Help Center/ NAT Gateway/ Best Practices/ Using a Public NAT Gateway and VPC Peering to Enable Communications Between VPCs and the Internet
Updated on 2023-08-10 GMT+08:00
View PDF

Using a Public NAT Gateway and VPC Peering to Enable Communications Between VPCs and the Internet

Scenarios

VPC A and VPC B are in the same region. A public NAT gateway is configured for subnet A in VPC A and you can add SNAT and DNAT rules for Internet connectivity. Subnet B connects to subnet A through a VPC peering connection and uses the public NAT gateway of subnet A to communicate with the Internet.

Solution Advantages

Only one public NAT gateway needs to be configured. Servers in the two VPCs can share the same public NAT gateway to communicate with the Internet, saving gateway resources.

Typical Topology

The CIDR block of VPC A is 192.168.0.0/16 and that of subnet A is 192.168.1.0/24.

The CIDR block of VPC B is 192.168.0.0/16 and that of subnet B is 192.168.2.0/24.

Implementation methods:

  1. A VPC peering connection is used to connect subnet A in VPC A to subnet B in VPC B.
  2. A public NAT gateway is created in VPC A, and subnet B can use the public NAT gateway to communicate the Internet.
    Figure 1 Network topology

Prerequisites

  • If VPCs connected by a VPC peering connection have overlapping CIDR blocks, the connection can only enable communications between specific (non-overlapping) subnets in the VPCs.
  • All subnets of the two VPCs do not overlap with each other. For details, see Unsupported VPC Peering Configurations.

Procedure

  1. Create VPC A, VPC B, subnet A, and subnet B.

    For detailed operations, see Creating a VPC.

  2. Create a VPC peering connection.

    Create a VPC peering connection between subnet A and subnet B. For detailed operations, see Creating a VPC Peering Connection with Another VPC in Your Account.

    The local VPC is VPC A, and the peer VPC is VPC B.

    Add a route in the route table of VPC B. Set Destination to 0.0.0.0/0 and Next Hop to the created VPC peering connection between VPC A and VPC B.

  3. Buy a public NAT gateway.

    Buy a public NAT gateway with VPC set to VPC A. For details about how to configure other parameters, see Buying a Public NAT Gateway.

  4. Add an SNAT rule.

    1. Select VPC for Scenario and subnet A for Subnet. For more details, see Adding an SNAT Rule.
    2. Add an SNAT rule for subnet B. Set Scenario to Direct Connect/Cloud Connect and enter the CIDR block of subnet B.

  5. Add a DNAT rule.

    1. Add a DNAT rule for subnet A. Select VPC for Scenario and enter an IP address of a server in subnet A for Private IP Address. For more details, see Adding a DNAT Rule.
    2. Add a DNAT rule for subnet B. Set Scenario to Direct Connect/Cloud Connect and enter an IP address of a server in subnet B for Private IP Address.

Verification

After the configuration is complete, test the network connectivity.

Log in to a server in subnet B and ping a public IP address.

Log in to a server that can access the Internet and is not deployed in VPC A or VPC B. Use curl to check whether the server can communicate with subnet B via the EIP associated with the DNAT rule configured for subnet B.