AWS Cloud Practitioner Study Notes · Part 25
AWS Network Gateways: Internet, NAT, VPN, Transit, and IPv6
AWS Cloud Practitioner study notes comparing Internet Gateway, NAT Gateway, Virtual Private Gateway, Transit Gateway, and egress-only gateways.
AWS gateways provide different roads between a VPC and other networks. The correct choice depends on the destination and the direction of traffic: public Internet access, private outbound access, an on-premises VPN, multiple VPCs, or outbound-only IPv6.
This is Part 25 of the AWS Cloud Practitioner Study Notes series. Part 24 introduced VPCs, subnets, route tables, and security controls; this article focuses on the gateway decision behind each network path.
Gateway comparison
| Gateway or connection | Connects to | Main use |
|---|---|---|
| Internet Gateway (IGW) | VPC and public Internet | Public IPv4 or IPv6 connectivity |
| NAT Gateway | Private subnet and external destinations through an IGW | Outbound IPv4 access without unsolicited inbound access |
| Virtual Private Gateway (VGW) | VPC and a remote network | Site-to-Site VPN termination on the AWS side |
| Transit Gateway (TGW) | Multiple VPCs, VPNs, and Direct Connect networks | Centralised hub-and-spoke routing |
| Egress-only Internet Gateway | VPC and IPv6 Internet | Outbound-only IPv6 connectivity |
| VPC endpoint | VPC and supported AWS services | Private service access without an Internet Gateway or NAT device |
The last item is technically an endpoint rather than a gateway, but it appears frequently in VPC connectivity questions and is useful to compare alongside gateways.
1. Internet Gateway
An Internet Gateway is a highly available VPC component that allows communication between a VPC and the Internet. It must be attached to the VPC and referenced by a route in a subnet’s route table.
A typical public-subnet route is:
0.0.0.0/0 → Internet GatewayFor IPv6, the equivalent route is:
::/0 → Internet GatewayAn Internet Gateway is required for a public EC2 instance or public load balancer to communicate with the Internet, but the gateway alone is not enough. The resource also needs suitable public addressing and security rules.
For an EC2 instance to be reachable over IPv4, check all of these:
- The Internet Gateway is attached to the VPC.
- The subnet route table sends Internet-bound traffic to the Internet Gateway.
- The instance or interface has a public IPv4 address or Elastic IP.
- The security group allows the required protocol and port.
- The NACL, operating system, and application allow the traffic.
Exam keywords:
- Public website
- Public EC2 instance
- Internet-facing load balancer
- VPC Internet access
Answer: Internet Gateway.
2. NAT Gateway
A NAT Gateway allows resources in a private subnet to initiate outbound connections to the Internet or other external destinations. The external destination cannot initiate an unsolicited connection back to the private resource through that NAT path.
Typical flow:
Private EC2
→ Private route table
→ NAT Gateway
→ Internet Gateway
→ InternetCommon uses include:
- Downloading operating-system updates
- Installing application packages
- Calling external APIs
- Accessing public repositories
A public NAT Gateway is created in a public subnet and uses an Internet Gateway for its own connectivity. The private subnet’s route table points Internet-bound IPv4 traffic to the NAT Gateway.
Important distinction:
| Feature | Internet Gateway | NAT Gateway |
|---|---|---|
| Typical subnet | Public subnet | Private resources use it; gateway sits in a public subnet |
| Direction | Internet communication for publicly addressed resources | Outbound connections from private resources |
| Unsolicited inbound Internet connection | Possible when public addressing and rules allow it | Prevented through the NAT path |
| Common exam phrase | Public Internet access | Private subnet outbound access |
NAT Gateways are Availability Zone-specific. For resilient multi-AZ designs, AWS recommends creating a NAT Gateway in each Availability Zone that needs one and routing private subnets to the appropriate local gateway. NAT Gateways have hourly and data-processing charges, so use VPC endpoints for supported AWS services when that is a better fit.
3. Virtual Private Gateway
A Virtual Private Gateway (VGW) is the AWS-side endpoint for connecting a VPC to a remote network through a Site-to-Site VPN. The remote network normally has a customer gateway device, and the VPN creates encrypted IPsec tunnels between the two sides.
Example:
On-premises office
→ Customer gateway
→ Site-to-Site VPN
→ Virtual Private Gateway
→ VPCA company might use this design to connect an office or data centre to private AWS resources. The VPC route tables must contain routes for the on-premises CIDR, and the security controls must allow the intended traffic.
Exam keywords:
- Site-to-Site VPN
- On-premises network
- Encrypted tunnel into a VPC
- AWS-side VPN endpoint
Answer: Virtual Private Gateway, unless the question specifically describes a central hub for several VPCs and networks, in which case consider Transit Gateway.
4. Transit Gateway
AWS Transit Gateway is a central network transit hub. It can connect multiple VPCs and on-premises networks through VPC attachments, VPN attachments, and Direct Connect gateway attachments.
