Okay.
Hello loggers and welcome to this lecture this lecture is on net instances and net gateways so net just
stands for network address translation and essentially what we want to do is enable our easy two instances
in our private subnets to still be able to go out and to download software and in order to do that they
need a way of communicating to our Internet gateway.
However what we don't want to do is make our subnets public.
We still want a degree of control so we're gonna do is create these things called Net instances and
net gateways.
Now nine times out of 10 or in the real world you'll always be using net gateways net instances are
individual easy to instances that do this or is that gateways are highly available.
They're not just one easy to instance to spread across multiple Availability Zones.
They're not dependent on a single instance net instances are completely on their way out but they are
still in the exam I still had a question on net instances literally like two weeks ago so you do need
to know the difference between a net instance and a NAT gateway and that instance is literally just
a single easy to instance a NAT gateway as a highly available gateway that allows you to get your you
know allows you to have your private subnets communicate out to the Internet without becoming public.
So what we're gonna do is gonna start with Nat instances or show you how to create one and then we're
gonna move on to NAT gateway.
I'm back in the adobe s console.
We're going to go over two services going to go too easy too.
We're gonna go ahead and launch an instance.
We're going to launch this instance into our public subnet.
We're gonna go over to community allies and in here we're going to type in gnat and hit enter.
And this will give us our net instances to go ahead and select the very first one we're gonna leave
everything else as default.
I'm gonna change the obviously the VPC over to our custom BPC and I'm going to make sure a launch this
into my public subnet and that will also give me a public IP address for this instance.
Next I'm going to add my storage I'm gonna add my tags.
I'm going to go in and give this a name.
I'm going to call it net underscore and then instance and then I'm gonna go ahead and add it to my security
group.
Can do an existing security group.
We're going to put this our web DMC security group to go ahead and hit review and launch.
It's asking me if I want a boot from general purpose SSD just going to click the second one.
I've never actually seen this before maybe it's just the ammo that I'm using but I'm gonna go ahead
and just hit launch and then I'm going to use my new key power which I got in the last one and I to
go ahead and launch that instance.
So that instance is now being launched and you can see that is launching into us e to a.
And it has a public IP address while I wait for this to come up.
I just want to show you something.
So put a link to the resources section to this page in the resources section of the course.
So explain all about net instances but essentially what we've just gone through the process of setting
up a net instance we've been using the Amazon Linux community am I.
This go all the way down it's going to tell you about disabling source and destination checks and each
easy to instance performs a source and destination check by default.
And this means that the instance must be the source or the destination of any traffic that it sends
or receives.
However a net instance must be able to send and receive traffic when the source or destination is not
itself.
Therefore you must disable source destination checks on the net instance.
So basically our net instance is acting as a gateway as acting as a gateway.
I hate using that term but it's acting as a gateway to our Internet gateway it's acting as a bridge
between our private subnets through our public subnet to our Internet gateway.
So what we need to do in all in order to make that a gateway is we need to disable our source and destination
checks.
So in order to do that let's click on our net instance you can see that is now running.
I need to go over to actions and go over to networking and in here I need to change my source and destination
check and I'm going to go ahead and disable it.
So that has now disabled it.
So now in order to get my database server to talk to my net instance what I need to do is create a route
and I need to create a route in my default route table so that our easy two instances can talk to our
net instance.
So let's go over to our VPC which is under network and content delivery then we're going to go over
to our route tables in here.
We're gonna go to our main route table for our custom VPC and go in here and in here we're going to
go in and add our roots go and edit your route and go and add a route and we're basically going to say
if we want to go out to the Internet.
So you want 0 0 0 0 forward slash 0 then what are we going to do.
Well we're going to use an instance.
And what instance are we going to use we're going to use our net instance.
And so we're gonna go ahead and hit save route.
Okay.
So now that I've done that I've got a route out hopefully to the internet in my main route to table
so in my main route table was saying go over to this elastic network interface.
Let's go back over to services go back over to easy to and I want you to grab the public IP address
of your web server and then what you want to do is go ahead and SS H in using this public IP address.
So I'm just going to SS H easy to hyphen user and then add my public IP address and then using my key
and that has now SSA action can elevate my privileges to root I'm gonna clear the screen then I'm gonna
do if I type in L S I still have my private key from the last lecture that I'm gonna do exactly the
same command SS H easy to hyphen then user.
And then at and it was 10 dot oh to it.
I think it's two three five.
From memory then I'm gonna use my private key which is my PVR keyed up ppm.
Don't forget your private IP address will be completely different to mine so to make sure you're using
the right one.
And now SSA HD in again I'm going to elevate my privileges to room.
Gonna go ahead and clear the screen and now I'm gonna go and run a Yum.
UPDATE And if this works it means we've got a route out to the Internet and there ego is now using my
net instance to go in and create basically go in and do an update to the operating system for my E2
instance.
And that has now finished updating.
Now the problem with this architecture is that this is a single virtual machine.
It's a small virtual machine so it could get easily overwhelmed.
