Lesson 06 — Internet Gateway & NAT Gateway

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 04 – Amazon VPC & Network Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand Internet Gateways (IGW).
Understand NAT Gateways.
Differentiate inbound and outbound Internet traffic.
Configure Internet connectivity.
Build Internet Gateway and NAT Gateway using AWS Console.
Configure routing using Route Tables.
Verify Internet connectivity.
Apply enterprise networking best practices.

📚 Lesson Information

Estimated Time: 120 Minutes

Difficulty: Beginner

Prerequisites: Lesson 05 – Route Tables

Hands-on Lab: Yes

💼 Business Value

Every enterprise application has different Internet connectivity requirements.

For example:

Resource	Internet Required?
Public Website	✅ Yes
Application Server	✅ Outbound Only
Database	❌ No
Bastion Host	✅ Yes
Internal API	❌ No

Instead of exposing every server to the Internet, AWS provides two networking components:

Internet Gateway (IGW)
NAT Gateway

These services allow organisations to securely control inbound and outbound Internet traffic.

🏢 CloudNova Scenario

CloudNova has deployed:

Public Load Balancer
Application Servers
Database Servers

Requirements:

Customers must access the website.
Application servers must download software updates.
Databases must never communicate directly with the Internet.

The Cloud Security Team decides to use:

Internet Gateway
NAT Gateway

🌍 What is an Internet Gateway?

An Internet Gateway (IGW) is a highly available AWS-managed component that enables communication between your VPC and the Internet.

It allows:

Incoming Internet traffic
Outgoing Internet traffic

An Internet Gateway is attached to a VPC.

Without an Internet Gateway, resources inside the VPC cannot communicate directly with the Internet.

🌍 Internet Gateway Architecture

Internet

↓

Internet Gateway

↓

Public Route Table

↓

Public Subnet

↓

Application Load Balancer

↓

EC2

Only resources in Public Subnets can use the Internet Gateway.

🌍 What is a NAT Gateway?

A NAT (Network Address Translation) Gateway allows resources in Private Subnets to initiate outbound Internet connections while preventing inbound Internet access.

Typical uses include:

Operating system updates
Installing software packages
Downloading application dependencies
Accessing AWS APIs
Connecting to external services

Users on the Internet cannot initiate connections to instances behind a NAT Gateway.

NAT Gateway Architecture

Private EC2

↓

Private Route Table

↓

NAT Gateway

↓

Internet Gateway

↓

Internet

Notice:

Internet traffic always passes through the Internet Gateway because the NAT Gateway itself resides in a Public Subnet.

Internet Gateway vs NAT Gateway

Internet Gateway	NAT Gateway
Public Internet access	Private outbound access
Supports inbound & outbound traffic	Outbound traffic only
Attached directly to VPC	Deployed inside Public Subnet
Used by Public Subnets	Used by Private Subnets
No Elastic IP required	Requires an Elastic IP

🏗 CloudNova Enterprise Architecture

Internet

│

Internet Gateway

│

────────────────────────

Public Subnet

│

Application Load Balancer

│

Bastion Host

│

NAT Gateway

────────────────────────

│

Private App Subnet

│

EC2

Containers

────────────────────────

│

Private Database Subnet

│

Amazon RDS

This architecture follows AWS Well-Architected best practices.

🛠 Lab 01 — Create an Internet Gateway (AWS Console)

Step 1

Open

AWS Console

↓

VPC

Step 2

Navigate to

Internet Gateways

↓

Create Internet Gateway

Step 3

Configure

Setting	Value
Name	CloudNova-IGW

Click

Create Internet Gateway

Step 4

Attach Internet Gateway

Select:

CloudNova-IGW

↓

Actions

↓

Attach to VPC

Choose

CloudNova-VPC

Click

Attach

🛠 Lab 02 — Update Public Route Table

Navigate to:

Route Tables

↓

Public-RT

↓

Routes

↓

Edit Routes

Ensure the following route exists:

Destination	Target
10.10.0.0/16	Local
0.0.0.0/0	Internet Gateway

Save Changes.

🛠 Lab 03 — Allocate an Elastic IP

Navigate to

VPC

↓

Elastic IP Addresses

↓

Allocate Elastic IP

Accept defaults.

Click

Allocate

Record the Elastic IP Allocation ID.

🛠 Lab 04 — Create NAT Gateway

Navigate to

VPC

↓

NAT Gateways

↓

Create NAT Gateway

Configure:

Setting	Value
Name	CloudNova-NAT
Subnet	Public-Subnet-A
Elastic IP	Select Allocated Elastic IP

Click

Create NAT Gateway

Wait until the status changes to:

Available

This may take several minutes.

🛠 Lab 05 — Update Private Route Table

Open:

Route Tables

↓

Private-RT

↓

Routes

↓

Edit Routes

Add:

Destination	Target
10.10.0.0/16	Local
0.0.0.0/0	CloudNova-NAT

Save Changes.

Now Private Subnets can access the Internet without being publicly accessible.

