Create a NAT gateway by calling the CreateNatGateway operation - NAT Gateway - Alibaba Cloud - NAT Gateway

Createa an enhanced public NAT gateway or a VPC NAT gateway.

Operation description

Before you call this operation, note the following:

When you create a NAT gateway for the first time, a service-linked role named AliyunServiceRoleForNatgw is automatically created. A permission policy named AliyunServiceRolePolicyForNatgw is attached to this role to allow the NAT gateway to access other cloud resources. For more information, see Service-linked roles.
After an enhanced public NAT gateway is created, the system automatically adds a route entry to the VPC's route table to route traffic to the NAT gateway. This entry sets the destination CIDR block to 0.0.0.0/0 and the next hop to the NAT gateway.
The CreateNatGateway operation is asynchronous. After you send a request, the system returns a NAT gateway (public or VPC) instance ID while the creation task runs in the background. Call the DescribeNatGateways operation to query the status of the NAT gateway.
- A status of Creating indicates that the NAT gateway is being created. You can perform only query operations.
- A status of Available indicates that the NAT gateway has been created.

Creating a NAT gateway takes about 1 to 3 minutes.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The ID of the region in which to create the NAT gateway. Call the DescribeRegions operation to obtain the region ID.	cn-hangzhou
VpcId	string	Yes	The ID of the virtual private cloud (VPC) where you want to create the NAT gateway.	vpc-bp1di7uewzmtvfuq8****
Name	string	No	The name of the NAT gateway. Must be 2 to 128 characters in length, start with a letter or a Chinese character, and can contain digits, underscores (_), and hyphens (-). If you do not specify this parameter, the system automatically specifies a name for the NAT gateway.	fortest
Description	string	No	The description of the NAT gateway. The description must be 2 to 256 characters in length. It cannot start with `http://` or `https://`.	testnat
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. You can create the token, but you must make sure that the token is unique among different requests. Note If you do not specify this parameter, the system automatically uses the request ID as the client token. The request ID may be different for each request.	5A2CFF0E-5718-45B5-9D4D-70B3FF3898
Spec	string	No	Subscription-based public NAT gateways are no longer available for purchase. This parameter is deprecated.	Invalid
InstanceChargeType	string	No	The billing method of the NAT gateway. Set the value to: PostPaid (default): pay-as-you-go. For more information, see Billing of public NAT gateways and Billing of VPC NAT gateways.	PostPaid
PricingCycle	string	No	Subscription-based public NAT gateways are no longer available for purchase. This parameter is no longer used.	Invalid
Duration	string	No	Subscription-based public NAT gateways are no longer available for purchase. This parameter is deprecated.	Invalid
AutoPay	boolean	No	Subscription-based public NAT gateways are no longer available for purchase. This parameter is deprecated.	Invalid
VSwitchId	string	No	The ID of the vSwitch to which the NAT gateway belongs. When you create a NAT gateway, you must specify a vSwitch to which the NAT gateway belongs. The system then assigns a private IP address to the NAT gateway from the vSwitch. To create a NAT gateway in an existing vSwitch, make sure that the zone to which the vSwitch belongs supports NAT gateways and that the vSwitch has idle IP addresses. If you have not created a vSwitch, create a vSwitch in a zone that supports NAT gateways and then specify the vSwitch. Note Call the ListEnhancedNatGatewayAvailableZones operation to query available zones and DescribeVSwitches to query the number of idle IP addresses in a vSwitch.	vsw-bp1e3se98n9fq8hle****
NatType	string	No	The type of NAT gateway. Set the value to Enhanced, which specifies an enhanced NAT gateway.	Enhanced
InternetChargeType	string	No	The billing method of the NAT gateway. Set the value to PayByLcu, which indicates that the NAT gateway is a pay-as-you-go NAT gateway and is measured in LCUs.	PayByLcu
NetworkType	string	No	The type of the NAT gateway to be created. Valid values: internet: a public NAT gateway intranet: a VPC NAT gateway	internet
SecurityProtectionEnabled`deprecated`	boolean	No	Specifies whether to enable the firewall feature. Valid values: false (default): disables the firewall feature. Important This parameter is deprecated.	false
IcmpReplyEnabled	boolean	No	Specifies whether to enable ICMP reply. Valid values: true (default): enables ICMP reply. false: disables ICMP reply.	true
PrivateLinkEnabled	boolean	No	Specifies whether to enable PrivateLink. Valid values: true: enables PrivateLink. false (default): disables PrivateLink.	false
EipBindMode	string	No	The mode in which the EIP is associated with the NAT gateway. Valid values: MULTI_BINDED (default): the multi-EIP-to-ENI mode. NAT: the EIP-to-NAT gateway mode. This mode is compatible with IPv4 gateways. Note If the EIP is associated with the NAT gateway in EIP-to-NAT gateway mode, the EIP occupies a private IP address of the vSwitch to which the NAT gateway belongs. Make sure that the vSwitch has sufficient private IP addresses. Otherwise, the EIP fails to be associated. In EIP-to-NAT gateway mode, a NAT gateway can be associated with up to 50 EIPs.	MULTI_BINDED
Tag	array<object>	No	The tags.	MULTI_BINDED
	object	No
Key	string	No	The tag key. You can specify up to 20 tag keys. The tag key cannot be an empty string. The tag key must be 1 to 128 characters in length and cannot start with `aliyun` or `acs:`. The tag key cannot contain `http://` or `https://`.	TestKey
Value	string	No	The tag value. You can specify up to 20 tag values. The tag value can be an empty string. The tag value must be 0 to 128 characters in length and cannot start with `aliyun` or `acs:`. It cannot contain `http://` or `https://`.	TestValue
AccessMode	object	No	The access mode of the VPC NAT gateway for reverse endpoint access.	MULTI_BINDED
ModeValue	string	No	The access mode. Valid values: route tunnel Note This parameter is valid only when PrivateLinkEnabled is set to true.	route
TunnelType	string	No	The type of tunnel. Valid value: geneve: Geneve. Note This parameter is valid only when the access mode is tunnel.	geneve
NatIp	string	No	The private IP address of the NAT gateway. Use an idle IP address from the CIDR block of the vSwitch to which the NAT gateway belongs. If this parameter is left empty, an IP address is randomly assigned.	192.168.0.2
Ipv4Prefix	string	No	The IP address prefix. NAT IP addresses are created from the prefix. Use a reserved CIDR block that is not allocated in the vSwitch to which the NAT gateway belongs.	192.168.0.0/28

