# Patching Private Subnet Instances in a Spoke VPC Using Squid Proxy

In a typical **VPC peering setup**, instances in the **private subnet of a Spoke VPC** cannot directly access the internet. While **NAT gateways** in the **Egress (Hub) VPC** are often used to allow outbound internet access, this approach **does not work** in all scenarios due to AWS routing constraints.

To overcome this limitation, one effective solution is to **use a Squid proxy** in the Egress VPC. This article explains how to set up and use **Squid proxy** to enable patch updates for instances in a private subnet of a Spoke VPC.

## **Architecture Overview**

We have **two VPCs** in this setup:

* **Egress (Hub) VPC**: Contains both **public and private subnets**.
    
* **Spoke VPC**: Contains only a **private subnet**.
    
* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743049992859/df451d99-21c0-4bc7-9940-421bcb94c5d0.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743049964565/ec8a0e80-f493-4114-a98d-0daf201a3e74.png align="center")
    

### **Key Configurations:**

1. **VPC Peering** is established between the Hub and Spoke VPCs.
    
2. **Route tables and security groups** are updated to allow communication between the two VPCs.
    
3. **A Squid proxy** is deployed in the **public subnet of the Hub VPC** to act as a gateway for outbound internet access.
    
4. **Private subnet instances** in the Spoke VPC are configured to route traffic through the **Squid proxy** for software updates and patching.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743049885555/ffb6008d-1111-4035-aa8f-1ea897a5c2da.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743050199623/90a97bdb-74a4-44e0-a81b-952da5bf6f00.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743050229303/303cb62c-f06d-4f25-b08b-53418036769d.png align="center")

Spoke Security group

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743050322266/4ff173b5-ae7d-41e9-882f-e3dd6c64a03f.png align="center")

Hub Security group

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743050368766/2cc1cb20-1774-4cc4-ad24-e5f8cbd79143.png align="center")

Update Packages and Apply Patches in spoke Vpc. Made the changes in dnf configuration file to use the proxy

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743051106506/f27ee099-2936-43ce-92c3-f1907c3e0380.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743051186352/0118494c-55f0-4fc2-9cc4-f41555bf31f8.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743051202941/f07d1558-6c19-4fc1-b79c-5a97717faca0.png align="center")

## **Conclusion**

Using **Squid proxy in the Egress VPC** provides a cost-effective and scalable way to **patch instances in private subnets** of a Spoke VPC. This method ensures **secure outbound access** for updates while maintaining network isolation.

This solution is particularly useful in environments where **NAT gateways are not an option** for Spoke VPCs.