DIFFERENCE BETWEEN INTERNET GATEWAY (IGW) AND NAT GATEWAY(NAT-GW)

In AWS Virtual private cloud, IGW and NAT GW are very important AWS VPC components. It is very pertinent to understand the function of the two components so as to know where and when to deploy each of them. Here i will explain the difference between the IGW and NAT Gateway. Both VPC components are called gateways, in VPC context, they allow internet access, but have different use cases. INTERNET GATEWAY (IGW) The Internet Gateway is a VPC component that provides internet access for public subnets. Its like a bridge that connects your VPC to the internet. Your VPC has access to the internet through the IGW. It allows instances or resources in a public subnet to access the internet and also to be accessed from the internet. Example of this resource in a public subnet, is a web application hosted on a web server, which is expected to have access to the intenet or be accessed from the internet. This is exactly a two-way communication i.e inbound and outbound internet traffic. The IGW is attached to a virtual private cloud (vpc). It acts like a gate to the outside world (Internet). Its usually used by the instances/resources in the public subnet, to route traffic to the internet. Note: Instances or resources deployed in the Public subnets have a public ip, and their traffic is routed to the internet Gateway for internet access. It is not like that for resources in the private subnet. The Traffic of an instance(WEB APPLICATION) in the public subnet is: INSTANCE(WEB-APPLICATION) >>>> IGW >>>>INTERNET NAT GATEWAY AWS NAT Gateway (Network Address Translation Gateway) is a managed AWS service that allows instances/resources in a private subnet to connect to the internet while preventing the internet from initiating connections with those instances/resources. Example is a backend server typically deployed in a private subnet. Users cannot be allowed to access this backend server from the internet for strict security measures; But the server needs to have access to the internet, for updates installations. This is a typical ONE-WAY Communication that allows only outbound traffic (SERVER-TO-INTERNET), but does not allow inbound traffic (INTERNET-TO-SERVER). This is ideally used by instances or resources in the private subnet, because the instances in the private subnet do not have public IPs , also their route do not point towards the IGW. One more thing to note is that, NAT GW is used by resources in the private subnet, but the NAT GW itself is deployed in the public subnet i.e it is attached to a subnet and not vpc . The Traffic flow of an instance(BACKEND APPLICATION) in the private subnet is: INSTANCE(BACKEND-APPLICATION) >>>> NAT-GW >>>> IGW >>>> INTERNET In the next article, i will be sharing the difference between the public and private subnet.

Apr 12, 2025 - 15:26

DIFFERENCE BETWEEN INTERNET GATEWAY (IGW) AND NAT GATEWAY(NAT-GW)

In AWS Virtual private cloud, IGW and NAT GW are very important AWS VPC components.

It is very pertinent to understand the function of the two components so as to know where and when to deploy each of them.
Here i will explain the difference between the IGW and NAT Gateway.

Both VPC components are called gateways, in VPC context, they allow internet access, but have different use cases.

INTERNET GATEWAY (IGW)
The Internet Gateway is a VPC component that provides internet access for public subnets.
Its like a bridge that connects your VPC to the internet. Your VPC has access to the internet through the IGW.

It allows instances or resources in a public subnet to access the internet and also to be accessed from the internet. Example of this resource in a public subnet, is a web application hosted on a web server, which is expected to have access to the intenet or be accessed from the internet.

This is exactly a two-way communication i.e inbound and outbound internet traffic.
The IGW is attached to a virtual private cloud (vpc). It acts like a gate to the outside world (Internet).
Its usually used by the instances/resources in the public subnet, to route traffic to the internet.

Note: Instances or resources deployed in the Public subnets have a public ip, and their traffic is routed to the internet Gateway for internet access. It is not like that for resources in the private subnet.
The Traffic of an instance(WEB APPLICATION) in the public subnet is:
INSTANCE(WEB-APPLICATION) >>>> IGW >>>>INTERNET

NAT GATEWAY
AWS NAT Gateway (Network Address Translation Gateway) is a managed AWS service that allows instances/resources in a private subnet to connect to the internet while preventing the internet from initiating connections with those instances/resources.
Example is a backend server typically deployed in a private subnet. Users cannot be allowed to access this backend server from the internet for strict security measures; But the server needs to have access to the internet, for updates installations.
This is a typical ONE-WAY Communication that allows only outbound traffic (SERVER-TO-INTERNET), but does not allow inbound traffic (INTERNET-TO-SERVER).

This is ideally used by instances or resources in the private subnet, because the instances in the private subnet do not have public IPs , also their route do not point towards the IGW.
One more thing to note is that, NAT GW is used by resources in the private subnet, but the NAT GW itself is deployed in the public subnet i.e it is attached to a subnet and not vpc .

The Traffic flow of an instance(BACKEND APPLICATION) in the private subnet is:
INSTANCE(BACKEND-APPLICATION) >>>> NAT-GW >>>> IGW >>>> INTERNET

In the next article, i will be sharing the difference between the public and private subnet.