Common Causes of Private Instances Not Reaching Internet Through NAT Gateway
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance is associated with an Elastic IP address. The route table for the private subnet has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in the public subnet and has an Elastic IP. Despite this, the instance cannot reach the internet. The security groups and NACLs are properly configured. What is the likely cause?
Quick Answer
The answer is that the NAT gateway’s Elastic IP is not associated with the NAT gateway. For a private instance to reach the internet through a NAT gateway, the NAT gateway itself must have a valid Elastic IP assigned and a route to an Internet Gateway in its public subnet’s route table. Even though the private subnet’s route table correctly points to the NAT gateway, if the NAT gateway lacks its own Elastic IP, it cannot translate private source addresses for outbound traffic, breaking connectivity. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of how NAT gateways differ from instances with public IPs—a common trap is assuming an instance’s Elastic IP bypasses the NAT gateway, but private subnet instances must always route through the NAT, which requires its own public IP. Remember the mnemonic: “NAT needs its own IP to translate—don’t let an instance’s public IP confuse the route.”
⚠ Common exam trap
Many candidates assume that placing a NAT gateway in a subnet labeled 'public' is sufficient, but the subnet must also have a route to an internet gateway to be truly public.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NAT gateway is not in a public subnet
The instance cannot reach the internet because the NAT gateway, although placed in a subnet labeled as public, is not in a functional public subnet—the subnet's route table must include a default route (0.0.0.0/0) pointing to an internet gateway. The problem statement indicates the NAT gateway has an Elastic IP, so association is not the issue. Instead, the likely cause is that the public subnet's route table lacks this route, meaning the NAT gateway cannot communicate with the internet gateway. Option A is incorrect because the NAT gateway's Elastic IP is properly associated. Option C is incorrect because NACLs are properly configured. Option D is incorrect because the private subnet route table correctly points to the NAT gateway for 0.0.0.0/0.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NAT gateway's Elastic IP is not associated with the NAT gateway
Why it's wrong here
This is incorrect. The problem states the NAT gateway has an Elastic IP, so it is associated. The issue lies elsewhere.
- ✓
The NAT gateway is not in a public subnet
Why this is correct
This is correct. For a NAT gateway to provide internet access, it must be in a public subnet with a route to an internet gateway. If the subnet's route table does not have a 0.0.0.0/0 route pointing to an internet gateway, the NAT gateway cannot reach the internet.
- ✗
The private subnet's network ACL is blocking outbound traffic
Why it's wrong here
This is incorrect. The problem states security groups and NACLs are properly configured, so they are not blocking traffic.
- ✗
The EC2 instance does not have a route to the internet
Why it's wrong here
This is incorrect. The private subnet route table has a default route to the NAT gateway, so the instance does have a route to the internet.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance has a route to a NAT Gateway in the public subnet. However, the instance cannot reach the internet. Which step should the network engineer take to troubleshoot?
easy- A.Move the NAT Gateway to a private subnet
- B.Verify that the NAT Gateway is in the same subnet as the EC2 instance
- ✓ C.Verify that the NAT Gateway has an Elastic IP and the private subnet's route table has a route to the NAT Gateway
- D.Attach an Internet Gateway to the private subnet
Why C: For a NAT Gateway to provide internet access to instances in a private subnet, it must have an Elastic IP (EIP) attached, and the private subnet's route table must include a route pointing to the NAT Gateway as the target for 0.0.0.0/0. Option A is wrong because NAT Gateways must reside in a public subnet (with a route to an Internet Gateway) to work. Option B is wrong because the NAT Gateway must be in the same VPC but not necessarily the same subnet as the EC2 instance; it should be in a public subnet. Option D is wrong because an Internet Gateway is attached to the VPC, not to individual subnets; attaching an Internet Gateway directly to a private subnet is not a valid configuration.
Variation 2. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a NAT Gateway in the public subnet. However, the instance cannot reach the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause?
hard- ✓ A.The NAT Gateway does not have an Elastic IP address attached.
- B.The security group for the EC2 instance blocks outbound traffic.
- C.The network ACL for the private subnet blocks outbound traffic.
- D.The private subnet route table does not have a route to the internet gateway.
Why A: A NAT Gateway requires an Elastic IP address to translate private IP addresses to a public IP for internet access. Without it, outbound traffic cannot be routed to the internet. Option B is incorrect because the private subnet route table correctly has a default route pointing to the NAT Gateway. Option C is incorrect because the security group is stateful and allows return traffic; outbound traffic would only be blocked if explicitly denied. Option D is incorrect because network ACLs are stateless but the question does not indicate any blocking rules; the default NACL allows all outbound traffic.
Variation 3. A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to access the internet. The instance has a route table with a default route to a NAT gateway. However, the instance cannot reach the internet. What is the most likely cause?
easy- ✓ A.The NAT gateway is placed in a private subnet.
- B.The instance does not have a public IP address assigned.
- C.The security group attached to the instance does not allow outbound HTTPS traffic.
- D.The network ACL on the private subnet blocks outbound HTTP traffic.
Why A: The most likely cause is that the NAT gateway is placed in a private subnet (Option A). A NAT gateway must be deployed in a public subnet with an associated Internet Gateway to route traffic to the internet. If it is in a private subnet, it cannot access the internet, thus the instance in the private subnet cannot reach the internet. Option B is incorrect because an instance in a private subnet does not need a public IP address to access the internet through a NAT gateway; it uses the NAT gateway's public IP. Option C is incorrect because security groups are stateful and allow outbound traffic by default; the security group would not block HTTPS outbound unless explicitly configured. Option D is incorrect because the default network ACL allows all outbound traffic; even if modified, the question says the route table points to the NAT gateway, so the issue is the NAT gateway's placement.
Variation 4. A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has a NAT Gateway in the public subnet. The network team notices that instances in the private subnets cannot reach the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT Gateway. What could be the issue?
medium- A.The NAT Gateway does not have a route to the internet gateway
- ✓ B.The NAT Gateway is in a private subnet
- C.The VPC does not have a VPC endpoint for the software update service
- D.The security group attached to the NAT Gateway is blocking traffic
Why B: The NAT Gateway must be in a public subnet with an internet gateway route to function. Option A is wrong because the NAT Gateway itself does not have a route; the route table of the subnet where it resides needs a route to the internet gateway. Option C is wrong because security groups are for instances, not NAT Gateways. Option D is wrong because VPC endpoints are for specific AWS services, not general internet access.
Variation 5. A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has set up a NAT gateway in the public subnet. However, instances in the private subnet cannot reach the internet. What is the most likely cause?
medium- A.The NAT gateway does not have a route to the internet gateway
- B.The security group for the instances blocks outbound traffic
- C.The NAT gateway is not associated with an Elastic IP
- ✓ D.The private subnet route table does not have a route to the NAT gateway
Why D: Instances in a private subnet require a route to the NAT gateway to reach the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway as its target. Without this route, traffic from private instances sent to the internet will not be directed to the NAT gateway, and will instead remain in the VPC or be dropped. Option A is incorrect because the NAT gateway itself resides in a public subnet and uses the internet gateway via that subnet's route table; it does not require its own route to the IGW. Option B is incorrect because security groups by default allow all outbound traffic, so this is unlikely to be the issue. Option C is incorrect because not having an Elastic IP would prevent the NAT gateway from having a public IP, but the question states a NAT gateway is set up, implying it has an Elastic IP; the more fundamental issue is the missing route.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.