NAT Gateway
6 posts tagged NAT Gateway.
A regional NAT Gateway makes the most common NAT mistake impossible to express
The zonal NAT Gateway has a placement rule, a per-AZ route table requirement, and a single-zone dependency, and each one is a documented outage. Regional mode does not fix those bugs. It removes the configuration they live in.
Networking7 minOn-premises cannot reach a NAT Gateway through a virtual private gateway
The same design works with a Transit Gateway and does not work with a VGW. It is one sentence in the documentation, and it decides whether centralised egress for on-premises traffic is possible at all.
Networking6 minThe NAT Gateway drops idle connections after 350 seconds and sends a RST
It is not a silent timeout. The connection is actively reset, which means your application sees a connection error at a moment when nothing was wrong, and connection pools are the most common casualty.
Networking4 minYou cannot borrow a peered VPC's NAT Gateway, but the reverse works
Routing a peered VPC's egress through your NAT Gateway is unsupported edge-to-edge routing. Sending NAT Gateway traffic through a peering to a peered destination is supported, and AWS documents a Return to Sender behaviour there that surprises people.
Networking5 min"The ephemeral port range" means four different things
Network ACLs get written with 32768-65535 because that is the number everyone knows. It is nobody's actual range — it is AWS's example. A NAT Gateway uses 1024-65535, and the gap between the two is an intermittent failure that retries hide for weeks.
Networking6 minThree AWS networking limits that changed shape, not just value
A remembered quota is worse than no quota, because it feels like knowledge. Three AWS networking limits where the mechanism changed underneath the number, and the design decision each one now points at.
Networking8 min