Response elements

Element	Type	Description	Example
	object	The response body.
NatGatewayId	string	The instance ID of the NAT gateway.	ngw-112za33e4****
RequestId	string	The request ID.	2315DEB7-5E92-423A-91F7-4C1EC9AD97C3
ForwardTableIds	object
ForwardTableId	array	The DNAT list.
	string	The ID of a DNAT forward table.	ftb-11tc6xgmv****
SnatTableIds	object
SnatTableId	array	The SNAT list.
	string	The ID of an SNAT table.	stb-SnatTableIds****
FullNatTableIds	object
FullNatTableId	array	The FULLNAT list.
	string	The ID of a FULLNAT table.	fulltb-gw88z7hhlv43rmb26****

Examples

Success response

JSON format

{
  "NatGatewayId": "ngw-112za33e4****",
  "RequestId": "2315DEB7-5E92-423A-91F7-4C1EC9AD97C3",
  "ForwardTableIds": {
    "ForwardTableId": [
      "ftb-11tc6xgmv****"
    ]
  },
  "SnatTableIds": {
    "SnatTableId": [
      "stb-SnatTableIds****"
    ]
  },
  "FullNatTableIds": {
    "FullNatTableId": [
      "fulltb-gw88z7hhlv43rmb26****"
    ]
  }
}

