<p>I created a kubernetes cluster using Kops on aws in private subnet.
When using NAT gateway as a point of egress in the cluster, everything just works fine. But when i try to deploy a NAT instance as a point of egress in my cluster, it does not work. I cannot figure out a way to use nat instance as egress in my cluster nor able to figure the issue. Any guidance or tutorial that can help in this case is most welcome.</p>

<p>A few gotchas that are easy to miss: </p>

<ul>
<li>The NAT instance needs to be deployed into a <em>public</em> subnet (i.e. one with an internet gateway attached and a route out through that internet gateway).</li>
<li>The NAT instance needs the Source/Destination check disabled (in the AWS console, you can get to this via Actions -> Networking -> Change Source/Dest. Check).</li>
<li>The private subnet's routing table needs a route to the NAT instance (presumably for 0.0.0.0/0 but you could scope it narrower if you need less).</li>
</ul>

<p>See <a href="http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html" rel="nofollow noreferrer">the AWS NAT Instance docs</a>, or <a href="http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario2.html#vpc-scenario-2-nat-instance" rel="nofollow noreferrer">this AWS tutorial on NAT with public/private subnets</a>, for more details.</p>

<p>My understanding is that NAT instances are potentially a scalability bottleneck, so if you have a lot of outgoing traffic you may ultimately need to move back to a NAT gateway, upgrade the NAT instance, or do some fancier things with a group of NAT instances.</p>
