Internet Gateway, NAT Gateway & Private Networking in AWS: Explained for DevOps Beginners

🎯 Target Audience: Beginners in DevOps & DevSecOps
🧠 Key Concepts: Internet Gateway, NAT Gateway, Private Subnets, Routing, Security
⏱ Estimated Read Time: ~10 minutes
📚 Series: Part of “AWS & Cloud Computing for DevOps Beginners”
🌍 Real-World Focus: How apps in AWS talk to the internet safely and securely

Why This Matters in DevOps

If you’re building on AWS, networking mistakes can break everything, even if your EC2s, S3s, and IAMs are perfect.

Every DevOps engineer needs to understand how private and public traffic flows in AWS, and how gateways (Internet + NAT) make that possible.

Because here’s the truth:
When your CI/CD runner, web app, or database can’t connect to the internet, it’s usually not DNS… It’s your VPC routing 😅.

1️⃣ Internet Gateway (IGW): Your Door to the Internet

An Internet Gateway is like your office’s main door; it allows people (traffic) to go in and out.

Without it, your AWS environment is fully isolated.

💡 In simple terms:

IGW = Lets instances in public subnets talk to the internet directly.

How It Works:

1. You attach an IGW to your VPC.

2. Add a route in your public route table:

    Destination: 0.0.0.0/0
    Target: igw-123456
   

3. Any instance in that subnet with a public IP can now access the internet.

💡 Pro Tip:
For public access (like web servers), your subnet must:

• Have a route to IGW ✅

• Have Auto-assign Public IP enabled ✅

• Use a Security Group allowing inbound traffic (e.g., port 80/443) ✅

Real-World Use Case:

Hosting a frontend web app on EC2.
Your users access it via the internet, so it must live in a public subnet connected to the IGW.

2️⃣ NAT Gateway: Internet Access for Private Subnets

Now imagine this:
Your backend app or database (in a private subnet) needs to download packages or connect to APIs, but shouldn’t be publicly accessible.

That’s where the NAT Gateway (Network Address Translation Gateway) steps in.

💡 What It Does:

NAT Gateway lets private resources access the internet outbound only without exposing them publicly.

It acts like a middleman:

• Instances send traffic to NAT.

• NAT forwards requests to the Internet using its own public IP.

• Replies come back, and NAT routes them back inside.

How to Set It Up:

1. Create a NAT Gateway in your public subnet.

2. Attach an Elastic IP (for public internet access).

3. In your private route table, add:

    Destination: 0.0.0.0/0
    Target: nat-123456
   

4. Now private EC2s can access the internet outbound only 🌐.

Real-World Example:

Let’s say:

• You have a web app (public subnet).

• It connects to a database (private subnet).

• The DB needs to download updates from the internet securely.

👉 NAT Gateway makes that possible without exposing the DB.

3️⃣ Public vs Private Subnets: The Big Picture

💡 DevOps Insight:
Designing your subnet layout this way is the backbone of secure cloud architectures. It separates what’s public and what’s private, like a firewall blueprint.

4️⃣ Real DevOps Scenario: Two-Tier Architecture

Here’s a quick practical breakdown:

Traffic flow:

• Web app → publicly reachable.

• Database → hidden, but can reach the internet via NAT for updates.

💡 This is the most common AWS VPC setup in production-ready architectures.

5️⃣ Common Mistakes to Avoid

⚠️ Creating NAT Gateway in private subnet (it must be public).
⚠️ Forgetting to attach the Elastic IP to the NAT.
⚠️ Missing route to IGW in the public subnet.
⚠️ Assuming private EC2s have internet access by default, they don’t!

6️⃣ Bonus Tip: NAT Gateway Costs

NAT Gateway isn’t free; it charges for:

• Gateway hours

• Data processed

If you’re practicing, try a NAT Instance (a small EC2 instance configured as a NAT); it's cheaper for labs and learning.

📘 AWS Docs: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html

Quick Recap

✅ Internet Gateway → Direct access to the internet for public subnets.
✅ NAT Gateway → Secure outbound access for private subnets.
✅ Private Networking → Keep sensitive components isolated and protected.

Now that you understand gateways and private networking, try building your own 2-tier VPC with both IGW and NAT.

When your first “private EC2” connects to the internet through NAT, that’s your true DevOps networking milestone.

👉 Next up: AWS Security in Action: Layered Defense for DevOps Pipelines. 🔒

👨‍💻 Written by: Abdulrahman A. Muhamad
🌐 LinkedIn | GitHub | Portfolio