Lecture 258: AWS Private NAT Gateway
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：12:57
- 来源：Udemy Lecture 33790046
- Slide 数量：8
- 画面切换：00:46、02:43、04:05、05:13、07:57、09:45、11:46
扫描说明
逐条读取了 Transcript 面板中的 290 条英文 cue，并按播放器进度同步全长约 12:57 的视频。依据 Public vs Private NAT、Overlapping CIDR、Alternative Solution、Routable/Non-routable Address、Secondary CIDR/TGW、Private NAT Route、ALB Packet Flow 与 Reverse Initiation 划分为 8 个小节。8 张截图来自真实课程 Slide，统一为 1364×770。讲义纠正了录制时关于 IPv6 的过时表述：IPv6 地址空间巨大，但并非所有 IPv6 都必须 Internet-routable；AWS 现在支持私有 IPv6 规划能力，实际可用范围应核对当前 VPC/IPAM 文档。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Private NAT Gateway 做 Private-to-Private SNAT，不分配 EIP，也不提供 Internet Egress
时间范围：00:00–00:46
总结 / Summary
中文
Public NAT Gateway 主要让 Private Subnet Workload 以 EIP 访问 Internet；Private NAT Gateway 不关联 Elastic IP，只把 Source Private IP 转换成 NAT Gateway 在其 Subnet 中的 Private IP，用于到其他 VPC、Transit Gateway、VPN/Direct Connect 或 On-premises 的私网通信。若把 Private NAT Gateway 的流量送到 Internet Gateway，IGW 会丢弃。因此考试看到“重叠私网、需要 Managed SNAT、禁止 Internet”应选 Private NAT Gateway，而不是 Public NAT Gateway。
English
A public NAT gateway primarily lets private-subnet workloads reach the internet through an Elastic IP. A private NAT gateway has no Elastic IP and translates a source private address to the gateway's private address in its subnet for private connectivity to other VPCs, Transit Gateway, VPN or Direct Connect, or on-premises networks. An internet gateway drops traffic originating from a private NAT gateway. When an exam describes overlapping private networks, managed source NAT, and no internet access, choose a private NAT gateway rather than a public one.
Transcript
00:00 Hello, and welcome to this lecture,
00:02 Private NAT Gateway.
00:03 Now, I'm sure you've heard about NAT gateway,
00:06 and it is used for giving the internet access
00:09 to the EC2 machines
00:11 which are launched in a private subnet.
00:13 And you very well know how NAT gateways work,
00:16 but this is a private NAT gateway.
00:18 And you must be wondering why this was introduced by AWS.
00:23 Now, there is a special purpose
00:24 why private NAT gateways were launched.
00:26 And from the name, as you can case,
00:29 it does not provide the internet access to the resources,
00:32 but then it still does the NAT-ing,
00:35 network address translation,
00:36 but it translates one private IP
00:39 to some other or its own private IP.
00:42 Now, what are the situation in which you will require that?
00:44 So let's try to understand that first.
2. RFC1918 复用与并购/业务单元自治导致 Overlapping CIDR 无法直接路由
时间范围：00:46–02:43
总结 / Summary
中文
RFC1918 包含 10.0.0.0/8、172.16.0.0/12 与 192.168.0.0/16。不同 Business Unit、Partner、Acquisition、On-premises Site 或 VPC 独立规划时，很容易重复使用相同 Prefix；Microservice、Container 与 ENI 又加快地址消耗。若 VPC A 与 VPC B 都有 100.64.0.0/16，目的地址 100.64.0.11 会被各自 Local Route 匹配，单纯增加 Peering、VPN 或 TGW Attachment 不能消除 Ambiguity。必须引入不重叠的 Rendezvous/Translated Address 或 Service Abstraction。
English
RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Independent business units, partners, acquisitions, on-premises sites, and VPCs often reuse the same prefixes, while microservices, containers, and ENIs accelerate address consumption. If VPC A and VPC B both use 100.64.0.0/16, a destination such as 100.64.0.11 matches each VPC's local route. Adding peering, VPN, or a transit-gateway attachment alone cannot remove the ambiguity; the design needs non-overlapping rendezvous or translated addresses, or a service abstraction.
