-2

There is a vpc on amazon that has two subnets. The outer one has internet access and the inner one using NAT server to connect to internet. Inner subnet have plenty of servers for development and testing. Now I need to use separated NAT server for development and test.

Is it possible? If yes then how?

masegaloeh
  • 17,978
  • 9
  • 56
  • 104
Bagi
  • 51
  • 7
  • Questions must demonstrate a ***minimal understanding of the problem being solved.*** Try including attempted solutions, why they didn't work, and the expected results. See [How can I ask better questions on Server Fault?](http://meta.serverfault.com/q/3608/) for further guidance. – HopelessN00b Nov 26 '14 at 17:03

2 Answers2

1

Of course you can do that! You don't even have to create a new DHCP options set.

A NAT instance in EC2 is just the same as any other instance. It just happens to do NAT.

In your particular case, you'll also need to ensure the routing table associated with each of your subnets has got a static route for the "inner" network, via that NAT instance's RFC1918 IP address. It will need its own EIP as well, since talking between VPCs is like talking over the Internet.

It sounds like you might be trying to do NAT between different subnets in the same VPC, though. Don't do that; it's generally not a good idea and will be a waste of money.

If you're doing things intra-VPC but between subnets, the correct way to manage security isolation is to use security groups with ingress and egress rules to apply security constraints. Not that NAT gives you security, but many people abuse it for that. You don't need to use NAT, because your VPC's RFC1918 address space is routeable inside your VPC. Each subnet's default gateway knows to route RFC1918 IP addresses inside your VPC to the correct subnet.

Falcon Momot
  • 24,975
  • 13
  • 61
  • 92
0

You can have a similar set up using another NAT server.

Assuming you will be placing the new NAT in the same subnet as the original NAT, you can setup a new subnet exactly like the original (inner) subnet you have--just make sure to use the new NAT when setting up the route tables and security groups.

jca-
  • 476
  • 4
  • 4