🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

📌 धडा 05 — Elastic IPs आणि allow-listing

📍 तुम्ही इथे आहात: 8 पैकी धडा 05 · मागे: lesson-04-per-az-routing · पुढे: lesson-06-costs

📦 या ब्रँचमध्ये काय आहे

धडे 01–04, आणि फाटकाचा स्थिर परतीचा पत्ता: Elastic IP. Partners तो allow-list का करतात, दुसरा IP फाटकाला ports चा दुसरा संच कसा देतो, आणि पत्ता म्हणजे ओळख का नाही. nat/demo.py मधील eip() हे दाखवते.

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

फाटकातून बाहेर पडणाऱ्या प्रत्येक पत्राच्या मागे शाळेचा पत्ता असतो. गावातली एक बँक म्हणते: "आम्ही फक्त त्या पत्त्यावरून आलेलीच पत्रे उघडतो". छान — दुसऱ्या गावातला अनोळखी माणूस शाळा असल्याचे सोंग घेऊ शकत नाही.

पण नीट पाहा. प्रत्येक विद्यार्थिनीच्या पत्रामागे तोच पत्ता असतो: मुख्याध्यापिकेच्या, कॅन्टीनच्या, पहिल्या दिवशीच्या नव्या विद्यार्थिनीच्याही. बँकेने मुख्याध्यापिकेवर विश्वास ठेवलेला नाही. तिने संपूर्ण शाळेवर विश्वास ठेवला आहे.

आणि शाळेत गर्दी वाढली की ती फाटकाचा दुसरा पत्ता जोडते. आता बँकेला दोन्ही माहीत असायला हवेत, नाहीतर अर्धी पत्रे न वाचताच राहतात.

🗺️ आकृती

flowchart LR
    app["🪑 payments app"] --> gate
    web["🪑 web app"] --> gate
    job["🪑 batch job"] --> gate
    gate["🚪 NAT gateway<br/>📌 13.232.10.20<br/>📌 13.232.10.30"]
    gate -->|"1 from a listed IP"| partner["🏦 partner firewall<br/>allow 13.232.10.20/32<br/>allow 13.232.10.30/32"]
    partner -->|"2 still check who: mTLS / signed request"| ok["✅"]

🗺️ काढलेली आकृती + एक lab: https://school-edh.pages.dev/nat/lesson-diagrams.html#l05

❓ काय

Elastic IP (EIP) — तुम्ही release करेपर्यंत तुमच्या account चा असलेला स्थिर public IPv4 address. Public NAT gateway ला एक लागतो; private subnets मधून निघणारे प्रत्येक connection source address म्हणून तोच घेऊन बाहेर पडते.
स्थिर egress IP — पत्ता बदलत नाही, म्हणून partners तो त्यांच्या firewall allow-list मध्ये टाकू शकतात (13.232.10.20/32).
Secondary IPs — NAT gateway शी तुम्ही 8 IP addresses पर्यंत जोडू शकता (primary आणि secondary मिळून; तुमचे Service Quotas तपासा, default कमी असू शकतो). प्रत्येक IP प्रत्येक unique destination कडे आणखी 55,000 एकाच वेळचे connections देतो (धडा 08). मग partners नी ते सगळे allow-list करायला हवेत.
IP म्हणजे ओळख नाही — त्या NAT मागचे प्रत्येक workload तोच address वापरते. तो allow-list करणे म्हणजे त्या सगळ्यांवर विश्वास ठेवणे. त्याच्यासोबत खरे authentication वापरा: mTLS, signed requests, OAuth tokens किंवा योग्य तपासणीसह API keys.
Public IPv4 addresses ना पैसे लागतात — AWS public IPv4 addresses साठी, Elastic IPs सह, प्रति तास पैसे घेते; pricing page तपासा.

🤔 का

कारण partner firewalls (banks, payment providers, सरकारी APIs) बरेचदा फक्त ओळखीच्या addresses वरूनच traffic स्वीकारतात. NAT मागचे servers हे सोडवतात: अनेक बदलणारे servers, एक किंवा काही स्थिर addresses. पण teams बरेचदा इथेच थांबतात, आणि मग allow-list हेच एकमेव कुलूप उरते — आणि VPC मधील कोणतेही compromised workload त्यातून आरामात जाऊ शकते.

🔧 कसे (या repo मध्ये)

nat/gateway.py मधील NatGateway(name, public_ips) IPs ची यादी घेते. send() पहिला IP वापरून पाहते; त्या IP ने त्या destination कडे ports_per_dest ports वापरले की ते पुढच्या IP कडे जाते. nat/demo.py मधील eip() दोन पत्ते असलेल्या फाटकासाठी partner allow-list छापते. ports_per_dest लहान केल्याने मूठभर connections मध्येच तुम्ही पुढच्या IP कडे सांडणे पाहू शकता.