Transcript
00:46 So first of all,
00:48 what's the problem with the private IPs?
00:50 Now, you know that there is very well defined RFC1918 ranges
00:55 which every company would use
00:57 and allocate to their private networks.
01:00 And there are different ranges
01:01 like 192.168, 172, 10.0.0.0/8.
01:07 All these ranges are standard ranges.
01:09 So in every organization,
01:11 whether it's in a cloud or it's on-premise network,
01:15 it will use this private IP address ranges
01:18 for all their servers.
01:20 Now, whenever they want
01:21 to expose their servers to the internet,
01:23 then comes the public IP in the picture,
01:26 but otherwise,
01:27 all these servers would have the private IPs.
01:30 That means, in most of the cases, these private IPs
01:34 needs to be allocated again and again to different networks,
01:38 even if they plan it well in advance,
01:41 over the time as company grew,
01:43 it's not possible that these private IPs are unique
01:46 across all your organization and organization units,
01:50 because they work independently, right?
01:53 So often it is required
01:54 that different business units which you have,
01:57 they should be able to also communicate with each other.
02:01 And also with microservices coming into life,
02:04 more and more applications are microservices based.
02:07 Every microservice service
02:09 would have its own private IP address.
02:11 And that means more and more private IPs are required.
02:15 So what does it cost?
02:16 Basically, if there are multiple business units
02:19 and a lot of private IPs are used,
02:21 then there is a problem connecting these networks.
02:25 And the primary reason
02:26 is they have the overlapping CIDR addresses.
02:29 So if one company has two business units
02:33 and both business units are using, say, 192.168 range,
02:37 it is difficult to connect this network
02:39 because IP addresses are same at both end.
3. PrivateLink、IPv6、Renumbering 与 Self-managed NAT 是不同 Trade-off
时间范围：02:43–04:05
总结 / Summary
中文
AWS PrivateLink 用 Consumer VPC 中的 Endpoint ENI 暴露特定 Service，天然绕开 Producer CIDR，可用于 Service-to-consumer 而非任意双向 Network Routing。Renumbering/IPAM 从根源消除 Overlap，但迁移成本高；Self-managed NAT/Firewall 支持更灵活的 Static/Dynamic Translation，却带来 HA、Scaling 与 Operations 负担。IPv6 地址空间巨大，能降低重叠概率；课程说“IPv6 全部 Public、没有 Private IPv6”已经过时，AWS 现在支持不对 Internet Advertise 的 Private IPv6/ULA 规划能力，需查当前 Region/Service 支持。
English
AWS PrivateLink exposes a specific service through endpoint ENIs in the consumer VPC and naturally hides the producer CIDR; it provides service-to-consumer access rather than arbitrary bidirectional network routing. Renumbering with IPAM removes overlap at the source but can be costly. Self-managed NAT or firewalls support more flexible static and dynamic translation but add high-availability, scaling, and operational burdens. IPv6 greatly reduces overlap risk. The lecture's statement that all IPv6 is public and no private IPv6 exists is outdated; AWS now supports private or non-internet-advertised IPv6 planning, including ULA capabilities, subject to current regional and service support.
Transcript
02:43 Now, what is the solution for this?
02:45 Now, in the cloud world,
02:46 we have seen that you could very well use AWS PrivateLink
02:50 because then you are really accessing the services
02:54 from other VPC through the VPC endpoint ENI,
02:58 which is provisioned into your VPC,
03:00 and you don't really need
03:01 to know the IP addresses on that side.
03:04 So that's one solution,
03:05 but, again, it primarily works in AWS.
03:08 And you could also make it work in a hybrid world,
03:11 but then it's purely AWS construct.
03:14 And it is not feasible in all the cases.
03:18 Then you could also use IPv6 addresses,
03:20 you know IPv6 addresses are 128 bit in length.
03:24 So you would have plenty of addresses to allocate
03:27 but then IPv6 addresses are globally public.
03:32 That means you can't have private IPv6 addresses.
03:35 Now, again, you are wasting a lot of addresses
03:37 if you're locating these addresses to your internal network.
