{"id":813,"date":"2022-10-23T09:37:31","date_gmt":"2022-10-23T14:37:31","guid":{"rendered":"https:\/\/cloudlearning365.com\/?p=813"},"modified":"2022-10-27T08:46:26","modified_gmt":"2022-10-27T13:46:26","slug":"aviatrix-nat-use-case-use-spoke-gateway-as-egress-gateway-for-private-subnet","status":"publish","type":"post","link":"https:\/\/cloudlearning365.com\/?p=813","title":{"rendered":"Aviatrix NAT use case – Use spoke gateway as egress gateway for private subnet"},"content":{"rendered":"\n

In AWS, subnet that doesn’t have default 0.0.0.0\/0 point to Internet Gateway (IGW) is considered as private subnet. Where subnet that have default 0.0.0.0\/0 point to IGW is considered as public subnet. Instances running on private subnet still need to access Internet to download patches, packages etc. You may use AWS NAT Gateway<\/a> on public subnet to provide this connectivity. NAT Gateway cost $0.045 USD per hour plus $0.045 per GB data processed.<\/p>\n\n\n\n

If you already have Aviatrix Spoke Gateway deployed, and need internet access (egress) from private subnet, also you don’t need any fancy egress control, then you may reuse the existing Aviatrix Spoke Gateway as Egress Gateway by using SNAT rule.<\/p>\n\n\n\n

If you need better control and traffic inspection, you should consider Aviatrix FQDN egress gateway for L7 egress control based on Fully Qualified Domain Name eg: allow https:\/\/github.com deny https:\/\/youtube.com. Or if deep packet inspection using Next Generation Firewall (NGFW) is required, then you may consider Aviatrix FireNet with NGFW integration.<\/p>\n\n\n\n

Simple diagram:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n\n\n\n\n

Following is a typical private subnet that managed by Aviatrix, where Aviatrix insert RFC1918 routes, 10.0.0.0\/8, 172.16.0.0\/12 and 192.168.0.0\/16 into private subnet route table and point them to Aviatrix Spoke Gateway eth0 interface<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Try to access google.com from the private instance, getting connection timed out:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

To add SNAT rule to the Spoke Gateway, go to Aviatrix Controller -> Gateways -> Find the spoke gateway, then click on EDIT<\/strong> (If you have HA gateway, you will need to complete this same step on the -hagw as well)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Scroll to Source NAT section, select Customized SNAT, make sure Sync to HA Gateway isn’t selected.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Click on ADD NEW<\/p>\n\n\n\n