hi there my name is Ben and I'm a cloud
support engineer here at AWS sometimes
after creating a knack gateway customers
private instances are still unable to
access the Internet
I'm gonna show you a few things to check
that could cause this
navigate to the V PC console page click
on the nat gateways link on the left
hand side select the nat gateway and
view the status information that in the
details section check to the nat
gateways an available state if the nat
gateways in the failed state there may
have been an error when it was created
since this nat gateways in an available
state let's check the route table
associated then that gateway must be in
the public subnet with a route table
that routes Internet traffic to an
Internet gateway check that your
instances are in a private subnet with a
route table associated to it which has a
route entry for Internet traffic via the
NAT gateway next ensure that you have a
loud they require protocols and ports on
the security groups for outbound traffic
to the internet also check the network
ACLs associated with the private subnets
in the public subnets and ensure that
they don't have rules that block
required inbound or outbound internet
traffic as a general recommendation you
can allow port range 1024 through 65535
for inbound the inbound rule in your
public ACL which is the NAT gateway
resides in the ACL rules for the private
subnet can be configured to allow the
ephemeral ranges as required if you've
gone through all these steps and you're
still unable to reach your destination
you may want to try to reach it from a
different instance just to ensure that
that destination is in fact responding
now let's look at what the check if you
encounter a message like NAT Gateway
creation failed again if the NAT Gateway
shows a status of failed there was an
error during creation select an ack
gateway and the reason for the failed
status can be seen in the window below
let's discuss some common reasons for
the failed status during NAT Gateway
creation this message indicates that the
VPC has no internet gateway
then at Gateway needs an Internet
gateway also known as the igw to route
traffic to the Internet to resolve this
associate an IG W to your V PC an add a
route to the Internet via the IG W this
route table needs to be associated with
a public subnet in which you wish to
create the NAT gateway
here's another message that indicates
that a IP does not exist or you may have
reached an EIP limit the NAT gayweed
needs an EIP to be associated during the
creation process check the allocation
idea of the elastic IP address to ensure
that you've entered it correctly also
ensure that you have specified the
elastic IP address that it's in the same
region in what you're creating than that
gateway you may sometimes have reached
an EIP limit and so you'll need to
contact AWS support to have this limit
increased as this message indicates the
elastic IP address that you specified is
already associated with another resource
and cannot be associated with the NAT
gateway you can check which resource is
associated with the elastic IP address
by going to the elastic ip's page in the
amazon BBC console and viewing the value
specified for the instance ID or network
interface ID if you do not require an
elastic IP address for that resource you
can disassociate it alternatively you
can allocate a new elastic IP address
for your account
here's another message that you may come
across that gateways require a network
interface with a private IP address
allocated from a subnets range if there
is no free available IP addresses you
can delete unused network interfaces or
terminate instances that are not
required keep in mind when a NAT
gateways Infeld status it is visible in
the V PC console for only a short while
usually an hour after which it's
automatically deleted if everything
checks out here and your instances are
still unable to access the Internet then
I would recommend checking out the links
under this video thanks for watching and
we wish you continued success with us
here at AWS