aws-vpc with NAT Gateway

aws-vpc-nat-gateway.md

AWS VPC with NAT Gateway

Sometimes, we need a static IP for accessing a private service since it has several firewall rules to avoide malcious attacks. In this case, we can create a NAT gateway on AWS and assign a static IP for this gateway. Therefore, we can use this public IP address to access our private service. This note tries to demonstrate how to create a NAT gateway on AWS VPC.

Architecture

Environment

1. one private subnet
2. one public subnet
3. one internal gateway
4. one NAT gateway
5. Elastic IP (public static IP)
6. 2 routing tables

Setup Nat Gateway

Create a VPC on AWS

1. Go to VPC console and click Your VPCs for creating a VPC on AWS
2. Click Create VPC and fill the information as following figure.

Create two subnets (public/private)

1. Got to Subnets
2. Click Create subnet for creating public subnets

3. Click Create subnet for creating private subnets

Create an internal gateway

1. Go to Internal Gateways and click Create internal gateway

2. Attach to VPC

3. Check the result of attachment

Create a public route table

1. Click Route Tables
2. Click Create Route Table

3. Add a routing rule in route table

4. Click Subnet Associations tab and associate to public subnet

Create a NAT gateway

1. Go to NAT Gateways
2. Click Create NAT Gateway

3. Create a EIP

4. Edit the main route table

Prepare an app for test (simulate private service)

const express = require('express');
const app = express();

app.get('/', function(req, res){
   const ip = req.headers['x-real-ip'] || req.connection.remoteAddress;
   console.log(ip);
   res.send("Hello world!");
});

app.listen(3000);

Prepare a lambda function on AWS

1. Create a lambda function on AWS

2. Go to IAM and assign a VPC permission to execturion role

3. Attach VPC to lambda

4. Test sending a request to server

5. Check execution result

const http = require('http');
const ip = process.env.IP;

exports.handler = (event, context, callback) => {
  const opt = {
    hostname: ip,
    port: 3000,
    path: '/',
    method: 'GET',
  };

  const req = http.request(opt, res => {
    console.log(res);
  });

  req.end();
};

6. Check server output and EIP

output:

$ node app.js 
::ffff:18.208.118.121

Reference

1. AWS Lambdas with a static outgoing IP
2. How to use Elastic Beanstalk with an IP Whitelisted API
3. Express.js: how to get remote client address
4. NAT instances
5. NAT gateway use cases