This scenario is simple, created a VPC (CIDR > in AWS Management Console, created 2 subnets in it.

  1. Public (CIDR >
  2. Private (CIDR >

Public route is set on Public subnet via Route-Table & Internet-Gateway. Both subnets can connect to each other logically, as these are in same VPC.

I want to allow private subnet to connect to the internet via Public subnet, hence it has public route, so any traffic from private subnet, that is not intended to public subnet, will route to the internet.

Can it be accomplished and how really? Do I need to add anything to Route-Table or NACLs or at add anything at indivisual level of instances?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 19:18

so any traffic from private subnet, that is not intended to public subnet, will route to the internet.

That is not a good idea. While it simply doesn't work - a public router should drop all packets with private IP addresses - it may open up an attack vector that you wouldn't want.

You can route private IP addresses over routers that you control (and set routes on appropriately) but you cannot expect any other router to handle them they way you like. If there are 'other' routers in the path you need to either use source and destination NAT or - preferably - encapsulate private IP packets in public IP packets (tunneling).

| improve this answer | |

You need to add a NAT gateway and point the default route to it.

| improve this answer | |
  • I'm looking for anything other than AWS NAT gateway, I mean I got to tackle it via routes, NACLs or Security Groups..is there a way? – user62543 Oct 10 '19 at 5:33
  • You are using private IP addresses which must be translated to public ones. Why can’t you use a NAT gateway? – Ron Trunk Oct 10 '19 at 6:00

Ip nat inside source static public ip Default route point towards isp gateway Is requied so that any private ip want to communicate with internet . It's souce translate packet with natted public ip . Hence our private subnet is hidden .

| improve this answer | |
New contributor
Sagar Uragonda is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy