🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🧭 धडा 07 — NAT चे पर्याय

📍 तुम्ही इथे आहात: 8 पैकी धडा 07 · मागे: lesson-06-costs · पुढे: lesson-08-troubleshooting

📦 या ब्रँचमध्ये काय आहे

धडे 01–06, आणि बाकीची दारे: gateway endpoints, interface endpoints (PrivateLink), IPv6 साठी egress-only internet gateway, domain allow-lists साठी proxy किंवा AWS Network Firewall, private NAT gateway, आणि internet अजिबात नाही. nat/demo.py मधील alternatives() हा नकाशा छापते.

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

प्रत्येक फेरीला मुख्य फाटक लागत नाही:

🚇 गावातल्या ग्रंथालयात (S3, DynamoDB) जायला: एक मोफत बोगदा.
🚪 नगरपालिकेच्या कार्यालयांकडे (इतर AWS services): तुमच्याच इमारतीत बांधलेले एक खाजगी बाजूचे दार, थोड्या शुल्कासह.
6️⃣ शाळेची नवी wing नव्या प्रकारचा पत्ता (IPv6) वापरते, जो आधीच संपूर्ण जगात एकमेव आहे. नोंदवहीची गरज नाही — फक्त एक एकमार्गी दार: बाहेर जाणे हो, अनोळखी लोकांनी आत येणे नाही.
📋 फक्त ठराविक दुकानांनाच परवानगी? फाटकासमोर दुकानांच्या नावांची यादी असलेला तपासनीस ठेवा.
🏫 ज्या दुसऱ्या शाळेचे खोली क्रमांक तुमच्याशी जुळतात तिच्याकडे: दोन शाळांमधले एक private फाटक, रस्त्याकडे नाही.
🔒 ज्या खोलीला कधीच बाहेर जायचे नसते? फाटकच नको. सर्वात स्वस्त, सर्वात सुरक्षित फाटक म्हणजे काहीच नाही.

🗺️ आकृती

flowchart LR
    desks["🪑 private desks"]
    desks -->|"S3 / DynamoDB"| gwe["🚇 gateway endpoint · free"]
    desks -->|"ECR, STS, SQS…"| ife["🚪 interface endpoint · $/h/AZ + $/GB"]
    desks -->|"IPv6 out only"| eigw["6️⃣ egress-only IGW"]
    desks -->|"listed domains only"| fw["📋 proxy / Network Firewall"] --> nat["🚪 NAT gateway"]
    desks -->|"other private network"| pnat["🏫 private NAT gateway"]

🗺️ काढलेली आकृती + एक lab: https://school-edh.pages.dev/nat/lesson-diagrams.html#l07

❓ काय

Gateway endpoint — फक्त S3 आणि DynamoDB साठी. Prefix list कडे जाणारी route-table मधील नोंद. मोफत. फक्त त्याच region मध्ये.
Interface endpoint (AWS PrivateLink) — एका service साठी (ECR, STS, SQS, Secrets Manager, CloudWatch Logs, आणि इतर अनेक) तुमच्या subnet मध्ये private IP असलेला elastic network interface. प्रत्येक AZ ला प्रति तास आणि प्रति processed GB charge. Private DNS चालू असेल तर service चे नेहमीचे नाव private IP वर resolve होते. त्याला security groups असतात.
IPv6 ला NAT नाही — IPv6 addresses जगभर unique असतात, त्यामुळे translate करण्यासारखे काहीच नसते. "फक्त outbound" IPv6 साठी ::/0 हे egress-only internet gateway कडे route करा: IPv6 connections आतून सुरू होऊन उत्तरे मिळवू शकतात; बाहेरून सुरू होणारी connections अडवली जातात.
NAT64 / DNS64 — फक्त-IPv6 subnets ना फक्त-IPv4 destinations पर्यंत पोहोचायचे असेल तर: DNS64 कृत्रिम IPv6 addresses (64:ff9b::/96) देते आणि NAT gateway त्यांचे IPv4 मध्ये translation करतो.
Domain allow-lists — NAT gateway ला फक्त IP addresses दिसतात. फक्त pypi.org ला परवानगी द्यायची आणि बाकी कशालाच नाही, तर NAT आधी मार्गात forward proxy किंवा AWS Network Firewall (domain rules) ठेवा.
Private NAT gateway — connectivity-type private: Elastic IP नाही, internet नाही. तो आपल्या private IP मध्ये translate करतो, private-to-private traffic साठी, उदाहरणार्थ Transit Gateway मधून overlapping CIDRs असलेल्या VPCs मध्ये.
NAT नाही — फक्त AWS services वापरणारे workloads बरेचदा फक्त endpoints वर, internet चा कोणताही मार्ग नसताना चालू शकतात.