03:41 And then another solution
03:42 is you have your self-managed NAT-ing appliances
03:45 and you do, you know, static kind of NAT
03:48 every time you go from one network to another network.
03:52 But then for this,
03:53 you'd have to manage your own appliances
03:55 and additional operational overhead is there.
03:58 So, to solve this problem
04:00 where you connect two private networks,
04:03 which has overlapping CIDRs,
4. Private NAT 只做 Source NAT；远端仍需一个可路由、非重叠的 Destination
时间范围：04:05–05:13
总结 / Summary
中文
Private NAT Gateway 是 Managed Stateful Source NAT。它把 Initiator 的原始 Source IP 改为 NAT Gateway Private IP，并维护 Return Mapping；它不会自动把一个重叠 Destination IP 转成另一个地址。因此架构通常分为 Non-routable Workload CIDR 与 Non-overlapping Routable CIDR：NAT Gateway 位于本端 Routable Subnet，远端通过 ALB/NLB、Proxy、Service Endpoint 或其他 Front Door 在远端 Routable CIDR 暴露服务。题目若要求任意 Host-to-host 双向地址映射，Private NAT Gateway 单独并不够。
English
A private NAT gateway is managed, stateful source NAT. It replaces the initiator's source address with the gateway's private address and maintains return mappings; it does not automatically translate an overlapping destination into another address. Designs therefore separate non-routable workload CIDRs from non-overlapping routable CIDRs. The NAT gateway sits in a local routable subnet, while the remote side exposes the service through an ALB, NLB, proxy, service endpoint, or another front door in its routable CIDR. If a scenario requires arbitrary bidirectional host-to-host address mapping, a private NAT gateway alone is insufficient.
Transcript
04:05 you can use private NAT gateway.
04:07 Now what it does, it allows communication between the VPCs
04:12 or VPC and on-premise network having the overlapping CIDRs.
04:17 Now, networks which are in AWS
04:20 should be connected to on-premise network
04:22 using the virtual private gateways or transit gateways.
04:26 And as I said,
04:28 private NAT performs the private IP address translation.
04:31 This is not private to public
04:33 but this is private to private.
04:35 So we are not going to internet,
04:37 but we are just going to another network
04:39 which is connected to your primary network.
04:42 So for deploying private NAT,
04:44 you would often need to divide your address space
04:47 in routable and non-routable address space,
04:49 know what that means.
04:50 If both side of the network has the same CIDR
04:54 or overlapping CIDR,
04:56 they are called non-routable CIDR,
04:58 because you can't go from one network to another,
05:00 because if you're trying to reach some machine
05:02 which is available into your own network,
05:05 it will be routed there itself, right?
05:08 Now in order to make this connectivity,
05:10 you need additional routable CIDRs.
5. 为两端增加不重叠 Secondary CIDR，并用 Transit Gateway 只传输 Routable Prefix
时间范围：05:13–07:57
总结 / Summary
中文
示例中两端 Workload 都在重叠的 100.64.0.0/16；VPC A 增加 10.0.1.0/24，VPC B 增加 10.0.2.0/24 作为 Secondary CIDR/Routable Subnet。Transit Gateway Attachment ENI 放在这些 Routable Subnet，TGW Route Table 只学习/指向 10.0.1.0/24 与 10.0.2.0/24，而不是冲突的 100.64.0.0/16。这里的关键不是“TGW 能路由重叠网段”，而是通过新的唯一 Prefix 建立无歧义 Transport Plane。每个 VPC/TGW Route Table 都必须有对称 Return Route。
English
Both workload sides in the example use overlapping 100.64.0.0/16 space. VPC A adds 10.0.1.0/24 and VPC B adds 10.0.2.0/24 as secondary CIDRs and routable subnets. Transit Gateway attachment ENIs reside in those routable subnets, and the TGW route table learns or points only to 10.0.1.0/24 and 10.0.2.0/24, not the conflicting 100.64.0.0/16. The point is not that Transit Gateway routes overlapping prefixes; the new unique prefixes create an unambiguous transport plane. VPC and TGW route tables also need symmetric return routes.
Transcript
05:13 And what I mean, I'll just explain by this diagram.
05:17 So let's take an example.
