9 ms·
> A new blog post shows you how to use Elastic Load Balancers and NAT Gateways for ingress and egress traffic, while avoiding the use of a public IPv4 address f
by amluto 3y ago
> A new blog post shows you how to use Elastic Load Balancers and NAT Gateways for ingress and egress traffic, while avoiding the use of a public IPv4 address for each instance that you launch.
It would be nice if this came with reasonably priced NAT gateways. The current pricing is outrageous.
- pnpnp 3y agoI completely agree. It’s odd they would announce charging for dedicated IPv4 while not having a free shared egress solution (unless I’m misunderstanding). I would expect them to reduce NAT pricing in the long run, but who knows.
- ransackdev 3y agoI think that as a business and given the fact they are now charging for a previously free service (public IPs), offering a now paid service as free would nullify the reasons for doing what they are doing. They don't owe anyone anything for free.
- inopinatus 3y agoThat doesn't follow, because the reason is that IP addresses are scarce.
- ransackdev 3y agoThat’s not anything new. They’ve been scarce for a decade and they’ve footed the bill this long so why change it now other then someone noticed the opportunity
- deleted 3y ago[deleted]
- Ensorceled 3y ago> They don't owe anyone anything for free. I always love this comments. We pay them literally hundreds of thousands a year.
- _sojh 3y agoLook I’m the last one that will bang the capitalism, consume, spend, drum, but nothing is ever free. You want a free nat box? Your managed database cluster just got a fraction of a fraction of a cent more expensive every hour. You would never get it for free even if they billed it as such. They wouldn’t be the biggest company in the world if they were in the habit of using their profits for your bills instead of the shareholder’s dividends. This is a business, not a family style steak house.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- SteveNuts 3y agoI'm shocked this isn't a feature of a VPC out of the box (shared internet bound traffic). You should only need a NAT gateway if you want the traffic to come out of a single set of external IPs that you control. Almost all of my use cases I could easily ride out to the internet through a shared pipe (apt updates and such) and don't care whatsoever what IP that exits the AWS network from, since I'm not applying firewall rules or anything.
- patmcc 3y ago>>> and don't care whatsoever what IP that exits the AWS network from You'll start to care pretty quickly if it's the same IP as a bad actor that's blocked everywhere.
- ishanjain28 3y agoSo for this, Run your apps in public subnets that are attached to IGW.
- zeroimpl 3y agoWhich then requires each app to have a public IP, priced at $44/year starting soon
- hnav 3y agoYou can stand up your own on top of a t3.micro or something if you don't care too much about HA (e.g. you just wanna be able to hit the internet when SSHed into your instances).
- whalesalad 3y ago$40/mo is outrageous? We spend thousands a month on AWS and drive most traffic thru a single NAT gateway. It's rock solid and it "just works" without any fuss. Totally worth it.
- cdchn 3y agoThere is where people usually start chiming in about how they can run a VPS at Whatever Hosting and Waffles Inc. for $4/mo.
- whalesalad 3y agoyep, and they should. aws has never really been suited to the hobbyist. does it work for that? of course. is it most cost effective? absolutely not. is it cost effective for people who need the resources? yes.
- Spivak 3y agoYes it is which is why Lightsail exists. The whole mantra of the cloud is only pay for what you need and scale down to zero.
- deleted 3y ago[deleted]
- otabdeveloper4 3y ago> is it cost effective for people who need the resources? yes. There is no possible use case in no possible universe where AWS is cost effective. Renting the same compute resources wholesale will cost you 20 times less. (Not a typo.)
- finikytou 3y agosure they became a multi billion dollar business by not being cost effective
- deleted 3y ago
- aednichols 3y agoNAT is pretty computationally intensive, this is why e.g. ISPs & mobile carriers are pushing IPv6 over CGNAT.
- NoZebra120vClip 3y agoFor example, rather than simply routing IP packets and then forgetting them, you need to statefully inspect every TCP segment and every supposedly connectionless UDP conversation, you need to maintain state for every live conversation, and you need to mitigate DOS with all those resources. At that point, you might as well be running a Layer 7 Firewall or an Intrusion Protection System.
- tptacek 3y agoUDP is connectionless precisely so you can build novel stateful protocols on it. There’s no promise in UDP that you’ll be able to statelessly monitor it.
- debugnik 3y agoWhich is why game networking libraries put a lot of emphasis on NAT traversal, forcing NATs to recognise the "connection". And why game console manufacturers tell users to just forward all incoming traffic unmanaged by the NAT to the console.
