Module 2 of 6 β€’ Network Cards & Outbound Translation

Elastic Network Interfaces (ENI) & NAT Gateways

Explore the two building blocks that confuse most cloud newcomers: 1) What is an ENI (and why do IP addresses and Security Groups belong to the ENI instead of the server?), and 2) How does a NAT Gateway let private servers talk to the internet while blocking strangers from coming back in?

πŸͺͺ
Two Simple Analogies: An ENI is like a removable SIM card & security badgeβ€”if your phone breaks, you unplug the SIM card and plug it into a backup phone, and calls to your number immediately ring the backup phone! A NAT Gateway is like a hotel front-desk conciergeβ€”when a VIP guest in a secret room mails a package out, the concierge puts the hotel's front-desk address as the return address and only forwards expected replies back to the VIP's room.
Next: Module 3 (VPC Endpoints) β†’ ← Prev: Module 1 (VPC & Subnets)
Interactive NAT Gateway & Packet Header Rewriter
🌍 PUBLIC INTERNET πŸ“¦ External API 140.82.112.4:443 (e.g. GitHub / Stripe) Sees Src: 52.88.10.99 πŸ•΅οΈβ€β™‚οΈ Stranger / Bot 203.0.113.66 Tries unsolicited SYN to 52.88.10.99:22 🏒 VPC (10.0.0.0/16) πŸšͺ IGW igw-01 1:1 EIP Map 🌀️ Public Subnet (10.0.1.0/24) Route Table: 0.0.0.0/0 β†’ igw-01 (Has path to Internet!) πŸ›ŽοΈ AWS NAT Gateway (nat-01) Lives in Public Subnet β€’ Managed ENI Inside Private IP: 10.0.1.200 Elastic IP (Public): 52.88.10.99 πŸ”„ Active NAT Translation Rule: 10.0.2.50:54321 ⇄ 52.88.10.99:61004 Unsolicited Inbound = DROPPED πŸ“¦ LIVE PACKET HEADER INSPECTOR SRC IP: 10.0.2.50:54321 DST IP: 140.82.112.4:443 Status: Ready to send packet πŸ”’ Private Subnet (10.0.2.0/24) Route Table: 0.0.0.0/0 β†’ nat-01 (Points to NAT GW!) πŸ–₯️ Private App Server EC2 Needs outbound HTTPS for OS patches & APIs πŸͺͺ ENI (eni-priv-01) Private IP: 10.0.2.50 Public IP: NONE (Hidden from Internet) πŸ“‹ Private Subnet Route Table 10.0.0.0/16 β†’ local 0.0.0.0/0 β†’ nat-01 πŸ’‘ Notice: Private Subnet routes 0.0.0.0/0 to NAT Gateway, while Public Subnet routes to IGW!
SNAT: Rewrites Private Source IP β†’ Public Elastic IP Stateful Return: Replies allowed back via port table
Watch the "LIVE PACKET HEADER INSPECTOR" inside the diagram during simulation!