🧪 करून पाहा

python3 nat/demo.py eip
python3 - <<'EOF'
import sys; sys.path.insert(0, "nat"); from gateway import NatGateway
PYPI = ("151.101.0.223", 443, "tcp")
for ips in (["13.232.10.20"], ["13.232.10.20", "13.232.10.30"]):
    g = NatGateway("nat-a", ips, ports_per_dest=3)
    out = [g.send(("10.20.48.25", 40000 + i), PYPI) for i in range(7)]
    print(len(ips), "IP(s):", [r[0] + ":" + str(r[1]) if r else "ERR" for r in out], "· errors:", g.errors)
EOF

✅ तपासा — तुम्हाला काय दिसायला हवे

eip हे partner firewall allow-list: 13.232.10.20/32, 13.232.10.30/32, every desk behind the gate looks like one of these 2 addresses — add IPs (up to 8) for more ports आणि allow-listing the NAT's IP trusts EVERY workload behind it ही सूचना छापते. तुमचा snippet (55,000 ऐवजी प्रत्येक destination साठी 3 ports, म्हणजे screen वर मावेल) हे छापतो:

1 IP(s): ['13.232.10.20:1024', '13.232.10.20:1025', '13.232.10.20:1026', 'ERR', 'ERR', 'ERR', 'ERR'] · errors: 4
2 IP(s): ['13.232.10.20:1024', '13.232.10.20:1025', '13.232.10.20:1026', '13.232.10.30:1024', '13.232.10.30:1025', '13.232.10.30:1026', 'ERR'] · errors: 1

दुसऱ्या IP ने नोंदवहीतील जागा दुप्पट केली. आणि connections 4–6 13.232.10.30 वरून बाहेर पडले — फक्त .20 यादीत टाकलेल्या partner ने ते नाकारले असते.

🏁 तुम्ही आत्ताच काय सिद्ध केले

स्थिर पत्त्यामुळे partners तुमची शाळा ओळखू शकतात, आणि जास्त पत्ते फाटकाला जास्त ports देतात — पण प्रत्येक पत्ता partner च्या यादीत असायलाच हवा, आणि त्यातला कोणताही पत्ता कोणते workload call करत आहे ते सांगत नाही.

⚠️ नेहमीच्या चुका

partner API साठी IP allow-listing हेच एकमेव संरक्षण
port errors दुरुस्त करण्यासाठी secondary IP जोडणे आणि partners ना न सांगणे — अर्धे calls fail होऊ लागतात
साफसफाई करताना चुकून Elastic IP release करणे — तोच पत्ता तुम्हाला परत मिळणार नाही
private subnets मधील प्रत्येक server ला NAT चा IP मिळतो असे समजणे — ते तो share करतात; त्यावरून आतले काहीही reachable नाही

🏭 प्रत्यक्ष वापरात

खऱ्या account वर — आधीपासून असलेल्या public NAT gateway ला secondary Elastic IP जोडा, आणि partners ना पाठवण्यासाठी addresses ची यादी काढा:

aws ec2 allocate-address --domain vpc --tag-specifications 'ResourceType=elastic-ip,Tags=[{Key=Name,Value=nat-a-2}]'
aws ec2 associate-nat-gateway-address --nat-gateway-id nat-0abc --allocation-ids eipalloc-0def
aws ec2 describe-nat-gateways --nat-gateway-ids nat-0abc --query 'NatGateways[].NatGatewayAddresses[].[PublicIp,IsPrimary,Status]' --output table

Terraform मध्ये, secondary address सह तोच gateway:

resource "aws_nat_gateway" "a" {
  allocation_id            = aws_eip.nat_a.id
  secondary_allocation_ids = [aws_eip.nat_a_2.id]
  subnet_id                = aws_subnet.public_a.id
}

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे: egress IPs ची यादी एकाच ठिकाणी ठेवा (एक output, wiki page, एक parameter), address जोडण्या किंवा बदलण्याआधी ती partners ना पाठवा, आणि allow-list ला कधीही एकमेव तपासणी होऊ देऊ नका.

⏭️ पुढे

फाटक मोफत नाही. त्याला दोन मीटर आहेत, आणि त्यातला एक जवळजवळ प्रत्येक team ला आश्चर्यचकित करतो. फाटकाचा खर्च किती.

git checkout lesson-06-costs

📌 Lesson 05 — Elastic IPs & allow-listing

📍 You are here: Lesson 05 of 8 · Previous: lesson-04-per-az-routing · Next: lesson-06-costs

📦 What's in this branch

Lessons 01–04, plus the gate's fixed return address: the Elastic IP. Why partners allow-list it, how a second IP gives the gate a second set of ports, and why an address is not an identity. eip() in nat/demo.py shows it.

🧒 Explain like I'm 5

Every letter that leaves through the gate has the school's address on the back. A bank in town says: "we only open letters from that address". Good — a stranger in another town cannot pretend to be the school.

But look closely. Every pupil's letter has the same address on the back: the head teacher's, the canteen's, a new pupil's on the first day. The bank has not trusted the head teacher. It has trusted the whole school.

And when the school gets busy, it adds a second gate address. Now the bank must know both, or half the letters go unread.

