How to Access a Private EC2 with a Bastion Host and NAT Gateway

By Ravindra Bagale, trainer · LinkedIn · Last updated: 18 October 2026

1. The two problems

The app server sits in the private subnet 10.0.16.0/20, for example at 10.0.16.7.

1. No public IP: your laptop can't SSH to it.
2. No route to the internet: its route table has only 10.0.0.0/16 → local, so sudo yum install php -y can't reach the package repos.

The server must stay private. So we need a way in for you, and a way out for the server, without opening a way in for everyone else.

2. Idea 1: build it public, copy it as an AMI

1. Launch a server in the public subnet.
2. sudo yum install php -y works there, because it has internet.
3. Make an AMI of it (What an AMI is).
4. Launch the private app server from that AMI. It starts with PHP already installed.

Why it isn't enough: it works for the first setup only. The day php-fpm stops or you need to read a log on the private server, you still have no way to log in.

3. The bastion host (jump server)

What: a small server in the public subnet whose only job is to be the door for SSH. You SSH to it, and from it to the private server. The word comes from castles: a bastion is the strong point of the wall that faces attackers, so it is the one place you guard hardest.

1. Laptop → SSH → bastion (public IP).
2. Bastion → SSH → app server (private IP 10.0.16.7).

The private server still has no public IP. The bastion reaches it over the local route, because both are in the same VPC.

In our setup the public web server can act as the bastion. In production the bastion is a separate small server that runs nothing else.

4. SSH through the bastion without copying the key

Never copy keypair.pem onto the bastion. The bastion faces the internet; if someone breaks into it, they would take the key to every server. The key stays on your laptop.

Way 1: one command with -J (ProxyJump) (Linux, macOS, or Windows PowerShell with OpenSSH)

1. Load the key into your SSH agent: ssh-add keypair.pem. If it says it can't connect to the agent, start one first: eval "$(ssh-agent -s)" on Linux.

2. Jump in one command:

   ssh -J ec2-user@<bastion-public-ip> ec2-user@10.0.16.7
   

3. SSH connects to the bastion, and through it to 10.0.16.7. Both logins use the key from your laptop's agent.

Way 2: a shortcut in ~/.ssh/config on your laptop:

Host bastion
    HostName <bastion-public-ip>
    User ec2-user
    IdentityFile ~/keypair.pem
Host app
    HostName 10.0.16.7
    User ec2-user
    IdentityFile ~/keypair.pem
    ProxyJump bastion

Now ssh app is enough.

Way 3: hop by hand with agent forwarding

1. ssh-add keypair.pem
2. ssh -A ec2-user@<bastion-public-ip> (-A forwards your agent; nothing is copied).
3. On the bastion: ssh ec2-user@10.0.16.7.

Prefer -J: with -A, an admin of the bastion could use your agent while you are logged in. The basics of the ssh command are in Building the SSH command piece by piece.

Security groups:

1. Bastion SG: inbound SSH 22 from My IP only.
2. App server SG: inbound SSH 22 with source = bastion SG only (plus HTTP 80 from the web SG, as before).

Without SSH at all: AWS Systems Manager Session Manager opens a shell on the server from the console, with no port 22 and no bastion; it needs the SSM agent and an IAM role on the server.

5. You're in, but yum still fails

On the app server, run sudo yum install php -y. It waits and then fails with a timeout. The reason hasn't changed: the private route table has no route to the internet.

Why not download the package on the laptop and copy it? A package is not one file:

1. The program goes to /usr/bin, settings to /etc, logs to /var/log, extensions to /usr/lib64.
2. It needs other packages (dependencies), which need others again.
3. yum downloads all of them and puts each file in its place. By hand you will miss something.

What we need: the server stays private, but it can start connections out to the internet.

6. The idea: an office extension phone

Think of a desk phone in an office.

1. Your extension has no direct number. Nobody outside can dial it.
2. You can still dial out. The call leaves through the office exchange, which has one outside number.
3. The person you called answers, and the reply comes back to your desk.
4. If an outsider wants to start a call to your extension, there is no number to dial.

A NAT gateway is that exchange for private servers.

7. What a NAT gateway does

NAT = Network Address Translation.

1. You create the NAT gateway in a public subnet and give it an Elastic IP.
2. The private server sends a request to the internet. Its route table sends it to the NAT gateway.
3. The NAT gateway replaces the private source IP (10.0.16.7) with its Elastic IP and sends it out through the internet gateway.
4. The reply comes back to the Elastic IP. The NAT gateway remembers the connection and hands the reply to 10.0.16.7.
5. A connection started from the internet towards the NAT gateway is dropped. Nobody can reach the private server through it.

So the private server never needs a public IP of its own.

