I have a public subnet with ec2 instnaces. The route table has IGW (Internet Gateway) as default.

I tested adding a public IP address to my instance ( as reported by curl ifconfig.co) and when I ssh to that ec2 it returns this IP address, which I expected.

1) My question is since NAT is only for outbound traffic, how they communicate when it sends request or quote to other sites?

2) If I switch IGW (internet gateway) to NAT for public subnet will it mask all outbound traffic to NAT IP address and still able to communicate with other sites?


Generally you will have 2 kinds of subnets in a VPC:

  1. Public subnet

    • has IGW and optionally NAT
    • there points to the IGW
    • hosts (EC2 instances) must have public IP or elastic IP attached as they go directly to the internet
  2. Private subnet

    • has no IGW or NAT
    • the points to the NAT in the public subnet above
    • hosts only have private IP and all outbound access is "masked" to the NAT gateway IP
    • without NAT configured hosts won't have internet access

Hope that explains it :)

  • I see Thanks! I have another question related with 1-3 If one instance(with EIP) in public subnet associated with a route table with ( to NAT) can communication simultaneously? EIP and NAT IP is different for sure but I am not sure how other clients can communicate. Since they send request to IP A(EIP or can be ELB) and received response from IP B(NAT). Thank you so much – tk0221 Oct 11 '18 at 1:27
  • @TKim yes they can all communicate simultaneously - NAT GW keeps track of the source and dest TCP ports and forwards the packets to the appropriate hosts. – MLu Oct 11 '18 at 1:34

Your Answer

