SysPad › Lessons › networking lessons › NAT Gateway

How NAT Gateway works

Managed Network Address Translation for private subnet egress traffic. Scales to 45 Gbps, supports up to 55,000 simultaneous connections. Billed per hour + per GB processed - consider VPC endpoints for AWS services.

You want your databases and app servers hidden from the internet, but they still need to fetch updates and call external APIs. That’s the contradiction a NAT Gateway resolves: it gives private resources outbound-only internet access. They can reach out; nothing on the internet can reach in.

What you will learn

Why keep resources in a private subnet with no public IP at all?
What does a NAT Gateway actually do for those resources?
Why is the access strictly one-way, and why does that matter for security?
Where does a NAT Gateway sit, and what does it cost?

Private subnets: hidden by default

Resources in a private subnet have no public IP, so the internet can’t initiate a connection to them. That’s the safe default for databases, internal services, and app servers, attack surface you don’t expose can’t be attacked.

Outbound access without exposure

A NAT Gateway (network address translation) sits in a publicsubnet. Private resources route their internet-bound traffic through it; the NAT replaces their private source address with its own public one, so the wider internet only ever sees the NAT.

This lets private instances download patches, pull packages, and call third-party APIs, all while staying unreachable from outside.

⚓ Standard in any VPC where app/database tiers live private but need egress.

Strictly one-way

The NAT allows the return traffic for connections that started inside, but it never lets the internet initiate a connection inward. Outbound and its replies: yes. New inbound: no.

Placement and cost

A NAT Gateway lives in a public subnet with a route to the internet gateway; private subnets route 0.0.0.0/0 to it. It’s managed and highly available within its AZ (deploy one per AZ for resilience). You pay an hourly rate plus a per-GB data processing charge.

Flashcards

Why place databases/app servers in a private subnet?: They have no public IP, so the internet can’t reach them inbound, reducing attack surface. They still need a way out.
What does a NAT Gateway provide, and what does it not?: Outbound internet access for private resources (and the return traffic). It does not allow new inbound connections.
Where does a NAT Gateway sit, and how do private subnets use it?: In a public subnet; private subnets route 0.0.0.0/0 to it. Deploy one per AZ for high availability.
You need inbound access to a service. Is NAT the tool?: No, NAT is egress-only. Inbound access uses a load balancer (or public IP) in a public subnet.
What drives NAT Gateway cost, and how can you reduce it?: Hourly + per-GB processed. For AWS-service traffic, VPC endpoints can bypass the NAT and its data charges.

Sources

Open the SysPad canvas · Official NAT Gateway documentation