3

I have one VPC where i configured NAT Gateway. Another VPC(s) do not have any "public subnet" nor IGW. I would like to share single NAT Gateway among many VPCs. I tried to configure Routing table but it does not allow to specify NAT Gateway from different VPC. As posible solution, I installed http/s proxy in VPC with IGW and configured proxy settings on every instance in different VPC. It worked, but I would like use NAT Gateway due to easier management. Is it possible to make this kind of configuration at AWS? There are few VPCs and I do not want to add NAT Gateway to each VPC.

Zdenko

4 Answers 4

8

You can't share a NAT Gateway among multiple VPCs.

To access a resource in another VPC without crossing over the Internet and back requires VPC peering or another type of VPC-to-VPC VPN, and these arrangements do not allow transit traffic, for very good reasons. Hence:

You cannot route traffic to a NAT gateway through a VPC peering connection, a VPN connection, or AWS Direct Connect. A NAT gateway cannot be used by resources on the other side of these connections.

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-gateway.html#nat-gateway-other-services

The instances in the originating VPC are, by definition, "on the other side of" one of the listed interconnection arrangements.

2
  • Thanks, In this case, I have to create NAT instance.
    – zdenko.s
    Commented Feb 10, 2016 at 9:38
  • A very good answer at the time, it is now out of date. See the AWS Transit Gateway answer below.
    – Erica Kane
    Commented Mar 17, 2022 at 14:25
5

AWS Transit Gateway now provides an option to do what you wish, although you will want to consider the costs involved -- there are hourly and data charges. There is a reference architecture published in which multiple VPCs share a NAT gateway without allowing traffic between the VPCs:

https://aws.amazon.com/blogs/networking-and-content-delivery/creating-a-single-internet-exit-point-from-multiple-vpcs-using-aws-transit-gateway/

2
  • 1
    Thanks. I am aware of this new feature. As you mentioned, cost is factor taken into consideration.
    – zdenko.s
    Commented Feb 3, 2020 at 18:32
  • @zdenko.s could you mark this the official answer, as things have changed since 2016?
    – ilam engl
    Commented Aug 17, 2023 at 9:12
3

You basically have 3 options

  • connect to a shared VPC (typically in a shared "network" account) that holds the NAT via VPC peering. No additional costs for the VPC peering, but cumbersome to setup if you have a lot of accounts
  • same, but using Transit Gateway. A Peering Attachment is almost the same cost as a single NAT, so this will only save costs if you use multiple NAT gateways to have a high bandwidth
  • Setup a shared VPC (e.g. in an infrastructure account that holds the NAT. Then share private subnets via AWS resource manager (RAM) to the VPCs that need outgoing access. This has the additional benefit you have a single place where you allocate VPC IP ranges and not every account needs to bother with setting up the full VPC. More details in AWS VPC sharing best practices. This setup avoids both the Transit Gateway costs and the burden of setting up VPC peering. But needs more careful planning to keep things isolated (and likely not everything in the same VPC)
1
  • Solution 2 and 3 look good, although I don't think solution 1 will work, because VPC peering does not support transitive routing, and NAT exist precisely for forwarding traffic further than the peered VPC. When we route traffic towards a peered VPC, all we can send there is traffic for the CIDR range of that VPC, or a subset of it, and we can only route to "the VPC" as a whole, not specifically a NAT inside it.
    – Svend
    Commented Jul 2 at 14:59
0

It may be a bit complicated to setup but running an OpenVPN server in the VPC with the IGW and connecting instances in the VPC without IGW to the vpn server might be a solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.