A SysOps administrator is configuring a private subnet in a VPC to host backend instances. To allow these instances to download software updates from the internet, the administrator deploys a NAT gateway in a public subnet. The administrator updates the route table of the private subnet to direct traffic to the NAT gateway. However, the backend instances are still unable to establish any connections to the internet.
Which of the following troubleshooting steps will resolve this connectivity issue?
- Verify that the route table associated with the public subnet containing the NAT gateway has a route for pointing to the Internet Gateway.Cevap
- BModify the private subnet's Network ACL (NACL) to allow outbound traffic to the NAT gateway on ports and , without adding any inbound rules for ephemeral ports.
- CUpdate the private subnet's route table to direct all traffic to a Gateway VPC Endpoint instead of the NAT gateway.
- DModify the private subnet's route table to route all internal VPC CIDR traffic () through the NAT gateway to enable central inspection.
Cevap
Verify that the route table associated with the public subnet containing the NAT gateway has a route for pointing to the Internet Gateway.
For backend instances in a private subnet to access the internet via a NAT gateway, the NAT gateway itself must reside in a public subnet. A subnet is defined as public if its associated route table contains a route targeting the Internet Gateway (typically targeting an `igw-xxxxxx` ID). If this route is missing from the public subnet's route table, the NAT gateway cannot send or receive traffic to and from the internet, resulting in timeouts for the backend instances.
Adım Adım Çözüm
Anahtar Kavram
For a NAT gateway to function, it must be deployed in a public subnet whose associated route table contains a default route () pointing to an Internet Gateway.