Another thing: EC2 instances (VMs) have a "Source/Destination IP check" which makes them ignore any packets not intended for them. If you want an instance to do NAT, you need to turn this off.

I've also got an open source terraform module for this-

https://github.com/tedivm/terraform-aws-nat