What is NAT gateway?
In a secure cloud network, we often put our most important servers (like databases) in a Private Subnet.
But what happens when that "hidden" server needs to download a security patch, update its software, or talk to an external API? It can't "see" the outside world. This is where a NAT Gateway comes in.
NAT stands for Network Address Translation.
The Inside-Out Rule: It allows your private servers to send requests out to the internet.
The Outside-In Rule: It prevents the internet from initiating a connection in to your private servers.
Imagine a high-security office building where the employees are not allowed to have their own phone lines.
The Employee (Private Server): If an employee needs to order a pizza, they call the Receptionist.
The Receptionist (NAT Gateway): The receptionist places the call using the office's official main phone number. To the pizza shop, it looks like the receptionist called.
The Pizza (Data): When the pizza arrives, the receptionist knows exactly which employee ordered it and delivers it to their desk.
The Intruder (Hacker): If a stranger calls the main office number and asks to talk to "anyone at their desk," the receptionist hangs up. The stranger has no way to call an employee directly.
To use a NAT Gateway, you place it in your Public Subnet (the neighborhood that has a connection to the internet).
The Request: Your private server sends a request (e.g., sudo apt-get update).
The Routing: Your "Route Table" tells the server: "If you want to reach the internet, send your data to the NAT Gateway."
The Translation: The NAT Gateway strips away the private server's internal ID and replaces it with its own Public IP address.
The Response: The internet sends the data back to the NAT Gateway, which then passes it back to the specific private server that asked for it.
These two sound similar, but they serve completely different purposes:
| Feature | Internet Gateway (IGW) | NAT Gateway |
| Traffic Direction | Two-way (In and Out) | One-way (Outbound only) |
| Purpose | Connects your VPC to the web | Protects private servers while allowing updates |
| Subnet Type | Used by Public Subnets | Used by Private Subnets |
| Cost | Usually free | Usually a paid service (per hour + per GB) |
Security (Zero-Inbound): It is the gold standard for maintaining a "zero-trust" environment. Your servers can stay fully updated without ever having a public-facing IP address.
Managed Reliability: Unlike an old-school "NAT Instance" (which was just a single Linux server you had to manage), a NAT Gateway is a managed service.
Simplicity: You don't have to manage complex firewall rules on every individual server. You just manage one central "door" for the whole subnet.
NAT Gateways are convenient, but they are notorious for driving up cloud bills. You are typically charged for:
The Hourly Rate: Just for having the "door" open.
Data Processing: A fee for every Gigabyte of data that passes through it.
Pro Tip: If your private servers are talking to other services from the same provider (like AWS S3 or Azure Storage), use a VPC Endpoint instead. It’s cheaper and keeps the traffic inside the provider's network, bypassing the NAT Gateway entirely!
A NAT Gateway is the "guardian" of your private cloud. it gives your servers the freedom to reach out for what they need while ensuring that the "wild west" of the internet can never find its way inside your secure environment.