So its just matter of defining the routes that go outside (through nat or igw), makes sense, will try that, thanks @full-artist-27215!