Give a private subnet internet access with a NAT gateway

A NAT gateway gives every instance in a private subnet outbound IPv4 access through one shared address. Instances behind it reach the internet as the gateway’s address and aren’t reachable from the internet. Use it for instances that only need to fetch packages or call external services, instead of giving each one a Floating IP.

A NAT gateway translates IPv4 only. It’s billed per hour, in addition to the Floating IP it uses.

Before you begin

A VPC with an Internet Gateway attached. See Attach and detach an Internet Gateway.
A public subnet for the gateway: one whose route table has a default route to the Internet Gateway. With the gateway attached, every subnet that uses the main table is public.
A private subnet for your instances, associated with a route table you created. See Route tables.
A payment method on your organization. Without one, allocating the Floating IP and creating the gateway are refused with PAYMENT_METHOD_REQUIRED.

Create the NAT gateway

Allocate a Floating IP for the gateway and leave it unassociated:
Terminal window
```
origin network allocate-floating-ip --project-urn <project-urn>
```
The address stays yours when you delete the gateway later.
Create the gateway in the public subnet:
Terminal window
```
origin network create-nat-gateway --subnet-urn <public-subnet-urn> \
  --floating-ip-urn <floating-ip-urn>
```
The command is refused if the subnet isn’t public, if the Floating IP is associated with a network interface, if the Floating IP already backs another NAT gateway, or if you’re at your NAT gateway quota.

Note the gateway’s URN:

origin network list-nat-gateways --project-urn <project-urn>

Route the private subnet through the gateway

Read the current routes of the private subnet’s route table:
Terminal window
```
origin network get-route-table --route-table-urn <route-table-urn>
```
Replace the routes with the existing local routes plus a 0.0.0.0/0 route to the gateway. The command replaces the whole list, so include every route you want to keep.
Terminal window
```
origin network update-route-table-routes \
  --route-table-urn <route-table-urn> \
  --route '10.0.0.0/16,local' \
  --route '<vpc-ipv6-cidr>,local' \
  --route '0.0.0.0/0,nat-gateway,<nat-gateway-urn>'
```
A nat-gateway route must have the destination 0.0.0.0/0. A ::/0 or narrower destination is refused.

If the subnet doesn’t use this table, associate it:

origin network associate-route-table --subnet-urn <private-subnet-urn> \
  --route-table-urn <route-table-urn>

Verify from an instance in the private subnet that it reaches the internet as the gateway’s address, for example by calling a service that shows the caller’s public address. The change applies to new connections within a few seconds.

An instance in the private subnet that has its own Floating IP keeps using that address, not the gateway’s.

Delete a NAT gateway

Remove or replace every route that names the gateway, in every route table. Deleting is refused while any route table still routes through it.

Delete the gateway:

origin network delete-nat-gateway --nat-gateway-urn <nat-gateway-urn>

Verify that list-nat-gateways no longer shows it. Release the Floating IP with release-floating-ip if you don’t need it any more; billing for it continues until you do.

A NAT gateway is never deleted with its subnet or VPC. Deleting a subnet or VPC is refused while a NAT gateway lives in it.

Give a private subnet internet access with a NAT gateway

Before you begin

Create the NAT gateway

Route the private subnet through the gateway

Delete a NAT gateway

Related