05:18 You have two VPCs
05:20 and both are having the same IP address range,
05:23 100.64 and 100.64.
05:26 And then you have private subnets
05:28 with the CIDR range prefix of 24, here and here.
05:32 And now instance A
05:34 wants to communicate with instance B.
05:37 Clearly, this IP addresses are overlapping
05:40 and then these are non-routable.
05:42 And this is business unit one,
05:43 and this is business unit two.
05:45 Now, how do you solve this problem?
05:47 Even if you connect these two VPCs
05:49 over a VPC peering connection
05:52 or VPN whatever mechanism,
05:55 but still, A cannot go to the B
05:57 because IP address is a local IP address from A.
06:01 Now, if you look at the route tables for this,
06:03 then you would understand that.
06:05 Now in order to solve that problem,
06:07 you'd have to bring another CIDR range to your VPC
06:10 and you know that you can extend your VPC CIDRs.
06:13 You can add secondary CIDRs.
06:15 If you go back to some sections, we have covered this topic.
06:20 So here, now we are adding one more CIDR to our VPC
06:23 with routable IP address range.
06:26 So, which are not overlapping that means.
06:29 So 10.0.1.0/24 here,
06:32 and 10.0.2.0/24 here.
06:35 That means you can go
06:37 from this address range to this address range
06:39 because they are not overlapping.
06:41 So this is one essential step
06:44 where you bring additional VPC CIDR,
06:46 which are non overlapping.
06:49 And now if you look at the route tables
06:50 for this private subnet,
06:52 you just have two local routes,
06:54 one for this VPC CIDR
06:55 and this is for secondary VPC CIDR.
06:58 And then for this subnet,
07:00 you again have the same route table.
07:03 Similarly for another VPC.
07:06 Now, if you have this architecture,
07:08 you first need to connect these two VPCs together.
07:12 Now, how do you connect that?
07:14 You could do that using VPN
07:16 or better ways, using the transit gateway.
07:20 So now you create transit gateway
07:22 and you know that transit gateway
07:23 creates transit gateway ENIs into the subnet.
07:26 And now these subnets
07:27 will be your routable subnet with secondary CIDRs.
07:32 So there are two ENIs now.
07:34 Okay, so far, so good.
07:36 And then you would have the attachment route tables
07:40 and we would have just common route table
07:43 for both the attachment,
07:44 which says how to go to VPC A
07:47 and how to go to VPC B,
07:49 and that is through corresponding VPC attachment.
07:52 So there is no special thing about this route table.
07:56 Okay.
6. Workload Route 指向 Private NAT；NAT Subnet Route 再指向 TGW
时间范围：07:57–09:45
总结 / Summary
中文
VPC A 的 100.64 Workload Subnet 对远端 Front Door Prefix 10.0.2.0/24 设置 Next Hop=Private NAT Gateway；Private NAT 位于 10.0.1.0/24，将 Source 100.64.0.10 转成自己的 10.0.1.x，然后 NAT Subnet Route 把 10.0.2.0/24 送往 TGW Attachment。VPC B 的 Routable Subnet 与 TGW 必须知道 10.0.1.0/24 的 Return Path。不要把远端重叠 100.64 Prefix 直接写成跨 VPC Route，因为 Local Route 更具体/同样匹配且语义不唯一。NAT Gateway 是 AZ-scoped，应按 AZ 部署并路由，避免 Cross-AZ Cost 与单点。
English
VPC A's 100.64 workload subnet routes the remote front-door prefix 10.0.2.0/24 to the private NAT gateway. The gateway in 10.0.1.0/24 translates source 100.64.0.10 to its own 10.0.1.x address, and the NAT-subnet route sends 10.0.2.0/24 to the transit-gateway attachment. VPC B's routable subnet and the TGW need a return path for 10.0.1.0/24. Do not attempt to route the remote overlapping 100.64 prefix directly across VPCs because the local route and address meaning are ambiguous. NAT gateways are AZ-scoped, so deploy and route per AZ to avoid cross-AZ cost and a single failure point.
Transcript
07:57 Now still, can you reach to this VPC?
