Unable to Reach Internet from Private Ec2 with NAT Gateway

I am unable to ping google.com from my private EC2 instance in my AWS VPC.

I have a bastion set up in front of the private instance, and am connecting to it via guacamole. But once I login and run ping google.com, it hangs.

My security group inbound / outbound rules for the bastion look like:

And here are the inbound / outbound rules for the private instance:

My Network ACLs are wide open. I have a private route table that points to the Network Gateway for any destination. I also have a public route table that points to the Internet Gateway for any destination. What am I missing? Why can't I ping google from my private EC2 instance?

I accidentally associated my private subnet with my public route table. After I changed the association to the private route table with the nat gateway, it worked!