Imagine if we had thousands of easy two instances in private subnets all trying to download things at
once since all connecting through this this net instance is a massive bottleneck.
And it's just a single point of failure.
If I go in and terminate this instance it's now going ahead and terminating and that has now terminated.
If I go back over to my terminal window and if I run a let's say you install HD DVD minus yes I'm trying
to install Apache you're going to see that it's going to time out because it no longer has a route to
that net instance.
We might want to do is just go back over to our route table and remove that route because that in that
instance is now dead.
So we go over to our route tables and we click on our main route table and click on routes and you can
see here the status has turned into a black hole.
And the reason it's a black hole is because this instance no longer exists.
So let's go ahead and remove this route and go ahead and hit save.
And we're now going to go ahead and close that.
So how can we fix this how can we make it so that we have a much more available highly available and
scalable solution.
Well let's go over to Nat gateways.
We have to go ahead and create a Nat gateway.
So first of all ask us what subnet 2 We want this to be in.
Of course we're going to want this to be in our subnet that is public.
Now annoyingly the UI just gives us the subnet I.D. so other might want to do is just go back and confirm
which subnet is my public one.
So it's one dot ten dot dot 1.0 so it's ending in a second to go back over to my NAT gateway.
I'm going to go ahead and create it and in here I'm going to choose a.
So that's my public subnet in there and then it's going to I'm going to create a new elastic IP address
and that will then attach it to my NAT gateway and then I'm gonna go ahead and hit create NAT gateway
and that has now being created we are going to need to edit our route tables to point to this NAT gateway.
So let's click on edit route table in here and we're going to go ahead and edit our main route table.
We're gonna give a route out to our Internet.
We're going to add our route.
We're gonna go Oh God.
Oh.
Forward slash.
Oh and in here we're gonna change the target and we're going to click NAT gateway.
And then we can see it in there.
I'm gonna go ahead and hit save route and hit close.
Now Nat gateways can take some time to be set up and click in here and you can see that the status is
pending.
Gonna pause the video while I wait for this NAT gateway to come back up and then I'm going to go back
over to my private E2 instance and then I'm going to go in and try and install my sequel.
Okay so that NAT gateway is now available.
I'm gonna go over to my private easy to instance case I'm back in here I'm just gonna clear the screen
I'm gonna go in and go Yum.
And then I'm going to type install and then my Eskew oh and then minus.
Yes.
And there we go it's now using my NAT gateway to install my sequel server.
So onto my exam tips.
Nat instances are completely out of date but they are still in the exam.
I literally just did the exam two weeks ago and I had a question on Nat instances not many people use
them anymore and the reason that is there's a few issues and we'll go through those in a second.
So just remembered that instance when you create a net instance you need to disable your source and
destination check on the instance you in that instance must be in a public subnet and there must be
a route out of the private subnet to that net instance in order for this to work and the amount of traffic
that the net instance can support depends on the instant size and if your bottle necking or you need
to do is go in and increase the instant size of your net instance and you can create high availability
using auto scaling groups and multiple subnets in different Availability Zones and a script to automate
failover.
So it is definitely possible but it is a pain in the butt and net instances are always behind a security
group.
So we put our net instance into our web DMC security group Nat gateways Nat gateways are redundant inside
the availability zone there not a single easy to instance they can survive failure of the easy two instances
that power Nat gateways so they are redundant inside the availability zone.
That being said though you can only have one net instance is a sorry one NAT gateway inside one a Z
Nat gateways cannot span ACS or come to that in a second Nat gateways are definitely preferred by the
enterprise.
They start with a throughput of 5 gigabits per second and they scale currently to 45 Gigabits per second.
That will increase throughout the year.
Don't worry you'll never be quizzed on like configuration maximums inside AWB.
This isn't a VM where exam.
Just remember though that it does scale automatically.
You don't need to go in and patch the operating system for your NAT gateways you do have to do that
for unit instances your NAT gateways are not associated with any security groups.
We didn't have to go in and add it to my Web DMZ security group.
You're not gateways gonna automatically be assigned a public IP address and you just need to go in and
update your route tables for your NAT gateways and there's no need to disable your source and destination
checks for your NAT gateway.
And then finally with Nat gateways just remember if you have resources in multiple Availability Zones
and they share one NAT gateway in the event that the Nat gateways availability zone is down then your
resources in the availability zones and the other Availability Zones are going to lose Internet access.
So if you only have one NAT gateway in one availability zone and it is a single point of failure you
should always have a look at having multiple Nat gateways and create an availability zone independent
architecture and so you want to create a NAT gateway in each availability zone and configure your rooting
to ensure that resources use the NAT gateway in the same availability zone that they're in and we'll
talk a bit of more about that more in the high availability section of the course which is the next
section of the course.
So always try and use Nat gateways over Nat instances but do be aware that Nat instances are still going
to be tested in your exam.
So that is it for this lecture goes if you have any questions please let me know.
If not feel free to move onto the next lecture where we're going to look at network access control this.