08:00 No, you can't,
08:01 because instance A wants to talk to instance B,
08:05 but then IP address of these instances are overlapping.
08:09 So now what you do is you introduce private NAT gateway,
08:12 which is, again,
08:13 sitting either in the same route table as TGW ENI
08:16 or you could have a separate subnet.
08:18 But for simplicity,
08:20 they're just showing both in the same subnet.
08:23 And additionally, what you would have to do is,
08:25 you have to modify the route table for your subnet A,
08:30 which is your non-routable subnet,
08:32 and say if the traffic is going to 10.0.2.0/24,
08:36 which is this subnet,
08:38 it has to go through the NAT gateway.
08:40 Now, we haven't really added the entry for 10.64,
08:45 where exactly the B is running,
08:47 because we can't directly reach to the B.
08:50 We first have to reach to this subnet on the right side,
08:54 and then from there,
08:54 we should be able to reach to instance B.
08:57 So what we are saying is,
08:59 if traffic is going from A to 10.0.2.0/24,
09:03 it has to go through the private NAT gateway.
09:06 Now, as soon as NAT gateway gets the traffic from A,
09:10 it would then do the network address translation.
09:14 And we'll see how.
09:15 Now, for this subnet, we have added a route table
09:18 which says if the traffic is going to 10.0.2.0/24,
09:22 then it has to go through transit gateway attachment
09:24 which is obvious.
09:26 Similarly, on this side, if traffic is going to 10.0.1.0,
09:31 then it has to go through the transit gateway.
09:33 And for this subnet just the local entries.
09:37 So far, so good.
09:38 That means from here,
09:40 we can reach up to at least this subnet,
09:43 though not the instance B.
7. 远端 ALB/NLB 用 Routable Address 接流量，再转发到重叠 Workload Target
时间范围：09:45–11:46
总结 / Summary
中文
VPC B 在 10.0.2.0/24 Routable Subnet 放置 Internal ALB（或符合场景的 NLB/Proxy），其 Target 可以是 B 侧 100.64 Workload。A 访问 ALB DNS，解析到 10.0.2.x；Packet 经 Private NAT SNAT 为 10.0.1.x，再经 TGW 到 ALB，ALB 新建到 Target 的连接。Return Traffic 先回 ALB，再沿 TGW 回 NAT，由 NAT State 恢复原 Source/Destination。ALB 是应用层 Proxy，不保留原 Client IP 作为 L3 Source；如后端需要 Client Identity，应使用 X-Forwarded-For 或选择适合的 L4 Pattern。
English
VPC B places an internal ALB, or an appropriate NLB or proxy, in the routable 10.0.2.0/24 subnet, with targets in B's overlapping 100.64 workload space. A resolves the load balancer DNS name to 10.0.2.x. The packet is source-NATed to 10.0.1.x, crosses the transit gateway, and reaches the load balancer, which opens a new connection to the target. Return traffic goes back through the load balancer and TGW to the NAT gateway, whose state restores the original flow. An ALB is an application-layer proxy and does not preserve the original client address as the L3 source; use X-Forwarded-For or an appropriate L4 pattern when backend client identity matters.
Transcript
09:45 So what's the solution?
09:46 If traffic is coming in this subnet,
09:48 it should automatically go to the B.
09:50 Maybe you have guessed already?
09:52 For this, we need ALB, application load balancer.
09:57 Now, if you look at this architecture,
09:59 we have assumed that instance A
10:01 has the IP address 100.64.0.10
10:05 and instance B has 100.64.0.11.
10:09 Just an example, it could be 10 as well.
10:12 Doesn't really change anything here.
10:15 But now if instance A tries to go to instance B,
10:18 it can't directly go,
10:20 it has to make an API call
10:22 or network connection to ALB.
10:25 Now, ALB has some address
10:26 out of this private IP address range, 10.0.2.0.
10:30 So it would have some IP address, right?
10:32 So instance A invokes an ALB, DNS rather,
10:36 DNS will be resolved to some IP address,
10:38 let's assume the IP address of ALB as 10.0.2.10, here.
10:43 Now, if you trace down this packet,
10:45 so A will look at the route table,
10:48 it has to go to 10.0.2.10.
