This is the second part of our series on AWS Cloud WAN. In the first part, we explored the main components of Cloud WAN and its role in modern networks on AWS.
Introduction: one of the most common and often underestimated challenges in large AWS environments is centralized internet egress. In architectures with multiple accounts, regions, and VPCs, having a NAT Gateway in each VPC and in each Availability Zone can drive up costs and make it difficult to control and monitor outbound traffic.
In this article, we describe how AWS Cloud WAN enables consolidating internet egress into a single, scalable architecture, improving visibility, security, and cost efficiency. We present a basic egress VPC design and an advanced design that incorporates AWS Network Firewall for traffic inspection, including routing details and best practices.
The problem: without a centralized egress architecture, organizations often face two main issues: cost overruns and loss of control over outbound traffic.
Inefficient costs: in a distributed egress model, each VPC typically has its own NAT Gateway in each AZ for high availability. For example: 5 VPCs across 3 AZs each results in 15 NAT Gateways; 15 NAT Gateways multiplied by 0.045 per hour equals 0.675 per hour; approximate monthly cost 730 hours ˜ 492.75; approximate annual cost 8,760 hours ˜ 5,913. Implementing one NAT Gateway per region can reduce hourly costs, but it often shifts expenses to data processing and cross-AZ transfers that increase the total bill.
Loss of control and visibility: with multiple distributed NAT Gateways, outbound traffic is dispersed across many exit points, making it difficult to apply consistent security policies, centralize logs and threat detection, and block or inspect suspicious destinations. As the environment grows, the lack of centralized control increases operational complexity and security risks.
Architecture overview: to simplify, we assume an implementation per AZ. In the proposal, we have AWS Cloud WAN with two Core Network Edges deployed in two regions and workload VPCs attached to Dev and Prod segments. To manage centralized internet access, we create a Network Function Group called Egress. NFGs enable service insertion to route traffic to network functions such as firewalls or inspection appliances.
Traffic flow: the Prod segment can send traffic to the Egress NFG through Cloud WAN policies that propagate routes to that NFG. The Egress VPC is attached to the NFG by specifying the Core Network ID, the subnets where the attachment ENIs will be placed, and the association with the Cloud WAN route table. This way, Cloud WAN can route traffic from the Prod segment through the Egress NFG for inspection before it exits to the internet.
Simple Egress VPC design: the Egress VPC contains at least two subnets. The private subnet is the landing point for the Cloud WAN attachment and receives traffic from workloads, then forwards it to the NAT Gateway. The public subnet hosts the NAT Gateway and sends traffic to the Internet Gateway to access the internet. For return traffic, the NAT Gateway uses its route table to direct responses back to the Cloud WAN attachment in the private subnet, ensuring symmetric routing. Key components: the private subnet receives traffic from Cloud WAN; the public subnet hosts the NAT Gateway and connects to the IGW.
Deep packet inspection with AWS Network Firewall and Cloud WAN: with a small change to the Egress VPC, we can introduce traffic inspection using AWS Network Firewall, a managed service that supports stateless and stateful rules and enables features such as URL filtering and deep inspection.
To enable inspection, we add an inspection subnet where the Network Firewall endpoint lands. AWS automatically provisions an endpoint powered by Gateway Load Balancer in that subnet. After creating the endpoint, we update the route tables so that traffic passes through the inspection subnet and Network Firewall before reaching the NAT Gateway or returning to Cloud WAN. This achieves centralized visibility and control of outbound traffic.
Routing and operational best practices: although Cloud WAN facilitates traffic steering, it is still necessary to update route tables in each attached VPC, either manually or through automation. We recommend creating AWS Managed Prefix Lists with internal CIDR ranges and referencing them in route tables to reduce configuration drift. Plan performance limits: Network Firewall endpoints scale with traffic, but NAT Gateways have throughput limits per AZ of approximately 45 Gbps, so if high demand is expected, horizontal scaling must be planned.
Costs and modeling: when designing the solution, consider data processing fees. Network Firewall adds approximate processing charges of 0.065 per GB, and NAT Gateway adds its own charges for processed data. These costs should be modeled before deployment to make informed decisions between savings and control.
Lessons learned: when creating a VPC attachment to Cloud WAN, AWS provisions a Transit Gateway-type endpoint; in Network Firewall stateless rules, it is essential to explicitly set actions to forward to evaluation if you want traffic to be evaluated; automating route table updates simplifies operations; using prefix lists for CIDRs reduces errors; and measuring throughput limits and processing costs is key for scalability and budget.
Design patterns: it depends on requirements. In some cases, a single egress point without inspection is enough to save costs. In regulated or high-risk environments, it is advisable to insert an inspection layer with Network Firewall and possibly additional appliances. With Cloud WAN, both models can coexist and scale globally, allowing differentiated policies per segment.
How Q2BSTUDIO can help: at Q2BSTUDIO, we are a custom software and application development company, specializing in artificial intelligence and cybersecurity. We help design and implement optimized cloud network architectures with AWS and Azure cloud services, integrating custom software solutions, artificial intelligence, and AI for businesses. We offer business intelligence and Power BI services, AI agent implementation, and cybersecurity consulting to ensure your egress patterns meet compliance and performance policies.
Services recommended by Q2BSTUDIO: cloud architecture assessment and cost optimization; design and implementation of centralized egress VPCs and NFGs with Cloud WAN; deployment and tuning of AWS Network Firewall for deep packet inspection; custom software development for integration with logging systems and SIEM; artificial intelligence and AI solutions for traffic analysis and threat detection; business intelligence services with Power BI for executive visibility.
Conclusion: centralizing egress with AWS Cloud WAN reduces operational complexity, applies homogeneous security policies, and gains visibility into outbound traffic. Adding deep inspection with AWS Network Firewall provides control and compliance when needed. Q2BSTUDIO can accompany your organization in the design, development, and implementation of these solutions, combining expertise in custom software, custom applications, artificial intelligence, cybersecurity, and AWS and Azure cloud services to achieve a secure, scalable solution aligned with your business objectives.
Contact Q2BSTUDIO for personalized consulting and a custom project that includes cost auditing of NAT Gateways and Network Firewall, routing automation, and deployment of business intelligence solutions such as Power BI. SEO keywords included throughout the text: custom applications, custom software, artificial intelligence, cybersecurity, AWS and Azure cloud services, business intelligence services, AI for businesses, AI agents, Power BI.
