-: So let's go
and create a NAT instance to give internet access
to our private subnets.
So I click on Launch instance
and I'm going to type NAT instance,
and now we need to find
the Amazon image that is for NAT instance.
So to do so I'm going to browse more AMI's right here
and then I need to enter a search term
such as NAT, N-A-T,
and then press enter.
And as we can see
there are 40 some results in the community AMI.
So I click on community AMI
and now I can see that we have some NAT instances from AWS.
So you can find one of these as long as it says, X 86 64.
And you can look at the published date to try to
find a newer kind of instance.
So I can find this one published date of 2022,
as long as it says Amazon AMI VPC NAT 2018,
something like this
then you're good to go.
Of Architecture X 86 64.
Okay, so let's choose this one.
Looks recent enough.
But you know, whatever you choose really is good enough
NAT instances are somewhat deprecated.
We'll see by what's next.
So don't worry too much about this, but here we go.
I'm using my community AMI from AWS to deploy a
NAT instance.
I use a T2 micro.
For Key pair I will just use a demo key pair.
And then for network settings, we're going to add, edit this
and we're going to create a new security group.
So rules wise, we're going to create a few things.
So SSH from anywhere, yes.
Then we have to add more rules.
So HTTP,
and then the source is a CIDR
and the CIDR block is the same as our VPC.
So 10 0 0 0 slash 16.
And then we're going to do the same, but for HTTPS
so to allow HTTPS traffic out as well
from the same CIDR block.
And then the last thing to do is to, of course
edit the VPC setting to be in my demo VPC.
And we deploy this NAT instance in the public subnet
for example, public subnet A.
So we have to redo this.
So NAT instance, SG is the name of the security group.
And actually my roles are kept.
So make sure to name it, NAT instance SG.
Okay, so we are good to go.
Now let's go ahead and launch that instance.
And we're done.
And what we want to do is to have the private instance
send internet traffic out through the NAT instance.
Okay, so now that my NAT instance is created
what I need to do is to edit a networking setting
called the source destination check.
So I need to stop this, okay.
And this is because if this is NAT instance
you must stop the source destination checking
because the NAT instance must be able to receive
and send traffic when the source
or destination is not itself.
So this is very important.
We click on save and somehow it was somewhat knew
that we're gonna use this for NAT instances.
So this is really good.
And next, what we have to do is to send some traffic
to the NAT instance.
So first let's verify right now.
So I'm going to re SSH into my private instance
so to do so I have to go through the Bastion Host.
So I will use EC 2 instance connect.
Great. I'm connected into Bastion Host
and then I will use the SSH command.
So EC2 user @, and then I need to have the private IP
of my private instance in here.
So I will copy this and I will paste it
minus I demo keypair.PEM.
Okay, so I am in my private instance.
And again, remember if we did PING Google.com
we're not getting any reply.
So this doesn't have internet access.
Now let's give internet access to the private subnets.
And to do so in my private route table, on the routes
we need to edit the route.
So let's edit them.
And currently we have this one for local rules
but we're going to have one that says, if you want to talk
out to the internet, then please go through your instance.
And the instance has to be the NAT instance, save.
And what we've done effectively is saying, 'Hey
for any EC 2 instance within this subnets
because it's associated with this route table
if you send traffic to the internet
so anywhere then go through my EC 2 instance
which is exactly what a NAT instance is for.'
So now if we try again
to PING Google.com, this is not working.
And I know why
because we need to also enable one specific port
on the NAT instance.
So let's go to security and the security group rules
and we need to enable a specific port for PING.
So let's edit the inbound rule
and I will add a rule for PING.
So it's ICMP.
So all ICMP, IPV4, from this subnets
from the CIDR that we have right here.
Okay, and then click on save.
Now, if we try again, the PING command.
So let's clear the screen and PING again.
Now we are getting some result back.
So this is working and if we wanted to choose, for example
curl google.com, as we can see, we get some result back.
So this is the HTML page
from Google.com or more, clearly.
If I did curl example.com
this would be a easier page to look at.
Okay, so everything is working.
We have PING working, we have curl working
we have HTTP access, HTTPS access.
We have ICMP.
So this is for PING and so on.
So what we've done effectively is
that we've given internet access to the instances
in my private subnet without exposing them to the internet.
As we can see my private subnet instance still
doesn't have a public IP.
We need to use the, the Bastion okay?
So that's it for this lecture really, really good.
But in the next lecture, we're going to use NAT's gateways
and it's going to be much better.
So what I'm going to do now is go back into my instances.
We don't need that NAT instance anymore
and I'm going to stop it.
Okay, or you can terminate as well.
We will not be using it anyway.
So to say for this lecture, I hope you liked it.
And I will see you in the next lecture.