How to Set Up AWS Transit Gateway with Central VPC

Select Language:

If you want EC2-VM1 in VPC2 to access the internet through VPC2’s NAT gateway via the transit gateway, there are a few routing settings you need to check and set up properly.

First, ensure the subnet where EC2-VM1 is located has a route that directs all internet-bound traffic (0.0.0.0/0) to the transit gateway. This way, when the instance tries to access an outside address like 8.8.8.8, the traffic will go through the transit gateway first.

Next, look at the route table of the transit gateway. Make sure there is a static route that directs all internet traffic (0.0.0.0/0) to the attachment with VPC2. This step ensures the traffic is sent back into VPC2, where the NAT gateway can handle it.

Then, check the route table for the subnet in VPC2 where the transit gateway has its elastic network interfaces (ENIs). This subnet should have a route that directs internet traffic (0.0.0.0/0) to the NAT gateway in the same availability zone. Keeping the traffic local to the zone saves time and avoids unnecessary cross-zone traffic.

The subnet housing the NAT gateway also needs some specific routes. It should have a route that sends all outbound traffic (0.0.0.0/0) to the internet gateway. Additionally, it should have a route for VPC2’s CIDR block (like 10.1.1.0/24) pointing back to the transit gateway. These routes make sure return traffic finds its way back to EC2-VM1.

Finally, review the network ACLs for the transit gateway subnets. It’s best to keep these rules open—both inbound and outbound—so traffic can flow freely. Make sure outbound rules allow communication with the public IP addresses and inbound rules permit traffic from the NAT gateway’s private IP address.

The most common problem in this setup is missing return routes. While traffic can leave the instance, it may not find a way back if the routing isn’t correctly configured in the NAT gateway subnet and transit gateway attachment subnet.

For more detailed guidance, you can visit AWS’s troubleshooting articles on transit gateway internet access and setting up NAT gateways, which cover these configurations thoroughly.