💻 AWS CLI Lab

List Internet Gateways

aws ec2 describe-internet-gateways

Create Internet Gateway

aws ec2 create-internet-gateway

Tag Internet Gateway

aws ec2 create-tags \
  --resources igw-xxxxxxxx \
  --tags Key=Name,Value=CloudNova-IGW

Attach Internet Gateway

aws ec2 attach-internet-gateway \
  --internet-gateway-id igw-xxxxxxxx \
  --vpc-id vpc-xxxxxxxx

Allocate Elastic IP

aws ec2 allocate-address \
  --domain vpc

Record:

AllocationId

Create NAT Gateway

aws ec2 create-nat-gateway \
  --subnet-id subnet-public \
  --allocation-id eipalloc-xxxxxxxx

View NAT Gateway

aws ec2 describe-nat-gateways

Add NAT Route

aws ec2 create-route \
  --route-table-id rtb-private \
  --destination-cidr-block 0.0.0.0/0 \
  --nat-gateway-id nat-xxxxxxxx

Verify Route Tables

aws ec2 describe-route-tables

✅ Verification

Your environment should look like this.

Internet

↓

Internet Gateway

↓

Public Route Table

↓

Public Subnet

↓

Application Load Balancer

↓

NAT Gateway

↓

Private Route Table

↓

Private App Subnet

↓

Private Database Subnet

Verify:

✅ Internet Gateway attached

✅ Elastic IP allocated

✅ NAT Gateway status = Available

✅ Public Route Table points to IGW

✅ Private Route Table points to NAT Gateway

🧪 Connectivity Test

Launch:

One EC2 instance in Public-Subnet-A
One EC2 instance in Private-App-A

Test:

From the Public EC2:

ping google.com

Expected:

Replies received

From the Private EC2:

ping google.com

curl https://aws.amazon.com

Expected:

Outbound Internet access works through NAT Gateway.

The Private EC2 should not have a Public IPv4 address.

🔍 Troubleshooting

Problem

No Internet from Public EC2.

Check:

Internet Gateway attached?
Public Route Table configured?
Security Group outbound rule?
Public IPv4 assigned?

Problem

Private EC2 cannot access Internet.

Check:

NAT Gateway status = Available.
NAT Gateway is in a Public Subnet.
Private Route Table points to NAT Gateway.
Elastic IP attached.
Outbound Security Group rules.

Problem

NAT Gateway creation fails.

Verify:

Elastic IP allocated.
Public Subnet selected.
Internet Gateway attached to VPC.

🏢 Enterprise Notes

CloudNova standards:

Never place a NAT Gateway in a Private Subnet.
Deploy one NAT Gateway per Availability Zone for production workloads.
Monitor NAT Gateway costs using AWS Cost Explorer.
Use VPC Endpoints for AWS services where possible to reduce NAT traffic.
Keep databases isolated in Private Subnets.
Review Route Tables during security assessments.

🚫 Common Mistakes

❌ Forgetting to attach the Internet Gateway.

❌ Creating the NAT Gateway in a Private Subnet.

❌ Forgetting the Elastic IP.

❌ Pointing the Private Route Table directly to the Internet Gateway.

❌ Deploying databases in Public Subnets.

❌ Assuming the NAT Gateway allows inbound Internet traffic.

🧪 DIY Challenge

Using your AWS account:

Create:

CloudNova-IGW
Elastic IP
CloudNova-NAT

Configure:

Attach IGW to CloudNova-VPC.
Create NAT Gateway in Public-Subnet-A.
Update Public Route Table.
Update Private Route Table.

Verify:

Public EC2 has Internet access.
Private EC2 has outbound Internet access.
Private EC2 does not have a Public IPv4 address.

Take screenshots of:

Internet Gateway
NAT Gateway
Elastic IP
Route Tables
EC2 networking
AWS CLI output

📊 Knowledge Check

What is an Internet Gateway?
What is a NAT Gateway?
Why must a NAT Gateway be placed in a Public Subnet?
Which AWS resource requires an Elastic IP?
Can a Private EC2 instance receive inbound Internet traffic through a NAT Gateway?
Which Route Table should contain the Internet Gateway route?
Which Route Table should contain the NAT Gateway route?
Why do enterprises deploy one NAT Gateway per Availability Zone?
What are the security benefits of Private Subnets?
How do Internet Gateways and NAT Gateways work together?

💡 Key Takeaways

After completing this lesson, you should understand:

An Internet Gateway connects an Amazon VPC to the public Internet.
A NAT Gateway allows Private Subnets to initiate outbound Internet connections without exposing resources to inbound Internet traffic.
Public Route Tables use an Internet Gateway, while Private Route Tables use a NAT Gateway.
NAT Gateways require an Elastic IP address and must be deployed in a Public Subnet.
Designing Internet connectivity correctly is a fundamental responsibility of Cloud Security Engineers and Cloud Architects.

🚀 Next Lesson

➡️ Lesson 07 — Security Groups