Centralized Egress Traffic with NAT64
Publication date: June 23, 2022 (Diagram history)
This architecture shows how to centralize egress traffic to IPv4-only endpoints on the internet by forwarding all traffic to the well-known 64:ff9b::/96 prefix from all your spoke VPCs to a central egress Amazon VPC with a public NAT gateway through AWS Transit Gateway.
Centralized Egress Traffic with NAT64 architecture
The following numbered items describe the key components in this architecture:
You need to enable DNS64 in all the subnets where you want your IPv6-only workloads to communicate with IPv4-only destinations. The Amazon Route 53 Resolver looks up the DNS record for the service queried. If there is no IPv6 address associated with the destination, it synthesizes one by prepending the well-known 64:ff9b::/96 prefix to the IPv4 address in the record.
You need to route traffic for the well-known 64:ff9b::/96 prefix through the NAT gateway located in the egress Amazon VPC. As per the spoke Amazon VPC A private subnet route table, all the traffic to the 64:ff9b::/96 prefix is routed first to the TGW ENI.
In the AWS Transit Gateway route table associated to the spoke Amazon VPC attachments, you need to add a static route sending all the traffic to the 64:ff9b::/96 prefix through the egress Amazon VPC attachment.
As per the egress Amazon VPC TGW subnet route table, all the traffic to the 64:ff9b::/96 prefix is routed to the NAT gateway.
The NAT gateway recognizes that the original destination is IPv4 and translates the IPv6 packets to IPv4 by replacing the source IPv6 with its own public EIP IPv4 address, and the destination IPv6 to IPv4 by truncating the 64:ff9b::/96 prefix.
Further reading
For additional information, see the following resources:
Diagram history
To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.
| Change | Description | Date |
|---|---|---|
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Initial publication | Reference architecture diagram first published. | June 23, 2022 |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 | |
Reference architecture diagram first published. | June 23, 2022 |
Note
To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.
