Skip to content
Origin Cloud Docs

Network / Task

Attach and detach an Internet Gateway

Updated · 2 min read

Attach an Internet Gateway to connect a whole VPC to the internet, check it, and detach it again to make the VPC private.

On this page4 sections

An Internet Gateway connects a whole VPC to the internet, including subnets and instances you create after attaching it. There is no per-subnet switch; you decide per subnet through route tables, Floating IPs and NAT gateways. A VPC has at most one Internet Gateway.

Before you begin

Attach an Internet Gateway

  1. Attach the gateway:

    terminal
    origin network attach-internet-gateway --vpc-urn <vpc-urn>

    The platform creates the gateway and adds two default routes through it to the VPC’s main route table: 0.0.0.0/0 and ::/0. If the VPC already has a gateway, the command returns the existing one, unless your organization is at its Internet Gateway quota, in which case it’s refused.

  2. Verify the gateway:

    terminal
    origin network get-internet-gateway --vpc-urn <vpc-urn>

  3. Check that the main route table has the default routes. Find the table with list-route-tables, then:

    terminal
    origin network get-route-table --route-table-urn <route-table-urn>

Attaching the gateway makes internet access possible; it doesn’t give it to any instance by itself. An instance also needs a Floating IP or a NAT gateway route, and its network ACL and security groups must allow the traffic. See Internet access.

Attaching a gateway also lets instances in different subnets of the VPC reach each other, because traffic between subnets goes through the VPC router that the gateway enables.

Detach an Internet Gateway

  1. Remove routes through the gateway from every route table other than the main one. Detaching is refused while another table still routes through it. For how to edit routes, see Route tables.

  2. Detach the gateway:

    terminal
    origin network detach-internet-gateway --vpc-urn <vpc-urn>

    The platform removes the main route table’s routes through the gateway for you. Detaching from a VPC with no gateway does nothing.

  3. Verify that get-internet-gateway returns no gateway for the VPC.

After detaching, nothing in the VPC reaches the internet, and instances in different subnets can no longer reach each other. A route can’t name a detached gateway. If you attach a new gateway later, the main table gets new default routes, and other tables must name the new gateway.