🗺️ Diagram

flowchart LR
    app["🪑 payments app"] --> gate
    web["🪑 web app"] --> gate
    job["🪑 batch job"] --> gate
    gate["🚪 NAT gateway<br/>📌 13.232.10.20<br/>📌 13.232.10.30"]
    gate -->|"1 from a listed IP"| partner["🏦 partner firewall<br/>allow 13.232.10.20/32<br/>allow 13.232.10.30/32"]
    partner -->|"2 still check who: mTLS / signed request"| ok["✅"]

🗺️ Drawn version + a lab: https://school-edh.pages.dev/nat/lesson-diagrams.html#l05

❓ What

Elastic IP (EIP) — a static public IPv4 address that belongs to your account until you release it. A public NAT gateway needs one; every connection from the private subnets leaves with it as the source address.
Stable egress IP — because the address does not change, partners can put it in their firewall allow-list (13.232.10.20/32).
Secondary IPs — you can associate up to 8 IP addresses with a NAT gateway (the primary plus secondary ones; check your Service Quotas, the default may be lower). Each IP gives another 55,000 simultaneous connections to each unique destination (lesson 08). Partners must then allow-list all of them.
An IP is not an identity — every workload behind that NAT shares the address. Allow-listing it trusts all of them. Pair it with real authentication: mTLS, signed requests, OAuth tokens or API keys with proper checks.
Public IPv4 addresses are charged — AWS charges per hour for public IPv4 addresses, including Elastic IPs; check the pricing page.

🤔 Why

Because partner firewalls (banks, payment providers, government APIs) often accept traffic only from known addresses. Servers behind a NAT solve that: many changing servers, one or a few fixed addresses. But teams often stop there, and then the allow-list is the only lock — and any compromised workload in the VPC can walk through it.

🔧 How (in this repo)

NatGateway(name, public_ips) in nat/gateway.py takes a list of IPs. send() tries the first IP; when that IP has used ports_per_dest ports to that destination, it moves to the next IP. eip() in nat/demo.py prints the partner allow-list for a gate with two addresses. Shrinking ports_per_dest lets you watch the spill-over with a handful of connections.

🧪 Try it

python3 nat/demo.py eip
python3 - <<'EOF'
import sys; sys.path.insert(0, "nat"); from gateway import NatGateway
PYPI = ("151.101.0.223", 443, "tcp")
for ips in (["13.232.10.20"], ["13.232.10.20", "13.232.10.30"]):
    g = NatGateway("nat-a", ips, ports_per_dest=3)
    out = [g.send(("10.20.48.25", 40000 + i), PYPI) for i in range(7)]
    print(len(ips), "IP(s):", [r[0] + ":" + str(r[1]) if r else "ERR" for r in out], "· errors:", g.errors)
EOF

✅ Verify — what you should see

eip prints partner firewall allow-list: 13.232.10.20/32, 13.232.10.30/32, every desk behind the gate looks like one of these 2 addresses — add IPs (up to 8) for more ports and the warning allow-listing the NAT's IP trusts EVERY workload behind it. Your snippet (3 ports per destination instead of 55,000, so it fits on a screen) prints:

1 IP(s): ['13.232.10.20:1024', '13.232.10.20:1025', '13.232.10.20:1026', 'ERR', 'ERR', 'ERR', 'ERR'] · errors: 4
2 IP(s): ['13.232.10.20:1024', '13.232.10.20:1025', '13.232.10.20:1026', '13.232.10.30:1024', '13.232.10.30:1025', '13.232.10.30:1026', 'ERR'] · errors: 1

The second IP doubled the room in the register. And connections 4–6 left from 13.232.10.30 — a partner that listed only .20 would refuse them.

🏁 What you just proved

A fixed address lets partners recognise your school, and more addresses give the gate more ports — but every address must be on the partner's list, and none of them says which workload is calling.

⚠️ Common mistakes

IP allow-listing as the only protection for a partner API
adding a secondary IP to fix port errors and not telling partners — half the calls start failing
releasing an Elastic IP by accident while cleaning up — you will not get the same address back
thinking the private subnets' servers each get the NAT's IP — they share it; nothing inside is reachable on it

🏭 In production

On a real account — add a secondary Elastic IP to an existing public NAT gateway, and list the addresses to send to partners:

aws ec2 allocate-address --domain vpc --tag-specifications 'ResourceType=elastic-ip,Tags=[{Key=Name,Value=nat-a-2}]'
aws ec2 associate-nat-gateway-address --nat-gateway-id nat-0abc --allocation-ids eipalloc-0def
aws ec2 describe-nat-gateways --nat-gateway-ids nat-0abc --query 'NatGateways[].NatGatewayAddresses[].[PublicIp,IsPrimary,Status]' --output table

In Terraform, the same gateway with a secondary address:

resource "aws_nat_gateway" "a" {
  allocation_id            = aws_eip.nat_a.id
  secondary_allocation_ids = [aws_eip.nat_a_2.id]
  subnet_id                = aws_subnet.public_a.id
}

🏭 Why this matters in production: keep the list of egress IPs in one place (an output, a wiki page, a parameter), send it to partners before you add or change an address, and never let the allow-list be the only check.

⏭️ Next

The gate is not free. It has two meters, and one of them surprises almost every team. What the gate costs.

git checkout lesson-06-costs

← Previousper az routing Next →costs

This page is the lesson's README from the lesson-05-elastic-ips branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.