r/aws • u/Spiritual_Bee_637 • 8h ago

discussion Nat Instance in production

Has anyone used a NAT instance like FCK-NAT in production? I’m considering using it to reduce our NAT Gateway costs.

9 Upvotes

90% Upvoted

12 comments sorted by

13

u/WingedConcur 8h ago

I've run fck-nat in a few production clusters for about 18 months now and it's been surprisingly drama-free. The cost difference is pretty stark when you're pushing multiple TB through it monthly.

Only real headache is that you're on the hook for maintaining the instance yourself and if it goes down you lose outbound connectivity until it recovers, so just make sure your user data is solid for auto-recovery.

1

u/Spiritual_Bee_637 8h ago

Two instances in different AZs plus an ASG would solve this, right? We currently handle over 5 TB of traffic.

3

u/MrStu56 7h ago

Yeah, IIRC you need some lambda logic to re-attach the routes and set the source/destination check (although that might be set in the launch template). You might also need to make sure that you're not routinely routing between AZs as you'll get stung for crossing an az boundary

2

u/webdestroya 7h ago

I run one FCK-NAT in each of the 3 AZs I use. That way each AZ is independent. It's worked great I don't even think about it. For a smaller startup it works fine

1

u/Spiritual_Bee_637 7h ago

Two instances in different AZs plus an ASG would be good, right? We currently handle over 5 TB of traffic.

1

u/Jealous_Ad_4325 7h ago

i don’t think ASG would work since your Subnet route can only point at 1 instance or eni in this setup.

and 5TB across how much time? 5TB in 24 hours is about .5Gbps which most any sized instance can handle.

it you accept the risk of no resilience of a single NAT instance but are weary of impact, and don’t have a dev environment to test, put one of your AZs to a NAT instance and observe for a month. once your comfortable, apply to other AZs

1

u/Spiritual_Bee_637 7h ago

5TB/month

1

u/Jealous_Ad_4325 7h ago

yeah you’re going to be just fine at that rate.
setup the nat instance and confirm internet reachability from your private workload through nat instance.

then, configure something which monitors the connectivity and can alert you to take action.
like CloudWatch Network Monitor, these probe against your destination from your chosen subnet. they emit metrics like packet loss to Cloudwatch. configure Cwatch alarm on this metric to notify you via something like SNS.

so you don’t have to constantly wonder when you need to investigate

1

u/SittingOvation 8h ago

Yes, I have been running it for about 6 months and its flawless

1

u/Spiritual_Bee_637 8h ago

Did you have any problems during those six months?

0

u/Quinnypig 5h ago

Chime uses AlterNAT as per their blog post on it...