AWS internet gateway NAT

Domain: docs.aws.eu Shared: 2026-08-20 | Tags: aws networking til toot

I recently learned that AWS internet gateway does a one-to-one destination NAT for public IPs inside a VPC, this includes public load balancers and elastic IPs (EIPs) on EC2 instances. So for any inbound IP filtering rules I need get the private IP addresses of the resources (if filtering by destination IP).

The closest documentation I could find of this behaviour talks about this in regards to EIPs:

traffic that's destined for the public IPv4 address or Elastic IP address of your instance has its destination address translated into the instance's private IPv4 address before the traffic is delivered to the VPC.

Seems logical in hindsight but led to some fun troubleshooting.