View source for Create Custom NAT Instance in AWS VPC

== Purpose ==

Build a NAT using a Linux CentOS instance to propose internet access for private subnet in AWS VPC. 
<br>This NAT instance will be run and needed by instances in private subnet to make connections to services outside of the subnet or to the public Internet. 
<br>An example may include downloading a software package, sending backup data to an external location, or applying system updates to servers on the private subnet.

== Preparation ==

Make sure we understand for public and private subnet in AWS VPC.
<br> We already have a new instance in public subnet which will be set as NAT server. Let's call it nat-server which built by Linux CentOS 7.
<br> We already have an instance in private subnet for a test. Let's call it test-server. We can build it by Linux or Windows. Whatever, just for a test to make sure it get internet access..
<br>
<br>In this tutorial, we assume that we already have a VPC with public and private subnet. And then will set its route like below picture.

[[File:20191114_custom_nat_aws.jpg]]

== Disable Source/Dest. Check for the NAT Server ==

In '''AWS EC2 Dashboard''' &rarr; '''Select the Instance''' &rarr; '''Action''' &rarr; '''Networking''' &rarr; '''Change Source/Dest. Check''' :

<pre>
Yes. Disable.
</pre>

== Configure System == 

First, update the system :

<pre>
[root@nat-server ~]# yum update
</pre>

In /etc/sysctl.conf enable ip forwarding :

<pre>
[root@nat-server ~]# vi /etc/sysctl.conf
</pre>

Add this :

<pre>
# For NAT Server
net.ipv4.ip_forward = 1
</pre>

Reboot now for good measure :

<pre>
[root@nat-server ~]# reboot
</pre>

Test our config :

<pre>
[centos@nat-server ~]$ cat /proc/sys/net/ipv4/ip_forward
1
</pre>

== Set Iptables for Masquerade ==

Issue iptables command below. Set the subnet based on subnet that we use in our VPC.

<pre>
[root@nat-server ~]$ iptables -t nat -A POSTROUTING -o eth0 -s 172.31.2.0/24 -j MASQUERADE
</pre>

Edit the /etc/rc.local file to make masquerade will automatically enable at boot time :

<pre>
[root@nat-server ~]$ vi /etc/rc.local
</pre>

And add this iptables command at the end of the file :

<pre>
iptables -t nat -A POSTROUTING -o eth0 -s 172.31.2.0/24 -j MASQUERADE
exit 0
</pre>

Ensure the script will be executed during boot :

<pre>
[root@nat-server ~]$ chmod +x /etc/rc.d/rc.local
</pre>

== Modify the NAT Instance Security Group ==

We can modify the security for our NAT server instance as our needs. It's up to you.

== Create Custom Route to Associate the Private Subnet ==

In '''AWS VPC Dashboard''' &rarr; '''Route Tables''' &rarr; '''Create Route Table'''

<pre>
Name tag : [name the route table]
VPC : [choose the VPC]
</pre>

In '''Route Table''' which early created &rarr; '''Routes''' &rarr; '''Edit Route''' &rarr; '''Add Route''' &rarr; '''Save Routes'''

<pre>
Destination : 0.0.0.0/0
Target : Instance [choose the nat server instance]
</pre>

Still in '''Route Table''' &rarr; '''Subnet Association''' &rarr; '''Edit Subnet Association''' &rarr; '''Select the Private Subnet''' &rarr; '''Save'''

== Test from Instance Inside Private Subnet ==

Just create test-server in private subnet. Don't attach public ip there. And then test to ping Google or any server which located in internet.