10:50 So it has to go through the NAT gateway.
10:53 The traffic will go to the NAT gateway.
10:55 NAT will perform the network address translation.
10:57 So source IP was a 100.64.0.10, which is address of A.
11:02 It will just replace it with its own IP address.
11:05 Now the NAT's own IP,
11:06 private IP address is 10.0.1.15, just an assumption.
11:11 And then with this route table,
11:13 it has to go to 10.0.2.0.
11:15 That is a destination address.
11:17 So it has to go through transit gateway ENI.
11:20 It will go to the transit gateway ENI
11:22 and the transit gateway ENI has a local route
11:26 which says if traffic is 10.0.2.0.
11:28 It has to be routed through the local router.
11:31 It will send it through ALB.
11:33 And ALB has instance B registered as a target.
11:37 So ultimately it will reach instance B.
11:40 Now this is how entire flow works
11:43 in case of private NAT gateway.
8. Stateful Return 可行，但反向独立 Initiation 需要镜像 NAT 与 Front Door
时间范围：11:46–12:57
总结 / Summary
中文
Private NAT Gateway 允许 A 发起连接后的 Return Traffic，因为存在 NAT State；这不等于 B 能主动连接 A 的重叠地址。若两端都必须独立发起，需在 B 侧建立 Private NAT/Routable Prefix，并在 A 侧提供可达 Front Door，配置镜像的 VPC/TGW/Return Routes。于是每个 Initiation Direction 都有自己的 SNAT 与 Destination Abstraction。对于大量任意双向 Session，这种架构复杂且成本高，应比较 Renumbering、IPv6、PrivateLink、Proxy/Firewall NAT 或 Application-level Integration。
English
A private NAT gateway permits return traffic for a connection initiated by A because NAT state exists; this does not mean B can independently initiate to A's overlapping address. If both sides must initiate, build a private NAT gateway and routable prefix on B and expose a reachable front door on A, with mirrored VPC, TGW, and return routes. Each initiation direction then has its own source NAT and destination abstraction. For many arbitrary bidirectional sessions, this becomes complex and costly, so compare renumbering, IPv6, PrivateLink, proxy or firewall NAT, and application-level integration.
Transcript
11:46 But another question is, does it also allows you
11:49 to have instance B talk to instance A?
11:53 So, the answer is no.
11:55 This is one way traffic as of now.
11:57 That means you get the written traffic
11:59 but A should initiate that traffic.
12:02 If B initiates that traffic, it doesn't happen,
12:05 because there is no ALB here which distribute traffic to A.
12:10 And in that case, you'd have to do exactly opposite.
12:13 So you would have to just create a NAT gateway in VPC B,
12:16 in this private subnet, and ALB in VPC A.
12:20 So if you need both direction connectivity,
12:23 that means anyone can originate the traffic,
12:26 then you would need two NAT gateways in both the VPCs
12:30 and then two ALBs in both the VPC.
12:33 And ultimately, this is how the end to end flow works.
12:37 So I know that this is little complicated,
12:39 but if you just go through this again probably
12:42 and just try to understand what's happening,
12:45 this makes sense.
12:46 And this is how the problem of overlapping private CIDR
12:50 is solved using the private NAT gateways.
12:53 Hope that is clear,
12:54 and you enjoyed the lecture,
12:55 and thanks for watching.
整讲总结 / Overall Summary
中文
Private NAT Gateway 的考试主线是 Private-to-Private Stateful SNAT、无 EIP/无 Internet、重叠 Workload CIDR 与唯一 Routable Secondary CIDR 分离、TGW 只传输不重叠 Prefix、远端 Front Door 提供可路由 Destination，以及 Initiation Direction。它只翻译 Source，不是通用双向 Static NAT；反向独立发起需要镜像架构。
English
Private NAT Gateway exam priorities are private-to-private stateful source NAT, no Elastic IP or internet access, separation of overlapping workload CIDRs from unique routable secondary CIDRs, transit of only non-overlapping prefixes through TGW, a remote front door as the routable destination, and connection-initiation direction. It translates the source and is not general bidirectional static NAT; independent reverse initiation requires a mirrored design.
返回顶部 ↑