NAT instance vs NAT Gateway (cost vs reliability)

Pehle nat-lab-vpc (10.40.0.0/16) banta hai, jisme ek public aur ek private subnet hota hai. Public subnet ke liye internet gateway aur route table banti hai. Private subnet ke liye ek khaali route table banti hai; uska internet route baad mein NAT instance ki taraf joda jaayega.

Phir do SGs bante hain. NAT instance ka SG poori VPC (10.40.0.0/16) se har tarah ka traffic allow karta hai, taaki private server ka traffic NAT tak pahunch sake. Private server ka SG khaali rehta hai.

nat-userdata.sh NAT instance ko router banati hai. Yeh iptables install karti hai, IP forwarding chalu karti hai, aur default network interface pe MASQUERADE rule lagati hai. Is rule se private IPs ka traffic NAT ke public IP ke naam se bahar jaata hai. Agar iptables-services package mil jaaye, toh rules save kar diye jaate hain taaki reboot ke baad bhi rahein.

Aakhir mein NAT instance public subnet mein launch hota hai aur uska source/dest check band kiya jaata hai. Private route table mein "0.0.0.0/0 is instance ki taraf" wala route joda jaata hai, aur NAT instance ka public IP print hota hai.

export AWS_DEFAULT_REGION=us-east-1 TYPE=t3.micro
mkdir -p ~/deepdive/scn6 && cd ~/deepdive/scn6
AMI_ID=$(aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text)

VPC=$(aws ec2 create-vpc --cidr-block 10.40.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=nat-lab-vpc},{Key=Project,Value=deepdive-scn6}]' --query Vpc.VpcId --output text)
PUB=$(aws ec2 create-subnet --vpc-id $VPC --cidr-block 10.40.1.0/24 --availability-zone us-east-1a --query Subnet.SubnetId --output text)
PRIV=$(aws ec2 create-subnet --vpc-id $VPC --cidr-block 10.40.2.0/24 --availability-zone us-east-1a --query Subnet.SubnetId --output text)
aws ec2 modify-subnet-attribute --subnet-id $PUB --map-public-ip-on-launch
IGW=$(aws ec2 create-internet-gateway --query InternetGateway.InternetGatewayId --output text)
aws ec2 attach-internet-gateway --internet-gateway-id $IGW --vpc-id $VPC
PUB_RT=$(aws ec2 create-route-table --vpc-id $VPC --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id $PUB_RT --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW >/dev/null
aws ec2 associate-route-table --route-table-id $PUB_RT --subnet-id $PUB >/dev/null
PRIV_RT=$(aws ec2 create-route-table --vpc-id $VPC --query RouteTable.RouteTableId --output text)
aws ec2 associate-route-table --route-table-id $PRIV_RT --subnet-id $PRIV >/dev/null

NAT_SG=$(aws ec2 create-security-group --vpc-id $VPC --group-name nat-instance-sg --description "NAT instance" --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id $NAT_SG --protocol -1 --cidr 10.40.0.0/16 >/dev/null
PRIV_SG=$(aws ec2 create-security-group --vpc-id $VPC --group-name private-sg --description "private server" --query GroupId --output text)

cat > nat-userdata.sh <<'EOF'
#!/bin/bash
dnf install -y iptables-nft
dnf install -y iptables-services || true      # rules ko reboot ke baad bhi rakhne ke liye
echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/90-nat.conf
sysctl -p /etc/sysctl.d/90-nat.conf
IFACE=$(ip route | awk '/^default/ {print $5; exit}')
iptables -F FORWARD
iptables -t nat -A POSTROUTING -o "$IFACE" -s 10.40.0.0/16 -j MASQUERADE
if systemctl list-unit-files | grep -q '^iptables.service'; then
  iptables-save > /etc/sysconfig/iptables
  systemctl enable --now iptables
fi
EOF
NATI=$(aws ec2 run-instances --image-id $AMI_ID --instance-type $TYPE --subnet-id $PUB --security-group-ids $NAT_SG \
  --iam-instance-profile Name=deepdive-ec2-role --user-data file://nat-userdata.sh \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=nat-instance}]' --query 'Instances[0].InstanceId' --output text)
aws ec2 wait instance-running --instance-ids $NATI
aws ec2 modify-instance-attribute --instance-id $NATI --no-source-dest-check
aws ec2 create-route --route-table-id $PRIV_RT --destination-cidr-block 0.0.0.0/0 --instance-id $NATI >/dev/null
NATI_IP=$(aws ec2 describe-instances --instance-ids $NATI --query 'Reservations[0].Instances[0].PublicIpAddress' --output text)
echo "NAT instance public IP: $NATI_IP"

