NAT Gateway:Access the Internet using an Internet NAT gateway

How it works

The following example shows how an ECS instance with the private IP address 192.168.1.100 accesses the Internet.

1. Route forwarding: The VPC forwards a request packet to the Internet NAT gateway based on the corresponding route entry in its route table.

2. SNAT (Source Network Address Translation): When the NAT gateway receives the packet, it translates the source IP address 192.168.1.100 to an EIP that is associated with the gateway, as defined by the SNAT rule. The gateway also records the mapping between the original five-tuple (protocol, source IP, source port, destination IP, destination port) and the translated five-tuple (protocol, EIP, public source port, destination IP, destination port).

3. Outbound to the Internet: The gateway sends the packet with the translated address to the Internet. The request originates from the EIP, not the private IP address of the ECS instance.

When the destination server on the Internet returns a response packet, the gateway uses the session mapping to restore the original private IP address and forwards the packet back to the ECS instance.

Verify network connectivity

Log on to the ECS instance and run the following commands.

# Make sure that the security group of the ECS instance allows outbound traffic to the Internet.
# Test connectivity to the Internet.
ping www.aliyun.com

# View the current egress public IP address. It should be the EIP associated with the NAT gateway.
curl ifconfig.me

How it works

The following example shows how an ECS instance with the private IP address 192.168.1.100 provides services to the Internet.

1. A client accesses the service: The destination IP address of the data packet is the EIP that is associated with the Internet NAT gateway and used to provide the service.

2. DNAT (Destination Network Address Translation): After the NAT gateway receives the packet, it translates the destination EIP to the private IP address of the ECS instance based on the DNAT rule. The gateway also records this address mapping.

3. The service is accessed: The packet with the translated address is forwarded to the destination ECS instance.

When the destination ECS instance returns a response packet, the packet is forwarded to the Internet NAT gateway according to the route. The gateway then translates the source IP address back to the EIP according to the session mapping table and sends the packet to the client on the Internet.

When only DNAT entries are configured, the source IP of packets received by the ECS instance is the public IP of the client. Therefore, when you configure inbound rules for the security group of the ECS instance, you must use the actual source IP address (the public IP).

Configure a DNAT entry

This section describes only how to configure a DNAT entry. To learn how to create a NAT gateway, associate an EIP, and configure routes, see SNAT - Access the Internet.

Best practices

• Network planning: Create a dedicated vSwitch for the Internet NAT gateway and reserve enough private IP addresses. This prevents IP exhaustion from blocking future EIP associations.

• Fine-grained control: Use vSwitch-level or ECS-level SNAT entries. Follow the principle of least privilege and grant Internet access only to the resources that require it.

Disaster recovery strategies

An Internet NAT gateway supports the following two disaster recovery modes. You can select a mode by using the Disaster Recovery parameter during creation.

EIP redundancy: Associate multiple EIPs with your SNAT entry. If one EIP becomes unavailable due to an attack or other issues, outbound traffic automatically switches to other available EIPs.

Risk prevention

• Security group configuration: An Internet NAT gateway performs address translation, but the security of backend ECS instances still relies on security groups and network ACLs. You must configure strict inbound security group rules for your ECS instances and allow traffic on only the necessary ports.

• Monitoring and alerts: Configure alert rules for key NAT gateway metrics, such as concurrent connections and inbound/outbound bandwidth, to receive timely notifications and scale resources before bottlenecks occur.

• Connection limits: If your services require a large number of connections to a single public service (such as a payment gateway), note the maximum number of concurrent connections (N × 55,000, where N is the number of EIPs configured in the SNAT entry). We recommend that you plan for a sufficient number of EIPs in advance and monitor the Failed Port Allocations metric.

• ICMP echo reply: This feature is enabled by default. When you use the ping command for detection, you receive a normal reply packet from the NAT gateway, but this does not guarantee that the backend server is running properly. For scenarios that rely on ping for fine-grained monitoring, you must disable ICMP Retrieval on the instance details page.

  • ICMP packets are forwarded to the backend server only when DNAT is configured with Any Port mapping.

  • In Custom Port mapping scenarios, ping probes will fail. You can usetelnet <EIP> <Public Port> to directly probe the mapped service port.

SNAT internet access failure

To troubleshoot this issue, follow these steps:

1. Route configuration: On the instance details page of the Internet NAT gateway, check the VPC routes that point to the NAT gateway section to confirm that a route entry points to the gateway.

2. SNAT entry configuration: On the SNAT tab of the Internet NAT gateway instance details page, confirm that the status of the SNAT entry is Available. Also confirm that the source address used to access the Internet is within the Source CIDR Block.

3. Access control: Check whether the public endpoint you are trying to access has an access control policy configured, or if the EIP associated with the instance has been added to a whitelist.

4. IPv4 gateway configuration: When used with an IPv4 gateway, ensure that the NAT gateway is in NAT mode and that the routing is configured correctly.

Slow internet access or timeouts

This issue typically has the following causes:

• Insufficient bandwidth: View monitoring data for EIPs associated with the NAT gateway and check the bandwidth usage. If the usage is close to 100%, increase the bandwidth or add more EIPs and associate them with an Internet Shared Bandwidth instance.

• Connection limit exceeded: When the number of concurrent connections to a single destination exceeds the limit, the system drops connections due to failed port allocation. View the ErrorPortAllocationCount metric in NAT gateway monitoring. If this value continuously increases, add more EIPs to the SNAT rule.

NAT gateway and private traffic

The NAT gateway itself does not determine the traffic path; it only performs address translation. The VPC route table controls whether traffic is sent to the NAT gateway and where it is routed after translation.

Billing

Internet NAT gateways incur instance fees and capacity unit (CU) fees. Associated EIPs have their own billing rules and are charged separately.

Quotas