NAT Gateway:Create and manage VPC NAT gateways

Create a VPC NAT gateway

1. Go to the NAT Gateway purchase page.

   • Billing Method: pay-as-you-go.

   • Region: Select the region.

   • Network and Zone: Select the VPC and vSwitch.

2. On the Confirm page, review your configuration, accept the terms of service, and click Activate Now.

3. View the created instance on the VPC NAT Gateway page.

   • The Basic Information tab shows the VPC and vSwitch of the gateway.

   • The NAT IP Address tab shows the default NAT CIDR block and NAT IP address.

     The default NAT IP address is randomly allocated from the vSwitch CIDR block. Neither the default CIDR block nor the default IP address can be deleted.

Delete a VPC NAT gateway

In the Actions column of the target VPC NAT gateway instance, click Delete.

Before deletion, remove all SNAT entries, DNAT entries, custom NAT IP addresses, and custom NAT CIDR blocks. Alternatively, force delete the instance to permanently remove the gateway and all associated resources. Proceed with caution.

Create a NAT CIDR block

1. Go to the VPC NAT Gateway page and select the region.

2. Click the gateway ID to open its details page. Click the NAT IP Address tab, and then click Create CIDR Block. The CIDR block must meet these conditions:

   • Use private CIDR blocks from RFC 1918 (such as 10.0.0.0/16, 172.16.0.0/16, or 192.168.0.0/16) with subnet masks of 16 to 32 bits. To use a public CIDR block, first add it as a user-defined CIDR block in the VPC.

   • The NAT CIDR block cannot overlap with the VPC's private CIDR block. To translate addresses within the VPC's CIDR block, create a vSwitch in that CIDR block and then create a new VPC NAT gateway in that vSwitch.

Add a NAT IP address

1. Go to the VPC NAT Gateway page and select the region.

2. Click the gateway ID to open its details page. Click the NAT IP Address tab, and then click Add NAT IP Address.

   • Select CIDR Block: Select an existing NAT CIDR block or create a new one.

   • Allocation Method: Select Randomly Allocate, or select Manually Allocate and specify an IP Address from the selected CIDR block.

Delete a NAT IP address

The default NAT IP address cannot be deleted.

In the Actions column of the target NAT IP address, click Delete. To delete multiple NAT IP addresses at once, select them and click Delete at the bottom of the list.

Delete a NAT CIDR block

The default NAT CIDR block cannot be deleted.

Click the icon next to the target NAT CIDR block. Delete all NAT IP addresses in the CIDR block before deleting it.

Create a DNAT entry

1. Go to the VPC NAT Gateway page and select the region.

2. In the Actions column of the target VPC NAT gateway instance, click DNAT, and then click Create DNAT Entry.

   • Select NAT IP Address: Select the NAT IP address for external private network access. The same NAT IP address can be shared between a DNAT port mapping entry and an SNAT entry.

   • Select Private IP Address: Select the private IP address to receive DNAT traffic. You can Select by ECS or ENI or Manually Enter the address.

   • Port Settings: Configure the DNAT mapping.

     • Any Port: Creates an IP mapping. All requests to this NAT IP address are forwarded to the target ECS instance, which can also use this NAT IP address for outbound access.

       A NAT IP address used for IP mapping cannot be shared with other DNAT or SNAT entries.

       If both a DNAT IP mapping entry and an SNAT entry exist, the ECS instance prioritizes the DNAT IP mapping NAT IP address for outbound access.

     • Specific Port: Creates a port mapping. The gateway forwards requests on a specified protocol and port of the NAT IP address to a specified port on the target ECS instance. Configure the Frontend Port (port accessed by external networks), Backend Port (port on the target ECS instance), and Protocol.

       • The port number must be within the range of 1 to 65535.

       • If the NAT IP address is already used in an SNAT entry and you need a port number greater than 1024, you must Remove Port Limits. The default SNAT port range is 1025–65535. Enabling this option may cause transient interruptions for existing SNAT connections.

   After an entry is created, you can click Edit in the Actions column of the entry to modify the NAT IP address, private IP address, and port settings.

Delete a DNAT entry

On the DNAT tab of the VPC NAT gateway details page, click Delete in the Actions column of the target DNAT entry.