What is the difference between an internet gateway and a NAT gateway?
An internet gateway lets resources with public IPs in a public subnet talk to the internet in both directions. A NAT gateway lets private-subnet instances start outbound connections, such as updates, while blocking inbound connections from the internet.
Explain it simply
An internet gateway is the main gate of a housing society open to visitors in both directions. A NAT gateway is the security guard who makes phone calls on behalf of residents: residents can call out, replies come back to them, but strangers cannot phone a resident directly.
Example
Public subnet route table
10.0.0.0/16 -> local
0.0.0.0/0 -> igw-123 (internet gateway)
Private subnet route table
10.0.0.0/16 -> local
0.0.0.0/0 -> nat-456 (NAT gateway, placed in a PUBLIC subnet)
NAT gateway
- lives in a public subnet and has an Elastic IP
- one per AZ for resilience
- managed by AWS, scales automatically
- billed per hour and per GB processedThe private instance sends a request to the NAT gateway, which forwards it through the internet gateway using its own public IP, and returns the reply. Nobody on the internet can open a new connection to that instance.
For access to AWS services like S3 or DynamoDB from private subnets, VPC endpoints can avoid NAT charges and keep traffic inside AWS.
What to say in the interview
"The internet gateway gives two-way internet access to public subnets. A NAT gateway sits in a public subnet and lets private instances go out without being reachable from outside. I place one NAT gateway per AZ for resilience."
Common mistakes
- Placing the NAT gateway in a private subnet.
- Forgetting the route from the private subnet to the NAT gateway.