Outbound traffic inspection through a NAT gateway and internet gateway - AWS Prescriptive Guidance

Outbound traffic inspection through a NAT gateway and internet gateway

The following diagram shows the workflow if you need to inspect outbound traffic originating from a VPC to the internet.

Inspecting traffic from a VPC to the internet through a NAT gateway and internet gateway.

The diagram shows the following workflow:

  1. The packet from an Amazon Elastic Compute Cloud (Amazon EC2) instance in Workload spoke VPC1 in Availability Zone 1 arrives at the Transit Gateway elastic network interface in Availability Zone 1. According to the Workload spoke VPC1 route table that is associated with the source, the packet arrives at the Transit Gateway.

  2. In Transit Gateway, the spoke transit gateway route table is associated with the Workload spoke VPC1 attachment, which determines the next hop.

  3. The next hop is the Appliance VPC. The Transit Gateway determines which Transit Gateway elastic network interface to send the traffic to based on 4-tuple hash.

  4. If Transit Gateway chooses the Transit Gateway elastic network interface in Availability Zone 2, it then checks the VPC route table associated to the Transit Gateway elastic network interface subnet in Availability Zone 2 for the Appliance VPC and then sends the traffic to the Gateway Load Balancer endpoint based on the default route.

  5. The Gateway Load Balancer endpoint is logically connected to Gateway Load Balancer through AWS PrivateLink , which forwards the traffic to the firewall appliance for traffic inspection. Gateway Load Balancer creates a GENEVE tunnel between it and the firewall appliances.

  6. If the traffic is allowed then the packet is sent back to the Gateway Load Balancer and the Gateway Load Balancer endpoint in Availability Zone 1 from where it came from based on metadata attached to the payload.

  7. At the Gateway Load Balancer endpoint in Availability Zone 1, the packet checks the VPC route table to determine the next hop.

  8. The packet arrives at NAT gateway 1 and looks at the NAT gateway's route table, with the default route being the internet gateway.

  9. The packet is then sent to its destination through the internet gateway. The return traffic follows the same path but in reverse.