AWS Interview Series — AWS NAT Gateway:

What is AWS NAT Gateway and When Is It Used?

If you’ve prepared for AWS or DevOps interviews, you’ve probably come across this question:

“What is AWS NAT Gateway and when would you use it?”

Many engineers memorize the definition but struggle to explain the actual traffic flow during an interview.

In this article, we’ll break down NAT Gateway in a simple and practical way.

— -

## The Problem NAT Gateway Solves

Imagine you have an application server running inside a Private Subnet.

For security reasons, the server does not have a public IP address and cannot be directly accessed from the internet.

However, the server still needs to:

• Download application dependencies
• Install operating system updates
• Pull Docker images
• Access third-party APIs
• Download packages from repositories

The challenge is:

How can a private server access the internet without exposing itself to inbound internet traffic?

The answer is AWS NAT Gateway.

— -

## What is NAT?

NAT stands for Network Address Translation.

A NAT Gateway allows resources in a private subnet to initiate outbound connections to the internet while preventing the internet from initiating inbound connections to those resources.

Think of it as a secure middleman between your private servers and the public internet.

— -

## Real-World Example

Let’s say you have:

• An Application Server in a Private Subnet
• A NAT Gateway in a Public Subnet
• An Internet Gateway attached to the VPC

When the application server needs to download software updates, the request follows this path:

Application Server → NAT Gateway → Internet Gateway → Internet

The response returns through the same path:

Internet → Internet Gateway → NAT Gateway → Application Server

The private server never becomes directly exposed to the internet.

— -

Route Table Configuration

For NAT Gateway to work, the private subnet’s route table must contain:

0.0.0.0/0 → NAT Gateway

This route tells AWS:

“If the destination is outside the VPC, send the traffic to the NAT Gateway.”

Without this route, the private instance cannot access the internet.

— -

## How NAT Gateway Works Behind the Scenes

Let’s understand what happens at the networking level.

A TCP packet contains:

• Source IP Address
• Destination IP Address
• Source Port
• Destination Port

Suppose:

Private Server IP = 10.0.1.10

Destination Website = 8.8.8.8

When the server sends a request:

Source IP: 10.0.1.10 Destination IP: 8.8.8.8

The NAT Gateway receives the packet and performs Network Address Translation.

It replaces:

Source IP: 10.0.1.10

with

Source IP: NAT Gateway Public IP

Now the packet travels across the internet using the NAT Gateway’s public address.

When the response returns, AWS checks the translation table maintained by the NAT Gateway and forwards the response back to the original private server.

This entire process is transparent to the application.

— -

## Interview Answer (Short Version)

If an interviewer asks:

“When do we use a NAT Gateway?”

You can answer:

“We use a NAT Gateway when resources in a private subnet require outbound internet access, such as downloading updates or accessing external services, but should not be directly accessible from the internet. NAT Gateway performs Network Address Translation by replacing the private source IP with its own public IP and forwarding the response back to the original instance.”

— -

## NAT Gateway vs Internet Gateway

Many candidates confuse these concepts.

### Internet Gateway

• Attached to a VPC
• Provides internet connectivity
• Used by resources with public IP addresses
• Supports inbound and outbound traffic

### NAT Gateway

• Deployed inside a public subnet
• Used by resources in private subnets
• Supports outbound internet access
• Does not allow unsolicited inbound traffic

— -

## Common Interview Questions

Can a NAT Gateway be placed in a Private Subnet?

No.

A NAT Gateway must be deployed in a Public Subnet and must have access to an Internet Gateway.

— -

### Does NAT Gateway allow inbound traffic?

No.

It only allows return traffic for connections initiated from private resources.

— -

### Why not assign a Public IP directly to the server?

Because it increases the attack surface.

Keeping application servers in private subnets improves security and follows AWS best practices.

— -

### Is NAT Gateway highly available?

Yes, within a single Availability Zone.

For production environments, AWS recommends deploying NAT Gateways in multiple Availability Zones.

— -

## Key Takeaways

✅ NAT = Network Address Translation

✅ Used when private subnet resources need internet access

✅ NAT Gateway replaces the private source IP with its own public IP

✅ Private subnet route table must point 0.0.0.0/0 to the NAT Gateway

✅ NAT Gateway allows outbound internet access without exposing private servers

✅ One of the most frequently asked AWS networking interview questions

— -

### AWS Interview Series

This is Part 1 of the AWS Interview Series.

Follow me for more practical AWS, Kubernetes, DevOps, and Cloud interview questions explained in a simple and visual way.

Author: Sajal Dhiman X (Twitter): @sajaldhiman2