Internet Gateway vs NAT Gateway

Watch the video on Instagram

Quick revision

• Internet Gateway (IGW): connects a VPC to the internet and serves as an internet route target.
• Public NAT Gateway: lets private resources initiate outbound internet connections and receive the corresponding responses.
• NAT means Network Address Translation.
• A public NAT Gateway uses an Elastic IP and works with an IGW for internet access; it does not replace the IGW.

See AWS Internet Gateways and AWS NAT Gateways.

Remember the entrance analogy

The IGW is the property's main entrance to the outside world. Public resources can use that entrance directly when addressing and security rules allow it.

A private application server needs software updates or an external API, but should not accept new internet connections. A public NAT Gateway acts as the intermediary for those outbound requests.

Request and response flow

For the public NAT Gateway setup described in the video:

Private server -> NAT Gateway -> Internet Gateway -> external API
Private server <- NAT Gateway <- Internet Gateway <- API response

The NAT Gateway maps the server's private source address to its own private address. For internet-bound IPv4 traffic, the IGW maps that address to the NAT Gateway's Elastic IP. The external API sees the Elastic IP; return traffic is translated back to the original server. See AWS NAT address translation.

Route table checklist

1. Attach an IGW to the VPC.
2. Place the public NAT Gateway in a public subnet and associate an Elastic IP.
3. Set the public subnet's internet route: 0.0.0.0/0 -> IGW.
4. Set the private subnet's internet route: 0.0.0.0/0 -> NAT Gateway.
5. Permit the required traffic in security groups and network ACLs.

The private server does not need its own public IPv4 address.

Interview pitfalls

• A NAT Gateway accepts responses to connections initiated from inside the VPC; it does not provide unsolicited inbound access to the private server.
• An IGW supports inbound and outbound connectivity when addressing, routing, and security rules permit it.
• A private NAT Gateway is a different connectivity type used for private networks; routing it to an IGW does not give it internet access.
• These routes describe IPv4. For outbound-only native IPv6 internet access, AWS offers an egress-only Internet Gateway. See AWS NAT connectivity types and IPv6 options.

Recall: IGW = internet connection for the VPC; public NAT Gateway + IGW = outbound internet access for private resources.

Review VPC vs Subnet first if subnet routing is unclear.