Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-hosting a NAT Gateway

awsistoohard.com

Post reply on HN
Print view View original

1–10 of 130 posts

Re: Self-hosting a NAT Gateway

#2

Post by nodesocket »

I build my own NAT instances from Debian Trixie with Packer on AWS. AWS built-in NAT Gateways use an absurdly outdated and end-of-life version of Amazon Linux and are ridiculously expensive (especially traffic).

The bash configuration is literally a few lines:

    cat  /dev/null
    net.ipv4.ip_forward=1
    EOF

    sudo sysctl --system

    sudo iptables -t nat -A POSTROUTING -o ens5 -j MASQUERADE
    sudo iptables -F FORWARD
    sudo iptables -A FORWARD -i ens5 -m state --state RELATED,ESTABLISHED -j ACCEPT
    sudo iptables -A FORWARD -o ens5 -j ACCEPT
    sudo iptables-save | sudo tee /etc/iptables/rules.v4 > /dev/null
Change ens5 with your instance network interface name. Also, VERY IMPORTANT you must set source_dest_check = false on the EC2 NAT instances.

Also, don’t assign a EIP to your EC2 NAT instances (unless you absolutely must persist a given public IP) as that counterintuitively routes through public traffic. Just use a auto-assigned public IP (no EIP).

  NAT instance with EIP
    - AWS routes it through the public AWS network infrastructure (hairpinning).
    - You get charged $0.01/GB regional data transfer, even if in the same AZ.

Re: Self-hosting a NAT Gateway

#3

Post by notTooFarGone »

It's honestly ridiculous that people now see that self hosting is stupidly cheaper and still 99.9% reliable.

No your service does not need the extra .099% availability for 100x the price...

Make your own VPN while you are at it, wireguard is basically the same config.

Re: Self-hosting a NAT Gateway

#4

Post by radicaldreamer »

notTooFarGone wrote: post #3

It's honestly ridiculous that people now see that self hosting is stupidly cheaper and still 99.9% reliable. No your service does not need the extra .099% availability for 100x the price... Make your own VPN while you are at it, wireguard is basically the same config.

A lot of this is support. If you’re self hosting, when things don’t work the way they should, the team has no one to blame. On AWS, they can always lean on aws not working the way it should as an excuse.

Re: Self-hosting a NAT Gateway

#7

Post by unquietwiki »

nodesocket wrote: post #2

I build my own NAT instances from Debian Trixie with Packer on AWS. AWS built-in NAT Gateways use an absurdly outdated and end-of-life version of Amazon Linux and are ridiculously expensive (especially traffic). The bash configuration is literally a few lines: cat /dev/null net.ipv4.ip_forward=1 EOF sudo sysctl --system sudo iptables -t nat -A POSTROUTING -o ens5 -j MASQUERADE sudo iptables -F FORWARD sudo iptables -…

Assigning an IP is ideal if you're having to whitelist traffic to/from a data center, application, or service.

Re: Self-hosting a NAT Gateway

#8

Post by unquietwiki »

heinternets wrote: post #5

Please can we do away with NAT forever. Why are we still encouraging this? It’s caused the world to do horrible kludges and continues to do so.

This shouldn't be mistaken for an anti-IPv6 post. There's also some steps you have to go through to enable IPv6 on your VPS networks, and there's still stuff like GitHub not handling IPv6. So, much as we need to migrate, we still have to support IPv4 connectivity for the foreseeable future.

Shoutout to Hacker News for having IPv6 support!

Re: Self-hosting a NAT Gateway

#9

Post by bilegeek »

heinternets wrote: post #5

Please can we do away with NAT forever. Why are we still encouraging this? It’s caused the world to do horrible kludges and continues to do so.

1.) IPv4 is still heavily favored over IPv6.

2.) Market segmentation: keeps home users from easily hosting their own services without spending $$$ on an upgraded plan.

3.) Adding on to #2, I've seen claims of providers putting IPv6 behind NAT, so don't think full IPv6 acceptance will solve this problem.

Re: Self-hosting a NAT Gateway

#10

Post by nodesocket »

unquietwiki wrote: post #7
nodesocket wrote: post #2

I build my own NAT instances from Debian Trixie with Packer on AWS. AWS built-in NAT Gateways use an absurdly outdated and end-of-life version of Amazon Linux and are ridiculously expensive (especially traffic). The bash configuration is literally a few lines: cat /dev/null net.ipv4.ip_forward=1 EOF sudo sysctl --system sudo iptables -t nat -A POSTROUTING -o ens5 -j MASQUERADE sudo iptables -F FORWARD sudo iptables -…

Assigning an IP is ideal if you're having to whitelist traffic to/from a data center, application, or service.

Sure that one’s case, though you might be able to give out a host instead of IP to others to whitelist. Then you just set a low TTL and update the DNS record.
Post reply on HN