Skip to content
Origin Cloud Docs

Network / Task

Give a private subnet internet access with a NAT gateway

Updated · 3 min read

Create a NAT gateway so instances without a Floating IP can reach the internet over IPv4, route a private subnet through it, and delete it again.

On this page5 sections

A NAT gateway gives every instance in a private subnet outbound IPv4 access through one shared address. Instances behind it reach the internet as the gateway’s address and aren’t reachable from the internet. Use it for instances that only need to fetch packages or call external services, instead of giving each one a Floating IP.

A NAT gateway translates IPv4 only. It’s billed per hour, in addition to the Floating IP it uses.

Before you begin

Create the NAT gateway

  1. Allocate a Floating IP for the gateway and leave it unassociated:

    terminal
    origin network allocate-floating-ip --project-urn <project-urn>

    The address stays yours when you delete the gateway later.

  2. Create the gateway in the public subnet:

    terminal
    origin network create-nat-gateway --subnet-urn <public-subnet-urn> \
  --floating-ip-urn <floating-ip-urn>

    The command is refused if the subnet isn’t public, if the Floating IP is associated with a network interface, if the Floating IP already backs another NAT gateway, or if you’re at your NAT gateway quota.

  3. Note the gateway’s URN:

    terminal
    origin network list-nat-gateways --project-urn <project-urn>

Route the private subnet through the gateway

  1. Read the current routes of the private subnet’s route table:

    terminal
    origin network get-route-table --route-table-urn <route-table-urn>

  2. Replace the routes with the existing local routes plus a 0.0.0.0/0 route to the gateway. The command replaces the whole list, so include every route you want to keep.

    terminal
    origin network update-route-table-routes \
  --route-table-urn <route-table-urn> \
  --route '10.0.0.0/16,local' \
  --route '<vpc-ipv6-cidr>,local' \
  --route '0.0.0.0/0,nat-gateway,<nat-gateway-urn>'

    A nat-gateway route must have the destination 0.0.0.0/0. A ::/0 or narrower destination is refused.

  3. If the subnet doesn’t use this table, associate it:

    terminal
    origin network associate-route-table --subnet-urn <private-subnet-urn> \
  --route-table-urn <route-table-urn>

  4. Verify from an instance in the private subnet that it reaches the internet as the gateway’s address, for example by calling a service that shows the caller’s public address. The change applies to new connections within a few seconds.

An instance in the private subnet that has its own Floating IP keeps using that address, not the gateway’s.

Delete a NAT gateway

  1. Remove or replace every route that names the gateway, in every route table. Deleting is refused while any route table still routes through it.

  2. Delete the gateway:

    terminal
    origin network delete-nat-gateway --nat-gateway-urn <nat-gateway-urn>

  3. Verify that list-nat-gateways no longer shows it. Release the Floating IP with release-floating-ip if you don’t need it any more; billing for it continues until you do.

A NAT gateway is never deleted with its subnet or VPC. Deleting a subnet or VPC is refused while a NAT gateway lives in it.