NAT Gateway:NAT Gateway FAQ

Instance configuration

SNAT configuration

DNAT configuration

EIP configuration

Cannot access the Internet through SNAT

• Check the default route to the NAT gateway:

  On the Internet NAT gateway details page, check VPC routes that point to the NAT gateway. If no route exists, add a route with destination 0.0.0.0/0 pointing to the NAT gateway.

• Verify the SNAT entry:

  • On the SNAT tab, confirm the SNAT entry status is Available.

  • Confirm the source address is within the Source CIDR Block.

• Troubleshoot non-NAT causes:

  • Cross-border access: The access link may be unstable.

  • Domain name access: Verify DNS resolution and ICP filing.

  • Access control: Check whether the remote server has an ACL or whitelist that blocks the EIP.

• Check IPv4 gateway configuration: When used with an IPv4 gateway, ensure the NAT gateway is in NAT mode and routes are correctly configured.

A new ECS instance cannot access the Internet through SNAT

An ECS instance in a newly created vSwitch cannot access the Internet through SNAT, while instances in other vSwitches can.

• Confirm the SNAT entry covers the new vSwitch's CIDR block:

  NAT Gateway does not auto-configure SNAT for new vSwitches. On the SNAT tab, check whether the Source CIDR Block of an existing entry covers the new vSwitch. If not, manually configure an SNAT entry.

• If the new vSwitch uses a custom route table, ensure it has a route with destination 0.0.0.0/0 pointing to the NAT gateway. Manually add the corresponding route entry.

An ECS instance cannot access the Internet when multiple NAT gateways exist

This occurs when the VPC has only a system route table with a single 0.0.0.0/0 route pointing to one NAT gateway. If that gateway's SNAT entry does not cover a specific vSwitch, its ECS instances cannot access the Internet.

• If you do not need multiple NAT gateways, delete the extras and add an SNAT entry covering the vSwitch CIDR block to the remaining gateway.

• To use multiple NAT gateways, follow the instructions in Deploy multiple Internet NAT gateways in the same VPC.

Failed to access an FTP server using SNAT

Possible causes:

• Active FTP mode: SNAT supports only active outbound connections, so FTP active mode cannot establish data connections. Use FTP passive mode instead.

• Multiple EIPs in the SNAT entry: The FTP control and data connections may use different EIPs, breaking the session. Enable EIP affinity to ensure the same client always uses the same EIP, or create a separate SNAT rule with a single EIP for the FTP client.

Cannot be accessed from the Internet after a DNAT entry is configured

• Check the default route to the NAT gateway:

  The DNAT target instance also needs a route to the NAT gateway for response traffic. Ensure a route with destination 0.0.0.0/0 pointing to the NAT gateway exists in the route table. Manually add the corresponding route entry.

• Verify the DNAT entry:

  • On the DNAT tab, confirm the DNAT entry status is Available.

  • Confirm the port, protocol, and destination address are correct.

• Check security groups, firewall, and service port status:

  • From another ECS instance in the same VPC, run telnet <private IP address of the ECS instance> <private port> to test connectivity.

    • If the response is unable to connect to remote host: Connection timed out, the private port is unreachable and cannot be accessed from the Internet.

    • If the response is Connected to <private IP address of the ECS instance>, the private port can be accessed.

  • If the private port is reachable, verify the security group rules allow Internet access on that port and the firewall has the port open.

• Domain name issues: If the service is accessible via EIP but not via domain name, check DNS resolution and ICP filing.

• Check IPv4 gateway configuration: When used with an IPv4 gateway, ensure the NAT gateway is in NAT mode and routes are correctly configured.

• Network interface consistency: If the ECS instance has multiple NICs, ensure inbound and outbound traffic uses the same interface. Centralized egress.

Use an IPv4 gateway with an Internet NAT gateway

Deploy the Internet NAT gateway in a public vSwitch. To give ECS instances in a private vSwitch Internet access, configure a route pointing to the Internet NAT gateway. Their Internet-bound traffic then flows to the NAT gateway, which uses its attached public IP address to reach the Internet.

Before combining the two gateways, check the EipBindMode setting of your Internet NAT gateway:

• An Internet NAT gateway created in the console uses NAT mode by default. When calling CreateNatGateway, set EipBindMode to NAT. To change the mode after creation, call ModifyNatGatewayAttribute.

• If your NAT gateway uses MULTI_BINDED mode (multi-EIP-to-ENI mode), you cannot create an IPv4 gateway—the two are incompatible.

• If an IPv4 gateway already exists and you create an Internet NAT gateway with EipBindMode=MULTI_BINDED, you cannot attach EIPs to that NAT gateway.

Configure routes for private vSwitch resources before activating the IPv4 gateway to make sure they retain Internet access after activation.

Impacts of switching an Internet NAT gateway to NAT mode

After the switch, the Internet NAT gateway can work with an IPv4 gateway. Instances with both SNAT and DNAT entries can use SNAT to access a DNAT service on the same gateway.

• Billing: The switch is free and incurs no additional fees.

• Service: Brief network interruptions (seconds) may occur during the switch. The duration depends on the number of associated EIPs.

• Configuration:

  • The public egress IP and existing configurations remain unchanged.

  • Each associated EIP consumes one private IP from the NAT gateway's vSwitch. Ensure sufficient available addresses.

  • The switch is irreversible — you cannot disable IPv4 gateway compatibility mode afterward.

Connection timeouts or slow download speeds when a client accesses an Internet service

• Monitor traffic data

  • View EIP monitoring data to check for packet loss due to bandwidth limits. If packet loss occurs, upgrade the EIP bandwidth.

  • For VPCs with many ECS instances, use NAT gateway traffic monitoring to identify the source of unusual traffic.

• Optimizing the Linux kernel

  • Cause: The Linux kernel may drop TCP connection requests when multiple Linux-based ECS instances concurrently access a Linux server through SNAT, causing timeouts.

  • Solution: You can disable either the net.ipv4.tcp_tw_recycle option on the server or the net.ipv4.tcp_timestamps option on the client.

Meaning of port allocation failures for a NAT gateway

This metric indicates TCP/UDP connections dropped because port allocation failed due to excessive concurrent connections.

Cause: Each EIP or NAT IP has a limited number of ports for SNAT. When too many sessions target the same destination with too few EIPs or NAT IPs, port allocation fails.

Solution: Add more EIPs or NAT IPs to the SNAT rule.

Sudden increase in NAT Gateway fees

NAT Gateway is billed on a pay-as-you-go basis. Higher fees usually indicate increased traffic. Troubleshoot as follows:

• Check monitoring data: In CloudMonitor, review inbound/outbound traffic and connection metrics to identify traffic peaks.

• Check billing details: Use Expenses and Costs to view hourly billing and pinpoint when fees increased.

• Enable traffic logs: Enable session logs and flow logs, then deliver them to Simple Log Service to pinpoint the traffic source.

Unsubscribing from a NAT Gateway resource plan

NAT Gateway resource plans support five-day unconditional refunds and pro-rated refunds. Refund policy for international site (alibabacloud.com).

Billing continues after a NAT gateway is deleted

Bills received after deleting a NAT gateway are caused by a billing delay. These bills cover usage before deletion. Check the usage period in your billing details to confirm.

Number of NAT gateways that can be created per account

No limit. You can create any number of NAT gateways per Alibaba Cloud account.