🤔 का

कारण NAT हे सर्वसाधारण कामाचे फाटक आहे: त्याला प्रति GB खर्च येतो, ते servers ना internet वरच्या कोणत्याही address पर्यंत पोहोचू देते, आणि ते फक्त IPv4 साठी आहे. अनेक फेऱ्यांसाठी स्वस्त, अरुंद किंवा private दार जास्त चांगले असते. योग्य दार निवडणे हा खर्चाचाही निर्णय आहे आणि सुरक्षिततेचाही.

🔧 कसे (या repo मध्ये)

nat/demo.py मधील alternatives() प्रत्येक गरज आणि तिचे दार छापते. nat/gateway.py मधील monthly_cost() ला तुम्ही स्वतःचे hourly आणि per_gb दिले तर ते कोणत्याही "तास + GB" दाराची किंमत काढते. खाली, 3 AZs मधील interface endpoint hourly=0.01, per_gb=0.01 वापरतो — us-east-1 च्या उदाहरण किमती.

🧪 करून पाहा

python3 nat/demo.py alternatives
python3 - <<'EOF'
import sys; sys.path.insert(0, "nat"); from gateway import monthly_cost
gb_s3, gb_ecr, gb_web = 3000, 1500, 500
print("1 all through 3 NATs              $", monthly_cost(3, gb_s3 + gb_ecr + gb_web))
print("2 S3 → free gateway endpoint      $", monthly_cost(3, gb_ecr + gb_web))
ecr = monthly_cost(3, gb_ecr, hourly=0.01, per_gb=0.01)   # example: interface endpoint in 3 AZs
print("3 + ECR → interface endpoint      $", round(monthly_cost(3, gb_web) + ecr, 2), f"(endpoint part ${ecr})")
print("4 no internet needed, no NAT      $", monthly_cost(0, 0))
EOF

✅ तपासा — तुम्हाला काय दिसायला हवे

alternatives सहा ओळी छापते, S3 / DynamoDB → gateway endpoint — free, just a route पासून nothing on the internet at all → no NAT — the cheapest and safest gate is none पर्यंत. तुमचा snippet हे छापतो:

1 all through 3 NATs              $ 323.55
2 S3 → free gateway endpoint      $ 188.55
3 + ECR → interface endpoint      $ 157.95 (endpoint part $36.9)
4 no internet needed, no NAT      $ 0.0

प्रत्येक दाराने bill चा काही भाग काढून टाकला. (ECR image layers S3 मध्ये साठवलेले असतात, म्हणून प्रत्यक्षात image pull चा बराचसा भाग S3 gateway endpoint मधूनच जातो; उरलेल्यासाठी ECR API endpoints तरीही लागतात.)

🏁 तुम्ही आत्ताच काय सिद्ध केले

NAT हे अनेक दारांपैकी एक दार आहे; प्रत्येक destination साठी योग्य दार निवडल्याने उदाहरणातले bill $323.55 वरून $157.95 वर आले, आणि internet ची गरज नसलेल्या workload साठी शून्यावर.

⚠️ नेहमीच्या चुका

IPv6-enabled subnet ला NAT नाही म्हणून ते private आहे असे गृहीत धरणे — ते ::/0 internet gateway कडे route करत असेल तर ते reachable आहे; egress-only IGW वापरा
NAT gateway domain name नुसार अडवेल अशी अपेक्षा — त्याला फक्त IPs दिसतात; proxy किंवा Network Firewall वापरा
महिन्याला 2 GB वाहून नेणाऱ्या service साठी प्रत्येक AZ मध्ये interface endpoints — तासाचा charge NAT पेक्षाही जास्त पडतो
private NAT gateway मधून internet पर्यंत पोहोचण्याचा प्रयत्न

