# Give a private subnet internet access with a NAT gateway

Create a NAT gateway so instances without a Floating IP can reach the internet over IPv4, route a private subnet through it, and delete it again.

A NAT gateway gives every instance in a private subnet outbound IPv4 access through one shared address. Instances behind it reach the internet as the gateway’s address and aren’t reachable from the internet. Use it for instances that only need to fetch packages or call external services, instead of giving each one a Floating IP.

A NAT gateway translates IPv4 only. It’s billed per hour, in addition to the Floating IP it uses.

## Before you begin [#before-you-begin]

<BeforeYouBegin>

- A VPC with an Internet Gateway attached. See [Attach and detach an Internet Gateway](/docs/network/internet-access/internet-gateways).
- A public subnet for the gateway: one whose route table has a default route to the Internet Gateway. With the gateway attached, every subnet that uses the main table is public.
- A private subnet for your instances, associated with a route table you created. See [Route tables](/docs/network/internet-access/route-tables).
- A verified payment method on the billing account your project is charged to. See [Add a payment method](/docs/platform/billing/payment-method). Without one, allocating the Floating IP and creating the gateway are refused with `PAYMENT_METHOD_REQUIRED`.

</BeforeYouBegin>

## Create the NAT gateway [#create-the-nat-gateway]

1. Allocate a Floating IP for the gateway and leave it unassociated:

   ```sh
   origin network allocate-floating-ip --project-urn <project-urn>
   ```

   The address stays yours when you delete the gateway later.

1. Create the gateway in the public subnet:

   ```sh
   origin network create-nat-gateway --subnet-urn <public-subnet-urn> \
     --floating-ip-urn <floating-ip-urn>
   ```

   The command is refused if the subnet isn’t public, if the Floating IP is associated with a network interface, if the Floating IP already backs another NAT gateway, or if you’re at your NAT gateway quota.

1. Note the gateway’s URN:

   ```sh
   origin network list-nat-gateways --project-urn <project-urn>
   ```

## Route the private subnet through the gateway [#route-the-private-subnet-through-the-gateway]

1. Read the current routes of the private subnet’s route table:

   ```sh
   origin network get-route-table --route-table-urn <route-table-urn>
   ```

1. Replace the routes with the existing local routes plus a `0.0.0.0/0` route to the gateway. The command replaces the whole list, so include every route you want to keep.

   ```sh
   origin network update-route-table-routes \
     --route-table-urn <route-table-urn> \
     --route '10.0.0.0/16,local' \
     --route '<vpc-ipv6-cidr>,local' \
     --route '0.0.0.0/0,nat-gateway,<nat-gateway-urn>'
   ```

   A `nat-gateway` route must have the destination `0.0.0.0/0`. A `::/0` or narrower destination is refused.

1. If the subnet doesn’t use this table, associate it:

   ```sh
   origin network associate-route-table --subnet-urn <private-subnet-urn> \
     --route-table-urn <route-table-urn>
   ```

1. Verify from an instance in the private subnet that it reaches the internet as the gateway’s address, for example by calling a service that shows the caller’s public address. The change applies to new connections within a few seconds.

An instance in the private subnet that has its own Floating IP keeps using that address, not the gateway’s.

## Delete a NAT gateway [#delete-a-nat-gateway]

1. Remove or replace every route that names the gateway, in every route table. Deleting is refused while any route table still routes through it.
1. Delete the gateway:

   ```sh
   origin network delete-nat-gateway --nat-gateway-urn <nat-gateway-urn>
   ```

1. Verify that `list-nat-gateways` no longer shows it. Release the Floating IP with [`release-floating-ip`](/docs/network/reference/cli#release-floating-ip) if you don’t need it any more; billing for it continues until you do.

A NAT gateway is never deleted with its subnet or VPC. Deleting a subnet or VPC is refused while a NAT gateway lives in it.

## Related [#related]

- [Route tables](/docs/network/internet-access/route-tables)
- [Floating IPs](/docs/network/internet-access/floating-ips)
- [`create-nat-gateway` reference](/docs/network/reference/cli#create-nat-gateway)
- [`delete-nat-gateway` reference](/docs/network/reference/cli#delete-nat-gateway)
- [Troubleshoot Network](/docs/network/troubleshooting)