So that's from anywhere.
06:22 Or you can also do my IP.
06:25 And that's it.
06:26 Basically let's launch the instance.
06:30 By the time let's also launch the private instance.
06:34 So let's call it EC2 private.
06:44 And again the network settings.
06:47 So let's select our VPC subnet should be private auto assign public IP should be disabled.
06:54 And we want IPv6 address.
06:57 So make sure that you enable this.
07:00 Now security group again we want SSH.
07:03 And this should be from the public subnet.
07:06 So instead of anywhere we can say that it should be vpc Cidr range IPv4.
07:15 So 10.0.0 slash 16.
07:20 That should work.
07:21 Rest of the settings as it is.
07:24 And let's launch the instance.
7. SSH Through the Bastion and Establish the Baseline
时间范围：07:29–09:11
总结 / Summary
中文
讲师使用 PuTTY 登录堡垒主机，把 PEM 密钥复制到主机并设置 chmod 400，再通过私有 IPv4 SSH 到私有 EC2。基线测试中，ping google.com 的 IPv4 路径因没有 NAT 网关而失败，ping6 google.com 也因尚未配置 EIGW 而失败。
English
The instructor uses PuTTY to access the bastion, copies the PEM key, applies chmod 400, and SSHs to the private EC2 instance through its private IPv4 address. At baseline, the IPv4 ping fails because no NAT Gateway exists, and the IPv6 ping also fails because no EIGW route has been configured.
Transcript
07:29 Okay.
07:30 So next we have to login to the bastion host or SSH.
07:34 So let me take its public IP.
07:36 And as I'm using windows I'll use putty to log in over SSH.
07:42 If you are using Mac or Linux then you can also use your terminal to SSH into the bastion host.
07:49 Okay so I'm just putting my public IP for the bastion host.
07:54 Or rather, I should first load my key and let me log in as EC2 user.
08:03 Now from here I have to SSH into the EC2 instance.
08:07 And for that I need to bring the SSH key here.
08:10 So let me do that.
08:17 Okay, so I pasted my PEM file here.
08:20 I need to change the permission to 400.
08:24 And then I have to use this key to login to private EC2 instance.
08:30 And for that I need to get the private IP.
08:34 So let me get the private IP address which is this.
08:39 And let's login.
08:42 Okay so I'm into the EC2 instance and the quick test.
08:46 Let's try to ping to google.com.
08:49 And it shouldn't work because we don't have Nat gateway.
08:53 And also if we do say ping six google.com which uses IPv6 address then also it doesn't go there.
09:01 So that means the traffic is not going.
09:05 So the next step of course is to create egress only internet gateway and then update the route table.
09:11 Let's go back to the VPC.
8. Create the EIGW and Add the IPv6 Default Route
时间范围：09:11–09:58
总结 / Summary
中文
在 VPC 控制台创建 demo egress 仅出站互联网网关（Egress-only Internet Gateway），并将其关联到 demo VPC。随后编辑私有路由表，添加 ::/0 → EIGW。该路由只处理 IPv6 默认流量，不会为 IPv4 提供 NAT。
English
The instructor creates a demo egress Egress-only Internet Gateway in demo VPC, then edits the private route table to add ::/0 → EIGW. This route handles only the IPv6 default path and does not provide NAT for IPv4.
Transcript
09:13 And again let's go here.
09:16 Egress only internet gateway.
09:17 Way.
09:18 Let's create that.
09:20 Let's call it demo egress.
09:23 In the demo VPC and let's create that.
09:28 Okay.
09:29 That being done.
09:30 Now let's go to the route tables and let's go to the private route table routes edit routes and add
09:39 route for IPv6 traffic.
09:43 And it should go through egress only internet gateway which is this one.
09:51 And let's save the changes okay.
09:54 Having done that let's go back to our terminal.
9. Verify IPv6 Egress and IPv4 Isolation
时间范围：09:58–11:07
总结 / Summary
中文
添加 EIGW 路由后，ping6 google.com 成功；显式执行 ping -4 google.com 仍失败，证明 IPv4 没有公网出口。普通 ping 可能默认选择 IPv6 并显示成功，因此验证时必须用 -4 强制 IPv4，避免误判。
English
After adding the EIGW route, ping6 google.com succeeds while an explicit ping -4 google.com still fails, proving that IPv4 has no egress path. A plain ping may select IPv6 by default and appear successful, so forcing IPv4 with -4 is important for an accurate test.
Transcript
09:58 And now let's try to ping six google.com.
10:04 And you can see that it is working.
10:07 Now one other thing we should do is let's see if there is ping for command which specifically uses the
10:13 IPv4 address.
10:14 So it is not there.
10:16 But I think we can use the flag which says it is IPv4 address.
10:21 And for that I think we have to use minus four as a flag.
10:26 Yeah.
10:27 And you can see that it is trying to go to this public IPv4 address of google.com.
10:32 And it doesn't work.
10:33 So which means what we expected is working.
10:36 Now in your case if you just do ping, it is possible that it is using IPv6 address by default.
10:42 And you can very well see that here.
10:45 And it will work in that case.
10:46 So please remember to use minus four flag to test IPv4 connectivity.
10:52 Right.
10:52 So that was the exercise.
10:54 Now just last thing terminate everything that you created.
10:57 Because there are two EC2 instances which are running.
11:00 And there will be cost for that if you are out of your free tier quota.
11:04 And I am also going to do that now.
10. Clean Up the Lab Resources
时间范围：11:07–11:23
总结 / Summary
中文
练习结束后应终止不再使用的 EC2 实例，并清理相关实验资源，避免超出免费套餐（Free Tier）额度后产生持续费用。
English
After the exercise, terminate the EC2 instances and remove unneeded lab resources to avoid continuing charges, especially when the account is beyond its Free Tier allowance.
Transcript
11:07 So make sure that you select all your EC2 instances which you don't need and you terminate that.
11:14 Right.
11:14 So that's it for this exercise.
11:15 I hope you could also do that.
11:18 And if so, I'll see you in the next lecture.
11:21 Thank you.
整讲总结 / Overall Summary
中文
本讲完整验证了 IPv6 私有出站模式：双栈私有实例在只有本地路由时无法访问互联网；创建仅出站互联网网关（EIGW）并配置 ::/0 后，IPv6 出站成功，而没有 NAT 网关的 IPv4 仍失败。实验同时强化了双栈 CIDR、子网/路由表关联、堡垒主机访问、安全组范围和协议专用连通性测试等操作要点。
English
This lab validates the private IPv6 egress pattern end to end. A dual-stack private instance cannot reach the Internet with local routes alone. After creating an EIGW and adding ::/0, IPv6 egress works while IPv4 still fails without a NAT Gateway. The exercise also reinforces dual-stack CIDRs, subnet and route-table associations, bastion access, Security Group scope, and protocol-specific connectivity testing.