🏭 प्रत्यक्ष वापरात

खऱ्या account वर:

aws ec2 create-vpc-endpoint --vpc-id vpc-0abc --vpc-endpoint-type Gateway --service-name com.amazonaws.us-east-1.dynamodb --route-table-ids rtb-private-a rtb-private-b rtb-private-c
aws ec2 create-vpc-endpoint --vpc-id vpc-0abc --vpc-endpoint-type Interface --service-name com.amazonaws.us-east-1.ecr.dkr --subnet-ids subnet-private-a subnet-private-b subnet-private-c --security-group-ids sg-0endpoints --private-dns-enabled
aws ec2 create-egress-only-internet-gateway --vpc-id vpc-0abc
aws ec2 create-route --route-table-id rtb-private-a --destination-ipv6-cidr-block ::/0 --egress-only-internet-gateway-id eigw-0abc
aws ec2 create-nat-gateway --subnet-id subnet-transit-a --connectivity-type private

resource "aws_egress_only_internet_gateway" "v6" {
  vpc_id = aws_vpc.main.id
}

resource "aws_route" "private_v6_out" {
  route_table_id              = aws_route_table.private["a"].id
  destination_ipv6_cidr_block = "::/0"
  egress_only_gateway_id      = aws_egress_only_internet_gateway.v6.id
}

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे: चांगली egress रचना प्रत्येक प्रकारचे destination आणि त्याचे दार यादीत मांडते: AWS services endpoints मधून, partners NAT मधून (स्थिर IPs सह), बाकी सगळे domain allow-list मधून — किंवा काहीच नाही.

⏭️ पुढे

फाटक चालते. एक दिवस ते चालत नाही तोपर्यंत: "connection reset", "cannot allocate port". फाटकाचे troubleshooting — भरलेल्या नोंदवह्या आणि विसरलेल्या ओळी.

git checkout lesson-08-troubleshooting

🧭 Lesson 07 — Alternatives to NAT

📍 You are here: Lesson 07 of 8 · Previous: lesson-06-costs · Next: lesson-08-troubleshooting

📦 What's in this branch

Lessons 01–06, plus the other doors: gateway endpoints, interface endpoints (PrivateLink), the egress-only internet gateway for IPv6, a proxy or AWS Network Firewall for domain allow-lists, the private NAT gateway, and no internet at all. alternatives() in nat/demo.py prints the map.

🧒 Explain like I'm 5

Not every trip needs the main gate:

🚇 To the town library (S3, DynamoDB): a free tunnel.
🚪 To the town hall offices (other AWS services): a private side door built into your own building, with a small fee.
6️⃣ The school's new wing uses a new kind of address (IPv6) that is already unique in the whole world. No register needed — just a one-way door: out yes, strangers in no.
📋 Only certain shops allowed? Put a checker with a list of shop names in front of the gate.
🏫 To another school whose room numbers clash with yours: a private gate between the two schools, not to the street.
🔒 A room that never needs to leave? No gate at all. The cheapest, safest gate is none.

🗺️ Diagram

flowchart LR
    desks["🪑 private desks"]
    desks -->|"S3 / DynamoDB"| gwe["🚇 gateway endpoint · free"]
    desks -->|"ECR, STS, SQS…"| ife["🚪 interface endpoint · $/h/AZ + $/GB"]
    desks -->|"IPv6 out only"| eigw["6️⃣ egress-only IGW"]
    desks -->|"listed domains only"| fw["📋 proxy / Network Firewall"] --> nat["🚪 NAT gateway"]
    desks -->|"other private network"| pnat["🏫 private NAT gateway"]

🗺️ Drawn version + a lab: https://school-edh.pages.dev/nat/lesson-diagrams.html#l07

❓ What

Gateway endpoint — only for S3 and DynamoDB. A route-table entry to a prefix list. Free. Same region only.
Interface endpoint (AWS PrivateLink) — an elastic network interface with a private IP in your subnet for one service (ECR, STS, SQS, Secrets Manager, CloudWatch Logs, and many more). Charged per hour per AZ and per GB processed. With private DNS on, the service's normal name resolves to the private IP. Has security groups.
IPv6 has no NAT — IPv6 addresses are globally unique, so there is nothing to translate. For "outbound only" IPv6, route ::/0 to an egress-only internet gateway: IPv6 connections can start inside and get answers; connections starting outside are blocked.
NAT64 / DNS64 — for IPv6-only subnets that must reach IPv4-only destinations: DNS64 gives synthetic IPv6 addresses (64:ff9b::/96) and a NAT gateway translates them to IPv4.
Domain allow-lists — a NAT gateway only sees IP addresses. To allow pypi.org and nothing else, put a forward proxy or AWS Network Firewall (domain rules) in the path before the NAT.
Private NAT gateway — connectivity-type private: no Elastic IP, no internet. It translates to its private IP, for private-to-private traffic, for example between VPCs with overlapping CIDRs through a Transit Gateway.
No NAT — workloads that only use AWS services can often run with endpoints alone and no internet path at all.

