NAT gateway vs internet gateway: what does each one do?

A brand-new VPC is sealed off: nothing inside it can reach the internet, and nothing on the internet can reach it. Two components open it up, in different ways: the internet gateway and the NAT gateway. Their names sound alike and they often appear in the same diagram, but they answer different questions:

• An internet gateway is the VPC’s front door. Traffic can go out and come in, for resources with a public IP address.
• A NAT gateway is a one-way exit for private resources. They can start connections out to the internet, but nobody on the internet can start a connection in.

Public and private subnets

The difference starts with what makes a subnet “public”. It’s not a setting on the subnet; it’s its route table:

• A public subnet has a route sending internet traffic (0.0.0.0/0) to an internet gateway.
• A private subnet has no such route. If it needs outbound internet access, its 0.0.0.0/0 route points to a NAT gateway instead.

So the typical layout is a web tier or load balancer in public subnets, and application servers and databases in private subnets.

Internet gateway: the front door

An internet gateway attaches to a VPC (one per VPC) and connects it to the internet in both directions.

• Two-way. Instances with a public IPv4 address (or an Elastic IP) can reach the internet, and the internet can reach them, as far as their security groups and network ACLs allow.
• It does the address translation for you, one-to-one: the instance only knows its private address, and the internet gateway maps it to its public one.
• Highly available and scaled by AWS. There’s nothing to size, and no bandwidth limit to plan for.
• Works for IPv4 and IPv6.
• No hourly charge for the gateway itself; you pay for data transfer and for public IPv4 addresses.

An instance in a public subnet without a public IP address still can’t use the internet gateway. Both pieces are needed: the route and the public address.

NAT gateway: a one-way exit for private subnets

A NAT gateway lets instances in a private subnet reach out to the internet, to download patches or call an external API, while staying unreachable from it.

• It lives in a public subnet and has an Elastic IP address. The private subnet’s route table sends 0.0.0.0/0 to it.
• Outbound only. Replies to connections your instances started come back; new connections from the internet are refused.
• It still needs the internet gateway. The NAT gateway forwards traffic out through the VPC’s internet gateway. It replaces the instances’ need for public addresses, not the internet gateway.
• Many to one. All the instances behind it share its single public address.
• Managed by AWS, scaling automatically, but it lives in one Availability Zone.
• Costs money: an hourly charge plus a charge for every GB it processes.

There’s also a private NAT gateway (no Elastic IP) for reaching other VPCs or your on-premises network through a transit gateway or VPN. It can’t reach the internet.

One per Availability Zone

Because a NAT gateway lives in one Availability Zone, an architecture with a single NAT gateway has a weak spot: if that zone fails, private subnets in the other zones lose internet access too. For resilience, put a NAT gateway in each Availability Zone and point each zone’s private subnets at their own one. It also avoids paying for traffic between zones.

Cutting the NAT gateway bill

Every GB through a NAT gateway is charged, including traffic to AWS services. Private instances reading from Amazon S3 or DynamoDB can skip the NAT gateway entirely with a gateway VPC endpoint, which has no charge. It’s one of the quickest wins in a VPC with heavy S3 traffic.

Side by side

What about IPv6?

IPv6 addresses are public by design, so there’s no NAT. For outbound-only IPv6, use an egress-only internet gateway: it lets instances start IPv6 connections out and blocks connections from the internet, like a NAT gateway does for IPv4.

Exam traps

• “Instances in a private subnet need to download updates, but must not be reachable from the internet.” NAT gateway in a public subnet, with a route from the private subnet to it.
• “The NAT gateway is in place but private instances still can’t reach the internet.” Check that the NAT gateway is in a public subnet, that subnet routes to an internet gateway, and the private subnet’s route table points to the NAT gateway.
• “Make outbound internet access highly available.” One NAT gateway per Availability Zone.
• “Reduce NAT gateway data processing charges for S3 traffic.” Gateway VPC endpoint for S3.
• “Outbound-only internet access for IPv6.” Egress-only internet gateway, not a NAT gateway.
• “An instance in a public subnet can’t be reached from the internet.” Check that it has a public IP or Elastic IP, then its security group and network ACL.
• “Lowest operational overhead.” A NAT gateway (managed) rather than a NAT instance, an EC2 instance you’d patch, size and make highly available yourself.

For the full details, see the Amazon VPC User Guide on internet gateways, NAT gateways, NAT gateway scenarios, egress-only internet gateways and gateway endpoints for Amazon S3.