search

AndrewGuenther / fck-nat

Feasible cost konfigurable NAT: An AWS NAT Instance AMI
https://fck-nat.dev
MIT License
1.25k stars 50 forks source link

Can I use a single fck NAT in multiple VPCs? #58

Closed vesper8 closed 8 months ago

vesper8 commented 8 months ago

I apologize if the question makes no sense.. I'm rather new at all this serverless stuff.

I'm tasked with creating multiple VPCs each hosting a few lambda functions, a cloudfront distribution and a single aurora serverless rds database. I've been asked to keep costs as low as possible which is how I found out about fck-nat (big thanks for making it).

I read somewhere that you can reuse a single NAT Gateway with multiple VPCs so I was wondering if it's possible to do the same with FCK NAT? I will have multiple VPCs as mentioned above but all of them should in fact receive very little activity and traffic so I'm not worried about the 5Gbps limitation.

Any insight would be much appreciated. Thanks!

AndrewGuenther commented 8 months ago

Yes and no. You cannot put a single instance of fck-nat (nor a NAT gateway for that matter) into multiple VPCs. You can however network multiple VPCs together and create a single "egress VPC". In this model, you'd have multiple VPCs which are peered together or use a Transit Gateway to route traffic to your egress VPC. This is a relatively advanced network configuration, so I would suggest for your use case just running one fck-nat per VPC.

A relevant blog from AWS discussing egress VPCs with Transit Gateway: https://aws.amazon.com/blogs/networking-and-content-delivery/creating-a-single-internet-exit-point-from-multiple-vpcs-using-aws-transit-gateway/

lorengordon commented 8 months ago

It may actually be possible... You can create an ENI in one VPC, and attach it to an instance whose primary ENI belongs to another VPC, and then update your route tables accordingly...

https://aws.amazon.com/about-aws/whats-new/2023/10/multi-vpc-eni-attachments/

AndrewGuenther commented 8 months ago

@lorengordon you learn something new every day! I missed that feature launch. That said, I don't think that's a feature I'm interested in supporting at this time. Going to close this one out.

lorengordon commented 8 months ago

I don't blame you! It's a cursed feature!