Without a hub, connecting many VPCs individually can create a difficult mesh of peering connections. A Transit Gateway provides a hub-and-spoke model:
| Attachment | Example |
|---|---|
| VPC | HR, finance, development, or production VPC |
| VPN | Site-to-Site VPN from an office |
| Direct Connect gateway | Dedicated private connectivity from a data centre |
| Transit Gateway peering | Connectivity to another Transit Gateway |
Each attachment is associated with a Transit Gateway route table. The route table determines which destinations are reachable through which attachments. The VPC route tables still need routes pointing traffic to the Transit Gateway.
Transit Gateway is a strong fit when an organisation needs:
- Many VPCs connected through a central hub
- Shared routing between VPCs and on-premises networks
- Centralised network segmentation
- A scalable alternative to many individual peering connections
Connected VPCs must have non-overlapping CIDR ranges for normal routing. CIDR planning therefore matters before attaching VPCs to a Transit Gateway.
Exam keywords:
- Multiple VPCs
- Hub-and-spoke architecture
- Central network hub
- Enterprise network routing
Answer: Transit Gateway.
5. Egress-only Internet Gateway
An egress-only Internet Gateway provides outbound-only Internet access for IPv6 traffic. IPv6 addresses are globally unique and do not use IPv4-style NAT in the same way, so this gateway provides a stateful boundary that allows outbound connections and their responses while preventing Internet resources from initiating new connections to the instances.
The route is:
::/0 → Egress-only Internet GatewayIt is for IPv6 only. For outbound-only IPv4 access, use a NAT Gateway.
Exam keywords:
- IPv6
- Outbound-only Internet access
- Prevent inbound Internet-initiated connections
Answer: Egress-only Internet Gateway.
6. VPC endpoints
VPC endpoints provide private access from a VPC to supported AWS services without requiring an Internet Gateway or NAT device. This is especially useful for private workloads that need to access services such as Amazon S3.
At the Cloud Practitioner level, remember the distinction:
- NAT Gateway: Private resources reach external destinations through an outbound NAT path.
- VPC endpoint: Private resources reach a supported AWS service through private VPC connectivity.
Gateway endpoints and interface endpoints have different implementation details, but both can reduce the need for public Internet paths when the target service supports them.
Putting the gateways together
Consider a VPC with a public web tier and a private application tier:
| Resource or network | Route or gateway | Result |
|---|---|---|
| Public load balancer | 0.0.0.0/0 → Internet Gateway | Public Internet traffic can reach the load balancer when allowed |
| Private application servers | 0.0.0.0/0 → NAT Gateway | Servers can initiate outbound IPv4 connections |
| Private AWS service access | VPC endpoint route or interface endpoint | Traffic stays on private AWS connectivity where supported |
| Office network | Site-to-Site VPN → VGW | Office can reach private VPC ranges |
| Several VPCs | VPC attachments → Transit Gateway | Centralised VPC-to-VPC routing |
| IPv6 private workload | ::/0 → Egress-only Internet Gateway | Outbound-only IPv6 Internet access |
The gateways do not replace route tables or security controls. A gateway provides a possible path, but the subnet route table must select it and security groups/NACLs must permit the traffic.
Common exam questions
| Question clue | Correct answer |
|---|---|
| Public website needs Internet connectivity | Internet Gateway |
| Public EC2 needs a public route | Internet Gateway |
| Private EC2 downloads operating-system updates | NAT Gateway |
| Office connects to AWS through Site-to-Site VPN | Virtual Private Gateway |
| Many VPCs need a central hub | Transit Gateway |
| IPv6 resources need outbound-only Internet access | Egress-only Internet Gateway |
| Private workload accesses supported AWS services | VPC endpoint |
Common exam traps
Internet Gateway versus NAT Gateway
An Internet Gateway supports public Internet communication when the resource has the required public addressing, route, and security rules. A NAT Gateway lets private resources initiate outbound IPv4 connections without exposing them to unsolicited inbound connections.
Virtual Private Gateway versus Transit Gateway
A VGW is commonly associated with one VPC’s Site-to-Site VPN or private connection. A Transit Gateway is a central hub for multiple VPCs, VPNs, and Direct Connect networks.
NAT Gateway versus egress-only Internet Gateway
NAT Gateway is the usual answer for outbound-only IPv4. Egress-only Internet Gateway is the IPv6-specific answer.
Gateway versus route
Attaching a gateway does not automatically route traffic through it. Check the subnet’s route table. For example, a public subnet needs a route such as 0.0.0.0/0 → Internet Gateway.
Memory trick
- IGW: “I am public.”
- NAT Gateway: “Private resources only go out.”
- VGW: “VPN to the office.”
- TGW: “Traffic hub for many networks.”
- Egress-only: “IPv6 goes out only.”
- VPC endpoint: “Private path to supported AWS services.”
Final takeaway
Choose an AWS gateway by matching the required network path:
- Internet-facing VPC resources use an Internet Gateway.
- Private IPv4 resources needing outbound access use a NAT Gateway.
- A Site-to-Site VPN into a VPC commonly terminates at a Virtual Private Gateway.
- Many VPCs and networks use a Transit Gateway hub.
- IPv6 outbound-only access uses an egress-only Internet Gateway.
- Private access to supported AWS services uses a VPC endpoint.
The final exam check is always the route table: the right gateway must be attached or available, the subnet must route traffic to it, and the security controls must allow the connection.