🤔 Why

Because the NAT is a general-purpose gate: it costs per GB, it lets servers reach any address on the internet, and it is only for IPv4. Many trips are better served by a door that is cheaper, narrower or private. Choosing the right door is both a cost decision and a security decision.

🔧 How (in this repo)

alternatives() in nat/demo.py prints each need and its door. monthly_cost() in nat/gateway.py prices any "hours + GB" door when you pass its own hourly and per_gb. Below, an interface endpoint in 3 AZs uses hourly=0.01, per_gb=0.01 — example us-east-1 prices.

🧪 Try it

python3 nat/demo.py alternatives
python3 - <<'EOF'
import sys; sys.path.insert(0, "nat"); from gateway import monthly_cost
gb_s3, gb_ecr, gb_web = 3000, 1500, 500
print("1 all through 3 NATs              $", monthly_cost(3, gb_s3 + gb_ecr + gb_web))
print("2 S3 → free gateway endpoint      $", monthly_cost(3, gb_ecr + gb_web))
ecr = monthly_cost(3, gb_ecr, hourly=0.01, per_gb=0.01)   # example: interface endpoint in 3 AZs
print("3 + ECR → interface endpoint      $", round(monthly_cost(3, gb_web) + ecr, 2), f"(endpoint part ${ecr})")
print("4 no internet needed, no NAT      $", monthly_cost(0, 0))
EOF

✅ Verify — what you should see

alternatives prints six lines, from S3 / DynamoDB → gateway endpoint — free, just a route to nothing on the internet at all → no NAT — the cheapest and safest gate is none. Your snippet prints:

1 all through 3 NATs              $ 323.55
2 S3 → free gateway endpoint      $ 188.55
3 + ECR → interface endpoint      $ 157.95 (endpoint part $36.9)
4 no internet needed, no NAT      $ 0.0

Each door removed part of the bill. (ECR image layers are stored in S3, so in real life the S3 gateway endpoint also carries much of an image pull; the ECR API endpoints are still needed for the rest.)

🏁 What you just proved

The NAT is one door among several; picking the right door per destination cut the example bill from $323.55 to $157.95, and for a workload with no internet needs, to zero.

⚠️ Common mistakes

assuming an IPv6-enabled subnet is private because it has no NAT — if it routes ::/0 to an internet gateway, it is reachable; use an egress-only IGW
expecting a NAT gateway to block by domain name — it only sees IPs; use a proxy or Network Firewall
interface endpoints in every AZ for a service that carries 2 GB a month — the hourly charge costs more than the NAT would
trying to reach the internet through a private NAT gateway

🏭 In production

On a real account:

aws ec2 create-vpc-endpoint --vpc-id vpc-0abc --vpc-endpoint-type Gateway --service-name com.amazonaws.us-east-1.dynamodb --route-table-ids rtb-private-a rtb-private-b rtb-private-c
aws ec2 create-vpc-endpoint --vpc-id vpc-0abc --vpc-endpoint-type Interface --service-name com.amazonaws.us-east-1.ecr.dkr --subnet-ids subnet-private-a subnet-private-b subnet-private-c --security-group-ids sg-0endpoints --private-dns-enabled
aws ec2 create-egress-only-internet-gateway --vpc-id vpc-0abc
aws ec2 create-route --route-table-id rtb-private-a --destination-ipv6-cidr-block ::/0 --egress-only-internet-gateway-id eigw-0abc
aws ec2 create-nat-gateway --subnet-id subnet-transit-a --connectivity-type private

resource "aws_egress_only_internet_gateway" "v6" {
  vpc_id = aws_vpc.main.id
}

resource "aws_route" "private_v6_out" {
  route_table_id              = aws_route_table.private["a"].id
  destination_ipv6_cidr_block = "::/0"
  egress_only_gateway_id      = aws_egress_only_internet_gateway.v6.id
}

🏭 Why this matters in production: a good egress design lists every destination class and its door: AWS services through endpoints, partners through the NAT (with fixed IPs), everything else through a domain allow-list — or nothing.

⏭️ Next

The gate works. Until one day it does not: "connection reset", "cannot allocate port". Troubleshooting the gate — full registers and forgotten rows.

git checkout lesson-08-troubleshooting

← Previouscosts Next →troubleshooting

This page is the lesson's README from the lesson-07-alternatives branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.