# Attach and detach an Internet Gateway

Attach an Internet Gateway to connect a whole VPC to the internet, check it, and detach it again to make the VPC private.

An Internet Gateway connects a whole VPC to the internet, including subnets and instances you create after attaching it. There is no per-subnet switch; you decide per subnet through route tables, Floating IPs and NAT gateways. A VPC has at most one Internet Gateway.

## Before you begin [#before-you-begin]

<BeforeYouBegin>

- The URN of the VPC.
- Room in your organization’s Internet Gateway quota. See [Limits](/docs/platform/reference/limits).

</BeforeYouBegin>

## Attach an Internet Gateway [#attach-an-internet-gateway]

1. Attach the gateway:

   ```sh
   origin network attach-internet-gateway --vpc-urn <vpc-urn>
   ```

   The platform creates the gateway and adds two default routes through it to the VPC’s main route table: `0.0.0.0/0` and `::/0`. If the VPC already has a gateway, the command returns the existing one, unless your organization is at its Internet Gateway quota, in which case it’s refused.

1. Verify the gateway:

   ```sh
   origin network get-internet-gateway --vpc-urn <vpc-urn>
   ```

1. Check that the main route table has the default routes. Find the table with `list-route-tables`, then:

   ```sh
   origin network get-route-table --route-table-urn <route-table-urn>
   ```

Attaching the gateway makes internet access possible; it doesn’t give it to any instance by itself. An instance also needs a Floating IP or a NAT gateway route, and its network ACL and security groups must allow the traffic. See [Internet access](/docs/network/internet-access).

Attaching a gateway also lets instances in different subnets of the VPC reach each other, because traffic between subnets goes through the VPC router that the gateway enables.

## Detach an Internet Gateway [#detach-an-internet-gateway]

1. Remove routes through the gateway from every route table other than the main one. Detaching is refused while another table still routes through it. For how to edit routes, see [Route tables](/docs/network/internet-access/route-tables).
1. Detach the gateway:

   ```sh
   origin network detach-internet-gateway --vpc-urn <vpc-urn>
   ```

   The platform removes the main route table’s routes through the gateway for you. Detaching from a VPC with no gateway does nothing.

1. Verify that `get-internet-gateway` returns no gateway for the VPC.

After detaching, nothing in the VPC reaches the internet, and instances in different subnets can no longer reach each other. A route can’t name a detached gateway. If you attach a new gateway later, the main table gets new default routes, and other tables must name the new gateway.

## Related [#related]

- [Route tables](/docs/network/internet-access/route-tables)
- [`attach-internet-gateway` reference](/docs/network/reference/cli#attach-internet-gateway)
- [`detach-internet-gateway` reference](/docs/network/reference/cli#detach-internet-gateway)