What is the difference between a NAT Gateway and an Internet Gateway?
Learn the difference between an AWS NAT Gateway and Internet Gateway, how each routes VPC traffic, and how to design secure public and private subnets.
Expected Interview Answer
An Internet Gateway allows resources in public subnets to send and receive traffic directly to and from the internet, while a NAT Gateway lets resources in private subnets initiate outbound internet connections without being reachable from the internet.
An Internet Gateway is attached to the VPC and provides bidirectional connectivity for instances that have public IPs. A NAT Gateway lives in a public subnet and performs source network address translation, so private instances can pull updates or reach external APIs while remaining unreachable inbound. NAT traffic still routes out through the Internet Gateway, but the NAT hides the private instances behind its own public IP.
- Internet Gateway enables direct inbound and outbound internet access
- NAT Gateway allows outbound-only access for private subnets
- NAT keeps private instances unreachable from the internet
- NAT Gateway is managed, scalable, and highly available in its AZ
- Separation supports a secure public/private subnet architecture
- NAT enables patching and API calls without exposing servers
AI Mentor Explanation
An Internet Gateway is like the main stadium gate where fans freely enter and exit both ways. A NAT Gateway is the players' tunnel: the team can go out to the field, but outsiders can't come in through it. One is two-way public access, the other is outbound-only for protected members — the VPC networking split.
Step-by-Step Explanation
Step 1
Attach an Internet Gateway
Create and attach an Internet Gateway to the VPC to enable internet connectivity.
Step 2
Configure public subnet routing
Route the public subnet's 0.0.0.0/0 traffic to the Internet Gateway for direct access.
Step 3
Deploy a NAT Gateway
Place a NAT Gateway with an Elastic IP inside a public subnet.
Step 4
Route private subnets to NAT
Point the private subnet's 0.0.0.0/0 route at the NAT Gateway for outbound-only access.
Step 5
Verify isolation
Confirm private instances can reach the internet outbound but cannot be reached inbound.
What Interviewer Expects
- Internet Gateway provides bidirectional access
- NAT Gateway allows outbound-only for private subnets
- NAT performs source address translation
- Understanding of public vs private subnets
- How route tables direct traffic to each gateway
Common Mistakes
- Thinking a NAT Gateway allows inbound connections
- Placing a NAT Gateway in a private subnet
- Forgetting an Elastic IP for the NAT Gateway
- Confusing NAT Gateway with NAT instance
- Not routing private subnet traffic through the NAT
Best Answer (HR Friendly)
“An Internet Gateway is like a public front door letting resources talk to the internet in both directions. A NAT Gateway is a one-way outbound door that lets private servers reach the internet for updates while keeping them hidden and unreachable from outside.”
Code Example
# Attach an Internet Gateway to the VPC
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway --vpc-id vpc-0abc --internet-gateway-id igw-0abc
# Allocate an Elastic IP and create a NAT Gateway in a public subnet
aws ec2 allocate-address --domain vpc
aws ec2 create-nat-gateway --subnet-id subnet-public --allocation-id eipalloc-0abc
# Private subnet route: outbound internet via the NAT Gateway
aws ec2 create-route --route-table-id rtb-private \
--destination-cidr-block 0.0.0.0/0 --nat-gateway-id nat-0abcFollow-up Questions
- How does a NAT Gateway differ from a NAT instance?
- How do you make a NAT Gateway highly available across AZs?
- Why can't you attach an Internet Gateway route to a private subnet directly?
- What is an egress-only Internet Gateway for IPv6?
MCQ Practice
1. What kind of access does a NAT Gateway provide to private subnets?
A NAT Gateway lets private instances initiate outbound connections while blocking inbound ones.
2. Where must a NAT Gateway be placed?
A NAT Gateway must sit in a public subnet with a route to the Internet Gateway to reach the internet.
Flash Cards
What does an Internet Gateway enable? — Bidirectional internet access for resources in public subnets.
What does a NAT Gateway enable? — Outbound-only internet access for resources in private subnets.
Where does a NAT Gateway live? — In a public subnet, with an Elastic IP and a route to the Internet Gateway.
Can the internet initiate a connection through a NAT Gateway? — No, NAT only permits outbound-initiated connections.