networking - Outgoing internet access over NAT Gateway for EC2 instances + keep incoming access on separate public ips

I'm trying to configure outgoing internet access over "NAT Gateway" for several EC2 instances, so that f.e. curl ifconfig.co returns the same ip for all instances & the outside statistics server they connect to show the same ip.

At the same time these instances must be still accessible over their public IPs (each ec2 instance has it own public ip), be accessible for ssh , serve web content & be accessible for each other on their private ips.

Instances had only eth0 interfaces with 10.0.1.0/24 subnet addresses on it (www1). I cannot see the interface for the public ip with ifconfig, but I guess it's an expected behavior for ec2 instances. They are all behind the Elastic Load Balancer.

I've created a second subnet www2 with CIDR block = 10.0.3.0/24.

I've created a NAT Gateway & assigned an Elastic ip to it & chose the subnet www2. The private ip of the NAT Gateway is shown correctly as 10.0.3.132.

I've created the network interface in EC2->Network interfaces for one of the instances with the subnet 10.0.3.0 selected + private ip auto assign + security group same as for other instances which has SSH TCP 22 0.0.0.0/0 for inbound rules & all traffic 0-65535 0.0.0.0/0 for outbound traffic.

The instance indeed got the second eth1 interface after with the correct ip=10.0.3.31 auto-assigned to it.
Here's the ip route show from that instance:

ip route show
default via 10.0.1.1 dev eth0

default via 10.0.3.1 dev eth1  metric 10001
10.0.1.0/24 dev eth0  proto kernel  scope link  src 10.0.1.69
10.0.3.0/24 dev eth1  proto kernel  scope link  src 10.0.3.31
169.254.169.254 dev eth0

Here's the ifconfig:

ifconfig
eth0      Link encap:Ethernet  HWaddr 0A:65:1C:28:80:7E

          inet addr:10.0.1.69  Bcast:10.0.1.255  Mask:255.255.255.0
          inet6 addr: fe80::865:1cff:fe28:807e/64 Scope:Link
          inet6 addr: 2600:1f18:4328:e200:4f10:db4d:6a56:d900/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:9001  Metric:1
          RX packets:10978429 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8536463 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:26095196998 (24.3 GiB)  TX bytes:2202490320 (2.0 GiB)

eth1      Link encap:Ethernet  HWaddr 0A:9D:28:92:38:0E

          inet addr:10.0.3.31  Bcast:10.0.3.255  Mask:255.255.255.0
          inet6 addr: fe80::89d:28ff:fe92:380e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:9001  Metric:1
          RX packets:262217 errors:0 dropped:0 overruns:0 frame:0
          TX packets:197708 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:237017161 (226.0 MiB)  TX bytes:50706247 (48.3 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0

          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:420172 errors:0 dropped:0 overruns:0 frame:0
          TX packets:420172 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:1399654528 (1.3 GiB)  TX bytes:1399654528 (1.3 GiB)

After that if I go to VPC dashboard->Route tables->Edit routes for the appropriate routing table for all of my instances & set "nat-06931899c65346b40" instead of igw-fd92cc9a for 0.0.0.0/0 in destination I get disconnected from the ssh session & the website hosted on the instance becomes unavailable. I guess it's expected as it is behind NAT now.

BTW it didn't look good to me that the security group of the NAT Gateway in the EC2->Network interfaces is empty, but when I try to set it to the same as the other instances (or any other at all) with "change security groups" I get "You do not have permission to access the specified resource."

So I'd like my instances to be accessible over their public ips over http & ssh, but to report the same ip with curl ifconfig.co.

The goal is not to edit the routing table on each instance manually as we prepare for auto-scaling & use the aws web console provided options.

But even if I do it manually, how exactly do I edit the routes to achieve my goal?

The general network scheme before adding the NAT Gateway was:
VPC Internet gateway <-> ELB <-> ec2 instances (with public ips accessible).

The web content from the instances is served through the ELB, but the instances themselves are available for ssh over their public ips directly.

Thanks in advance!