NAT and internet gateways

Four components move traffic between a VPC and the world outside it. Choosing between them comes down to whether traffic is IPv4 or IPv6, and whether the resources need to be reachable from outside or only to reach out.

Internet gateway

The connection point between a VPC and the internet.

Horizontally scaled, redundant and highly available; it is not a bottleneck and there is nothing to size.
Supports IPv4 and IPv6.
A subnet whose route table has a route to an internet gateway is by definition a public subnet.
Two jobs: it is the route table target for internet-bound traffic, and it performs network address translation for instances that have a public IPv4 address.

The limitation. An internet gateway performs NAT only for instances that have a public address of their own. An instance with a private address alone cannot reach the internet through it, which is what NAT gateways exist for.

A VPC can have at most one internet gateway attached, and an internet gateway attaches to at most one VPC.

Egress-only internet gateway

The IPv6 equivalent of a NAT gateway.

IPv6 addresses are globally unique and publicly routable by default, so there is no address translation to perform — the problem is inbound reachability, not addressing.
An egress-only internet gateway allows outbound IPv6 traffic and the responses to it, and blocks connections initiated from outside.
Stateful, like a NAT gateway.
Needs a ::/0 route in the subnet’s route table pointing at it.

Use it for IPv6 what you would use a NAT gateway for with IPv4.

NAT gateway

A managed service that translates traffic from private instances to a single public address, and refuses connections initiated from outside. It comes in two availability modes: a zonal gateway lives in one Availability Zone and is deployed one per zone, while a regional gateway spans zones automatically and needs no public subnet — see NAT gateway.

Connectivity types

Public — instances in private subnets reach the internet through it. Created in a public subnet, and you must associate an Elastic IP address with it at creation. Traffic is then routed from the NAT gateway to the internet gateway.
Private — instances reach other VPCs or an on-premises network through it, via a transit gateway or virtual private gateway, but not the internet. No Elastic IP is associated. A private NAT gateway is what you use when overlapping address space or a compliance rule means on-premises should see one source address rather than the whole subnet range.

Properties

Redundant within its Availability Zone, but not across zones. A NAT gateway in a failed zone takes down internet access for every subnet routed to it.
Supports 5 Gbps of bandwidth and scales automatically to 100 Gbps.
Handles one million packets per second, scaling to ten million.
Supports TCP, UDP and ICMP. It performs NAT64 for IPv6 traffic reaching IPv4 destinations, in combination with DNS64.
No security group. Control traffic with security groups on the instances behind it and with a network ACL on its subnet.
Each associated IPv4 address supports up to 55,000 simultaneous connections to a single destination IP, port and protocol; add secondary addresses if a workload exceeds that against one destination.

Multi-Availability-Zone deployment

Create a NAT gateway in each Availability Zone and point each zone’s private subnets at the gateway in their own zone. This removes the cross-zone dependency and avoids cross-zone data transfer charges on every outbound byte.

NAT instance

An EC2 instance configured to perform NAT. The predecessor to the NAT gateway.

Must sit in a public subnet with a route to an internet gateway, and needs a public or Elastic IP address.
Requires source/destination checking to be disabled on its network interface.
Bandwidth is whatever the instance type provides.
Not supported for IPv6.
Failover between instances is a script you write.

It does two things a NAT gateway cannot: it can act as a bastion host, and it can do port forwarding. Where those are needed, purpose-built alternatives — Systems Manager Session Manager for access, a load balancer for inbound traffic — are usually a better answer than reviving a NAT instance.

NAT gateway or NAT instance

	NAT gateway	NAT instance
Availability	Redundant within its Availability Zone	You script the failover
Bandwidth	5 Gbps, scaling to 100 Gbps	Whatever the instance type gives
Maintenance	None	Patching and updates are yours
Performance	Software optimised for NAT	A general-purpose AMI
Public IP	Elastic IP chosen at creation, not detachable afterwards	Elastic IP or public IP, changeable at any time
Security groups	Not supported	Supported
Port forwarding	Not supported	Possible, by hand
Bastion host	Not supported	Possible
Timeout behaviour	Sends RST when a connection times out	Sends FIN

AWS recommends the NAT gateway, and for production that recommendation is straightforward: better availability, more bandwidth, nothing to patch.

Practice

Use a NAT gateway rather than a NAT instance for anything in production.
Deploy one per Availability Zone and route each zone to its own.
Use an egress-only internet gateway for IPv6 rather than trying to NAT it.
Add explicit routes for VPC peering, VPN and Direct Connect destinations — they should not go through the NAT gateway.
Watch the cost. A NAT gateway charges per hour and per gigabyte processed, and it is one of the commonest surprises on an AWS bill. See NAT gateway for how to reduce it.