Instructor: So now let's talk about NAT instances,
which are definitely outdated.
There is a better solution called NAT gateway
in the next lecture, but they still can appear at the exam.
So let's go and have a look at them.
So NAT means Network Address Translation,
and these NAT instances allow EC2 instances
in private subnets to connect to the internet.
To do so, the NAT instance must be launched
in a public subnet and then will connect the public subnet
and the private subnets.
There's also a setting we'll have to disable,
and we'll see this in the hands-on,
called the source/destination check,
and I'll show you this right now why.
Also, your NAT instance must
have a fixed Elastic IP attached to it.
So let's have a look.
So we have a server,
and it's a public server with a public IP, 50.60.4.10,
and we want to access it from our private subnets, okay.
So how do we establish connectivity from the private subnets
to the server?
Well, to do so, we're going to launch a NAT instance
with its own security group in a public subnet,
then what we're going to do is attach an Elastic IP
to this NAT instance,
and then we're going to edit the route tables
from the private subnet to the public subnet
to be allowed to send traffic from the EC2 instances
between the two subnets to the NAT instance.
So then the IP at the instance wants to access the server,
the public server,
but it has to go through the NAT instance.
So the request is seeing that the source IP is 10.0.0.20,
which is true, which is a private IP,
and the destination is 50.60.4.10 which the NAT instance
is smart enough to say, hey, I know you're trying
to send traffic to something else,
so let me send the traffic over to that server.
But that server has something different.
So the destination is still this IP,
but now the source IP is 12.34.56.78,
which is corresponding to the public IP of the NAT instance.
So as you can see, this network packet gets rewritten
by the NAT instance, this is what NATs do,
they rewrite network packets,
and the source IP has changed.
The server now says, hey, I know how to reply to you
because the source is me and the destination
is the public IP of your NAT instance,
and then the NAT instance will reply back the traffic
to the EC2 instance, it's smart enough to know which one
to go to, and say, hey, the source is the public server
and the destination is your private IP.
And this is why,
because there's some IPs are being rewritten,
this is why the source and destination check
must be disabled on the EC2 instance for your NAT instance.
So this is how NAT instances work at a high level.
So again, we're going to create a NAT instance
within a public subnet, and next I attach an Elastic IP
to it, and then we're going to have a route table
which allows the private instances to talk
to the NAT instance all the way
to the internet gateway and so on.
So some comment about NAT instances.
So we have a pre-configured Amazon Linux AMI available
to us, and although it's available there,
it reached its end of standard support
on December 31st, 2020.
So NAT gateways are now recommended,
and NAT instances are not highly available.
They're not resilient with out of the box setup,
so we need to create multiple ones and multiple AZs,
and maybe have an ASG, have a resilient user-data script.
It's quite complicated.
And then if you select a small instances,
then you're going to get less bandwidth
than a bigger instance.
You also must manage Security Groups and rules
on your instance.
So inbound, you must allow whatever HTTP HTTPS traffic
from the private subnets,
allow maybe SSH from your home network,
and outbound, you need to also allow some traffic outbound.
So NAT instances, they work.
This is good to see how NATs work at a high level,
and this is what this lecture is about.
We're going to set up a NAT instance in the next lecture,
but remember, they're going away and the exam will ask you
to choose between NAT instance
that we've just seen right now and NAT gateways
that we'll see in the next lecture.
So I will see you in the next lecture.