Yeh block private subnet mein bina public IP ke ek server launch karta hai aur uske chalu hone ka intezaar karta hai:

PRIVI=$(aws ec2 run-instances --image-id $AMI_ID --instance-type $TYPE --subnet-id $PRIV --security-group-ids $PRIV_SG \
  --iam-instance-profile Name=deepdive-ec2-role --no-associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=private-server}]' --query 'Instances[0].InstanceId' --output text)
aws ec2 wait instance-running --instance-ids $PRIVI

2–3 minute baad Session Manager se private-server mein jao. Yeh isliye chal paata hai kyunki server ka SSM agent bhi NAT instance ke through hi AWS tak pahunch raha hai. Neeche ki pehli command batati hai ki bahar ki duniya ko tumhara kaunsa IP dikhta hai; yeh NAT instance ka public IP hona chahiye. Doosri command check karti hai ki dnf chal raha hai. Teesri command AWS CLI ki zip file teen baar download karke har baar ki speed MB/s mein dikhati hai:

curl -s https://checkip.amazonaws.com                  # == NAT instance ka public IP
sudo dnf -y makecache >/dev/null && echo "dnf OK"
for i in 1 2 3; do curl -s -o /dev/null -w "%{speed_download}\n" https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip; done \
  | awk '{printf "%.1f MB/s\n", $1/1048576}'

Ab Session Manager se NAT instance mein jao aur sudo iptables -t nat -L POSTROUTING -n -v chalao. MASQUERADE rule ke packet counters badhte hue dikhenge.

Yeh block ek Elastic IP ke saath NAT Gateway banata hai aur uske available hone ka intezaar karta hai. Phir private route table ke 0.0.0.0/0 route ko NAT instance se hata ke NAT Gateway pe kar deta hai (replace-route). Aakhir mein NAT Gateway ka public IP print hota hai:

EIP=$(aws ec2 allocate-address --query AllocationId --output text)
NATGW=$(aws ec2 create-nat-gateway --subnet-id $PUB --allocation-id $EIP --query NatGateway.NatGatewayId --output text)
aws ec2 wait nat-gateway-available --nat-gateway-ids $NATGW
aws ec2 replace-route --route-table-id $PRIV_RT --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NATGW
aws ec2 describe-addresses --allocation-ids $EIP --query 'Addresses[0].PublicIp' --output text

Private-server pe wahi teen commands dobara chalao. Ab checkip NAT Gateway ka Elastic IP dikhayega. Dono ki speeds compare karo. t3.micro NAT instance ka network "up to 5 Gbps" tak burst karta hai, jabki NAT Gateway 5 Gbps se 100 Gbps tak apne aap scale hota hai.

PL-065 course se — asli console reference

NAT Gateway create karke NAT instance se compare karna — yeh managed NAT Gateway ka console hai.

Tumhari tulna kuch is tarah ki table mein honi chahiye:

Aam taur pe recommendation yeh hoti hai: dev aur test mein NAT instance (ya fck-nat jaise community projects) aur production mein NAT Gateway. Dono jagah S3 aur DynamoDB ke liye muft gateway endpoints lagao, taaki NAT se kam data jaaye.