- deleted 3y ago[deleted]
- colmmacc 3y agoUDP is actually more expensive to NAT than TCP is. The reason is UDP fragmentation, which is my vote for the worst, and least forgivable, design error of TCP/IP. Instead of putting the fragmentation in L4 (like QUIC now does) and including a UDP header on every fragmented packet in a datagram, UDP only includes the header on the first packet. With fragmentation happening; firewalls, NATs, and end-hosts have to buffer and coalesce IP packets based on IP IDs, before the destination can be identified. It's a real nuisance. A lot of CGNAT "stateless" implementations can't handle this and you get very hard to debug issues when there are fragmentation and MTU mismatches.
- secondcoming 3y agoLast time we used GCP's NAT gateway it was constantly dropping SYN packets. We had to revert to using External IPs on machines that talked to the wider internet.
- brickteacup 3y agoNot to mention the absurd fact that accessing (IPv4) AWS APIs from a private subnet requires paying for either a NAT gateway or an interface endpoint (we got bitten by sending a ton of Kinesis traffic through a NAT gateway once)
- profmonocle 3y agoThis is one thing Google Cloud does well - traffic to Google services bypasses NAT gateway, even over IPv4. I was curious how they do this, so I set up a service on Google Cloud Run that just echo'd the user's public IP address. When curl'd over IPv4, it said I was coming from a unique local (i.e. private) IPv6 address. The private IPv4 address of my server was embedded in the address, along with some other random-looking bits that probably identified my VPC somehow. So they must have been doing some sort of stateless IPv4 to IPv6 translation behind the scenes. It was a clever solution that takes advantage of the fact that all of Google's API endpoints are dual-stack, even though (at the time) they didn't support IPv6 on customer VMs. The problem AWS currently has is not all of their internal endpoints are dual-stack, so even using IPv6 can't save you from cloud NAT costs when accessing AWS services.
- formercoder 3y agoOur network is completely software defined, so we just fake it to the VM and make it look like it's talking right to the service, and do all the routing via magic.
- rescbr 3y agoThe problem AWS has is the design of VPC internals. As the first hyperscaler, they gotta pay the legacy tax.
- saurik 3y agoAWS didn't start with "VPC", and people who still had access to the much-easier-to-conceptualize EC2 Classic only got forced off recently; Amazon VPC wasn't actually launched publicly until after Google Cloud.
- nodesocket 3y ago100% agree, they need to offer steep reserved instance pricing for NAT gateways. To deploy 3 NAT gateways (HA one in each availability zone) is $99/mo just for the instances.
- Hexcles 3y agoWe use https://github.com/1debit/alternat https://github.com/1debit/alternat in our EKS cluster to save the AWS tax (surcharge for NAT on top of the egress fee)
- Galanwe 3y agoYou don't have to use AWS' appliance (the NAT GW) to do NAT. You can NAT your traffic yourself from a t2.micro Linux. AWS used to maintain a AMI to do just that, nowadays you have to do it yourself, but it's honestly not much more than adding 2/3 iptables rules. I find this trade-off to be exactly the reason why AWS is so good even for small startups. You can bootstrap something quickly, though it will be a tad expensive. And if you need to down your costs later on, you start chasing the quickwins like maintaining your own NAT gateway. The same could apply for all managed services. Maintaining your own OpenVPN VS AWS VPN. Maintaining your own Postgres VS RDS. etc
- benjaminwootton 3y agoThe sweet point should be that the total cost of using the managed services should be less than doing so yourself when you account for manpower. If we have ended up at a place where it’s cheaper to run them yourself on an EC2 box then something has gone awry.
- Galanwe 3y ago"Cheaper" is not the only dimension to consider. Using managed services is also faster, more reliable, and scale better. You cannot just get that for free.
- kelnos 3y agoHow much does the NAT gateway cost? Quick search didn't turn up anything (and I don't care about this enough to spend more than a few seconds on it). You can turn a regular EC2 instance running Linux into a NAT box by giving it two network interfaces (hell, you can even do it with a single interface) and a few shell commands; I wonder if that's cheaper, even including the price of the public IPv4. Edit: I see from another post that NAT gateway costs $0.045/hr + $0.045/GB of transfer. That seems... not terrible? An a1.large on EC2 is $0.051/hr + $0.09/GB transfer to the internet (which I assume this type of box would be doing a lot of).
- storyinmemo 3y agoThe 0.045/GB of NAT transfer cost is in addition to the $0.09/GB egress costs.
- multifasciatus 3y agoJust run an Aviatrix gateway instead, same functionality, lower price
- EconomicsDense 3y ago[dead]
- belter 3y agoNAT Instances are still a thing. - https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-comparison.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-com...
- grumple 3y agoWhat kind of workloads require a lot of NAT gateway usage? I think my team's use is kind of high, with 16 TB going through NAT last month. The bill for that came to ~1300, which is higher than I'd like, but that's only about 1.5% of our AWS spend. Tbh I never really looked at the spend for NAT before, but this doesn't alarm me.