NAT

# AWS NAT Gateway Terraform 구성
resource "aws_eip" "nat" {
  domain = "vpc"
  tags = {
    Name = "nat-gateway-eip"
  }
}

resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public.id

  tags = {
    Name = "main-nat-gateway"
  }

  depends_on = [aws_internet_gateway.main]
}

# Private 서브넷 라우팅 테이블
resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main.id
  }

  tags = {
    Name = "private-route-table"
  }
}

# Private 서브넷 연결
resource "aws_route_table_association" "private" {
  subnet_id      = aws_subnet.private.id
  route_table_id = aws_route_table.private.id
}

# Elastic IP 할당
aws ec2 allocate-address --domain vpc

# NAT Gateway 생성
aws ec2 create-nat-gateway \
  --subnet-id subnet-0abc123 \
  --allocation-id eipalloc-0xyz789

# NAT Gateway 상태 확인
aws ec2 describe-nat-gateways \
  --nat-gateway-ids nat-0def456

# Private 서브넷 라우팅 테이블에 NAT 경로 추가
aws ec2 create-route \
  --route-table-id rtb-0ghi789 \
  --destination-cidr-block 0.0.0.0/0 \
  --nat-gateway-id nat-0def456

# NAT Gateway 대역폭 모니터링
aws cloudwatch get-metric-statistics \
  --namespace AWS/NATGateway \
  --metric-name BytesOutToDestination \
  --dimensions Name=NatGatewayId,Value=nat-0def456 \
  --start-time 2024-01-01T00:00:00Z \
  --end-time 2024-01-02T00:00:00Z \
  --period 3600 \
  --statistics Sum

# Linux에서 NAT 설정 (iptables)

# IP 포워딩 활성화
echo 1 > /proc/sys/net/ipv4/ip_forward

# 영구 설정 (sysctl.conf)
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sysctl -p

# SNAT (Masquerade) - 내부 -> 외부
iptables -t nat -A POSTROUTING \
  -s 192.168.1.0/24 \
  -o eth0 \
  -j MASQUERADE

# DNAT - 포트 포워딩 (외부 80 -> 내부 192.168.1.10:8080)
iptables -t nat -A PREROUTING \
  -i eth0 \
  -p tcp --dport 80 \
  -j DNAT --to-destination 192.168.1.10:8080

# NAT 규칙 확인
iptables -t nat -L -n -v

# 규칙 저장
iptables-save > /etc/iptables/rules.v4