This is usually the very first question that pops up when designing AWS networking. 🤔 Let’s break it down using this architecture:
🟣 Internet Gateway (IGW)
Think of the Internet Gateway as your VPC’s front door to the public internet. It handles both inbound and outbound traffic, acting as the target in your route tables for public subnet traffic.
Scope & Limits: You attach one IGW per VPC.
💰 Cost: The gateway itself is completely free—you only pay for standard AWS outbound data transfer.
🟣 NAT Gateway
What if you have instances in a private subnet that need internet access to pull security patches or dependencies—without exposing them to external threats? That’s where the NAT Gateway comes in. It translates private IP addresses to allow outbound-only connectivity.
💡 Key Distinction: "Outbound-only" means connections must originate from inside your private subnet. While return traffic from your requests is allowed back in, external users on the internet can never initiate a new connection directly to your private instances through a NAT Gateway. (If users need to access your app via a browser, that inbound flow is handled by an Application Load Balancer not the NAT Gateway).
Placement & Scope: A NAT Gateway must be placed inside a public subnet so it can route through the IGW. So, NAT Gateways are zonal resources—for high availability across Availability Zones, you should deploy one in a public subnet within each AZ.
💰 Cost: AWS charges for NAT Gateways per hour (for provisioning) plus a per-GB data processing fee on all data transferred through it.
Why Use It:
Enhanced Security Posture: Keeps workloads isolated while maintaining outbound access.
Allows private application servers to run apt update, fetch dependencies, or call third-party APIs safely.
🟣 How to Access Your Private Instances (Bastion Host)
Since private servers aren't directly reachable from the internet, you'll use a Bastion Host (jump box) pattern to connect:
SSH into your public instance inside the public subnet (the Bastion server).
From the Bastion, initiate a second SSH connection into your target instance inside the private subnet (Private App).
Because both subnets are inside the same VPC, AWS routes this traffic internally via the local VPC router.
The NAT Gateway is completely bypassed. The request never leaves the VPC, never touches the internet, and never hits the NAT Gateway.
To Implement that ssh access approach please check that blog: visit
Quick Summary
Internet Gateway (IGW): Inbound & Outbound | 1 per VPC | Free gateway
NAT Gateway: Outbound-only | Zonal (1 per AZ for HA) | Paid hourly + per GB
Let's connect on LinkedIn to share cloud engineering insights and grow our networks!
Top comments (0)