It is a managed service: AWS runs it and scales it; it is not an EC2 instance you look after, and it has no security group (the NACL of its subnet still applies). The do-it-yourself option is a NAT instance, an EC2 server you configure and patch yourself.

8. The route tables

1. Public route table (web, bastion, NAT gateway): 10.0.0.0/16 → local, 0.0.0.0/0 → igw-.... Unchanged.
2. Private route table (app, DB): 10.0.0.0/16 → local, and add 0.0.0.0/0 → nat-....

Worked example: the app server sends two packets.

1. To the DB at 10.0.32.10: both routes match, 10.0.0.0/16 is more specific than 0.0.0.0/0, so it stays local.
2. To a package repo on the internet: only 0.0.0.0/0 matches, so it goes to the NAT gateway.

Remember: the NAT gateway itself sits in the public subnet, because it needs the public route table to reach the internet gateway.

9. Create it in the console

Part A: the NAT gateway

1. VPC > NAT gateways > Create NAT gateway.
2. Name my-nat. Subnet: the public subnet web-a.
3. Connectivity type: Public.
4. Elastic IP allocation ID: click Allocate Elastic IP.
5. Create NAT gateway. Wait until State shows Available.

Part B: the private route

1. Route tables, select the route table of app-b and db-c (in our VPC, the main route table).
2. Routes > Edit routes > Add route: Destination 0.0.0.0/0, Target NAT Gateway my-nat. Save changes.

Part C: install on the private servers (log in through the bastion with ssh -J)

1. App server:

   sudo yum install nginx php php-fpm php-mysqlnd -y
   sudo service php-fpm start
   sudo service nginx start
   

2. DB server:

   sudo yum install mariadb105-server -y
   sudo service mariadb start
   

3. The downloads now work, and both servers still have no public IP. The setup from the previous chapter, One public server: send .php to the app server, can now be finished.

More on this design in Bastion host (jump server) and NAT gateway.

10. What it costs

1. A NAT gateway is charged per hour while it exists, and per GB of data it processes.
2. Its Elastic IP is a public IPv4 address, which is also charged by the hour.
3. After the lab: delete the NAT gateway, wait until it shows Deleted, then Elastic IPs > Release the address. Remove the 0.0.0.0/0 → NAT route too, or it shows as a blackhole.

11. High availability: two AZs

So far each tier lives in one AZ.

If that AZ has an outage, the tier in it is gone, and the whole application is down. High availability means copying the layout into a second AZ:

1. ap-south-1a: web 10.0.0.0/20, app 10.0.16.0/20, DB 10.0.32.0/20.
2. ap-south-1b: web 10.0.48.0/20, app 10.0.64.0/20, DB 10.0.80.0/20.
3. Six subnets in total, still inside 10.0.0.0/16.
4. One NAT gateway in each AZ's public subnet. Each AZ's private subnets use a private route table that points 0.0.0.0/0 to the NAT gateway in the same AZ, so one AZ failing doesn't cut the other off.

How traffic is spread across the two web servers is the job of a load balancer, in Load balancing.

12. When something goes wrong

1. ssh -J asks for a password or says "Permission denied (publickey)": the key isn't in the agent. Run ssh-add keypair.pem, check with ssh-add -l.
2. The hop to 10.0.16.7 times out: the app server's SG must allow 22 from the bastion's SG, and you must use the private IP.
3. yum still times out on the private server: the private route table has no 0.0.0.0/0 → NAT route, or the NAT gateway is in a private subnet, or it isn't Available yet.
4. The NAT gateway is in the right subnet but nothing goes out: the public subnet's route table must send 0.0.0.0/0 to the internet gateway.
5. A route shows "Blackhole": its NAT gateway was deleted. Remove the route or point it to a new NAT gateway.
6. An unexpected bill: a NAT gateway or an unattached Elastic IP left running.

13. The whole class on one page

1. A private server has two problems: no way in (no public IP) and no way out (no internet route).
2. An AMI from a public server helps once, but you still can't log in later.
3. Bastion host: a small public server you SSH through. Bastion SG: 22 from My IP. Private SG: 22 from the bastion SG.
4. Keep the key on the laptop: ssh-add keypair.pem, then ssh -J ec2-user@<bastion-public-ip> ec2-user@10.0.16.7 or ProxyJump in ~/.ssh/config. Never copy the .pem to the bastion.
5. Session Manager is the no-SSH option.
6. Packages spread files over many folders and need dependencies, so yum must download them.
7. NAT gateway: in a public subnet with an Elastic IP; private servers go out, connections from outside are dropped. AWS-managed, no security group.
8. Private route table: 0.0.0.0/0 → nat-...; public route table keeps 0.0.0.0/0 → igw-....
9. Charged per hour and per GB; delete it and release the Elastic IP after the lab.
10. High availability: the same subnets in two AZs, one NAT gateway per AZ.

14. Try at home

Recap

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.