NAT Gateway Troubleshooting: Missing Routes, NACLs, and Subnet Placement
A company has a VPC with private subnets that use a NAT gateway for outbound internet access. The NAT gateway is in a public subnet with an Elastic IP. Users report that some applications are failing to connect to external services. Network engineers confirm that the NAT gateway is in the 'available' state and the route tables have a default route (0.0.0.0/0) pointing to the NAT gateway. What is the most likely cause?
Quick Answer
The answer is a missing inbound rule for ephemeral ports in the network ACL of the public subnet. This is correct because NACLs are stateless, meaning they evaluate inbound and outbound traffic independently; while the outbound rule allows the NAT gateway to send traffic out, the return traffic from the internet arrives on a high-numbered ephemeral port, and if the inbound NACL rule does not explicitly allow that traffic, it is dropped. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of stateless versus stateful filtering and how NAT gateway traffic flows through a public subnet—a common trap is assuming the NAT gateway’s state or the route table is the issue, when in fact the problem lies in the NACL blocking return traffic. Remember the mnemonic: NAT needs NACL love both ways—outbound for the request, inbound for the reply on ephemeral ports.
⚠ Common exam trap
The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates assume the NAT gateway's availability and correct route tables guarantee connectivity, overlooking the need for explicit inbound ephemeral port rules in the public subnet's network ACL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network ACL for the public subnet is blocking inbound traffic on ephemeral ports.
The network ACL for the public subnet is blocking inbound traffic on ephemeral ports. When a private instance initiates outbound traffic through the NAT gateway, the NAT gateway sends the traffic to the internet and expects return traffic on high-numbered ephemeral ports (1024–65535). If the public subnet's network ACL blocks inbound traffic on these ports, the return traffic cannot reach the NAT gateway, causing asymmetric routing and connection failures. The NAT gateway itself is available and the route tables are correctly configured, so the issue lies in the stateful nature of security groups versus the stateless nature of network ACLs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group for the private instances is blocking outbound traffic.
Why it's wrong here
Outbound traffic is allowed by default; the issue is return traffic.
- ✓
The network ACL for the public subnet is blocking inbound traffic on ephemeral ports.
Why this is correct
NACL must allow inbound traffic from the internet on ephemeral ports (1024-65535) for return traffic.
- ✗
The NAT gateway has reached its connection limit.
Why it's wrong here
NAT gateway supports up to 55,000 simultaneous connections, unlikely cause.
- ✗
The route table for the private subnets is missing a route to the internet gateway.
Why it's wrong here
Private subnets route to NAT gateway, not internet gateway.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet. They want to provide internet access to instances in private subnets. The NAT gateway is configured with an Elastic IP. The private instances still cannot access the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT gateway. What is missing?
medium- A.The network ACL for the private subnet allows outbound traffic
- B.The private subnet route table is missing a route to the NAT gateway
- C.The security group for the instances allows outbound traffic
- ✓ D.The route table for the public subnet where the NAT gateway resides does not have a default route to an internet gateway
Why D: The private instances can't access the internet because the NAT gateway itself is in a public subnet that lacks a route to an internet gateway. The route table for the public subnet where the NAT gateway resides must have a default route (0.0.0.0/0) pointing to an internet gateway for the NAT gateway to reach the internet. Without this, the NAT gateway cannot forward traffic from the private instances to the internet. Option A is not the best answer because network ACLs are stateless and by default allow outbound traffic, but they could be misconfigured; however, the most common missing piece is the public subnet's route table. Option B is incorrect because the private subnet route table already has the default route to the NAT gateway. Option C is incorrect because security groups are stateful and automatically allow outbound traffic if inbound is allowed, so they are not blocking.
Variation 2. A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet for outbound internet access from private instances. Which TWO of the following are required for the NAT gateway to function correctly?
medium- A.The NAT gateway is deployed in a private subnet
- B.A security group attached to the NAT gateway
- ✓ C.A route in the public subnet's route table to an internet gateway
- D.A network ACL attached to the NAT gateway's subnet that allows inbound traffic from the internet
- ✓ E.An Elastic IP address assigned to the NAT gateway
Why C: A NAT gateway must be placed in a public subnet and requires an Elastic IP address (E) to enable outbound internet traffic with a source IP that can be routed back. Additionally, the public subnet where the NAT gateway resides must have a route in its route table that points to an internet gateway (C) for the NAT gateway to reach the internet. Security groups are not attached to NAT gateways (they use security groups for attached instances, but NAT gateways themselves are not security group–aware). Network ACLs control traffic at the subnet level but are not a requirement specific to NAT gateway functionality; they can be configured as needed. Deploying the NAT gateway in a private subnet (A) would prevent it from accessing the internet because private subnets do not have direct routes to an internet gateway. Therefore, only options C and E are required.
Variation 3. A company has a VPC with two subnets: a public subnet with a NAT Gateway and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a security group that allows all outbound traffic. The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely issue?
medium- A.The security group does not allow inbound traffic from the internet.
- ✓ B.The NAT Gateway is deployed in a private subnet.
- C.The network ACL on the private subnet blocks outbound traffic.
- D.The instance's DNS resolution is not configured correctly.
Why B: The NAT Gateway must be deployed in a public subnet with an Internet Gateway (IGW) attached to its route table to translate private IP addresses to the IGW's public IP. If the NAT Gateway is in a private subnet, it has no route to the internet, so traffic from the private EC2 instance reaches the NAT Gateway but cannot be forwarded to the internet. This is the most likely issue because the route table correctly points to the NAT Gateway, but the gateway itself lacks internet connectivity.
Variation 4. A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. They also have an EC2 instance in the private subnet that needs to access the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. The security group for the EC2 instance allows outbound HTTPS traffic. The network ACL for the private subnet allows inbound and outbound ephemeral ports. However, the EC2 instance cannot reach the internet. The network engineer checks the NAT Gateway and sees that it has an Elastic IP attached. The engineer also checks the route table for the public subnet and finds no route to the internet. What should the engineer do to fix the issue?
medium- A.Deploy a second NAT Gateway in the private subnet.
- ✓ B.Add a route in the public subnet route table to 0.0.0.0/0 via the internet gateway.
- C.Add a route in the private subnet route table to 0.0.0.0/0 via the internet gateway.
- D.Attach a second Elastic IP to the NAT Gateway.
Why B: The NAT Gateway resides in the public subnet, and for the NAT Gateway to forward traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway. Without that route, the NAT Gateway cannot send traffic to the internet, even though the private subnet's route points to the NAT Gateway. Options A, C, and D are incorrect: A is unnecessary because a NAT Gateway in the private subnet would not have direct internet access; C would bypass the NAT Gateway and require a route to the internet gateway directly from the private subnet, which is not the standard design; D is wrong because adding another Elastic IP does not solve the missing route issue.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.