Added NAT instance. Tweaking/refining ACLS and routing on public subnet