Error codes

HTTP status code	Error code	Error message	Description
400	Forbidden.NatPayBySpec	Pay-by-specification NAT is no longer supported. Newly purchased pay-as-you-go NAT gateways only support the pay-by-CU metering method.	Pay-by-specification NAT gateways are no longer available for purchase. Set InternetChargeType to PayByLcu.
400	DependencyViolation.FullNatEntry	The specified resource of %s depends on %s, so the operation cannot be completed.
400	UnsupportedFeature.InternetChargeType	The feature of InternetChargeType is not supported.
400	InvalidVPCStatus	vpc incorrect status.
400	InvalidNatGatewayName.MalFormed	NatGateway name is not valid.
400	InvalidNatGatewayDescription.MalFormed	NatGateway description is not valid.
400	MissingParameter.BandwidthPackage	only support one BandwidthPackage be created with NatGateway.
400	OperationDenied	The user cannot allow to create natgw, please call PD to authorize
400	RouterEntryConflict.Duplicated	A route entry already exists, which CIDR is '0.0.0.0/0'
400	MissingParameter	Miss mandatory parameter.
400	QuotaExceeded.BandwidthPackageIps	The specified ipCount exceeded quota.	The number of IP addresses has reached the upper limit. Request a quota increase on the Quota Management page.
400	AllocateIpFailed	Alloc bandwidthPackage ips failed, maybe no available ip.
400	InvalidParameter.Name.Malformed	The specified Name is not valid.
400	InvalidParameter.Description.Malformed	The specified Description is not valid.
400	ZONE_NO_AVAILABLE_IP	The Zone have no available ip.
400	ParameterIllegal	ipCount,bandwidth parameter invalid
400	InvalidParameter.BandwidthPackage.n.ISP.ValueNotSupport	The specified ISP of BandwidthPackage is not valid.
400	InvalidNatGatewayId.NotFound	The NatGatewayId not exist.
400	VpcStatusError	The Vpc is creating .
400	InvalidParameter.Spec.ValueNotSupported	The specified Spec is not valid.
400	TaskConflict	The operation is too frequent, TaskConflict.	The system is unavailable. Try again later.
400	COMMODITY.INVALID_COMPONENT	The instance component is invalid.	The instance component is invalid.
400	CreateNatGateway.RouteConflict.DynamicRoute	Route conflict exists in routing table.
400	OperationUnsupported.MultiNatGateway	More than one natGateway per vpc is unsupported.
400	Forbidden.CheckEntryRuleQuota	Route entry quota rule check error.
400	OperationFailed.UnpaidBillsExist	The account has unpaid bills. Please pay your overdue bill first.	This account has unpaid orders.
400	IncorrectStatus.RouteEntry	Specified routeEntry status error.
400	OperationFailed.RiskControl	Risk control check failed.	The error message returned because your payment method has security risks. Click the link for verification in your email or console message and submit your order after verification.
400	OperationFailed.TokenVerfiy	Token verify failed.
400	IllegalParam.Name	The specified Name is invalid, shorter than 2 characters.
400	OperationFailed.EnhancedQuotaExceed	Enhanced nat gateway per vpc quota is exceeded
400	NoPermission.CreateServiceLinkedRole	You are not authorized to create service linked role
400	OperationFailed.EnhancedInventoryNotEnough	Operation failed because inventory is not enough.
400	OperationFailed.VswNotBelongToVpc	Operation failed because the specified VSwitch is not bound to the same VPC with NAT gateway.	The vSwitch and NAT gateway do not belong to the same VPC.
400	OperationFailed.EnhancedUserIsUnAuthorized	Operation failed because the user is not authorized to create an enhanced NAT gateway.	Operation failed because the user is not authorized to create an enhanced NAT gateway.
400	OperationUnsupported.PrePaidPyByLcu	The operation failed because the subscription NAT gateway does not support the pay-by-LCU billing method.	The operation failed because the subscription NAT gateway does not support the pay-by-LCU billing method.
400	OperationFailed.NormalInventoryNotEnough	Standard NAT gateways are no longer offered. You can create enhanced NAT gateways and set the correct natType.
400	OperationFailed.VSwitchNoAvailableIp	Operation failed because the specified vswitch does not have availabe ip.
400	UnsupportedFeature.IcmpReplyEnabled	The feature of IcmpReplyEnabled is not supported.	The value of IcmpReplyEnabled cannot be modified.
400	UnsupportedFeature.SecurityProtectionEnabled	The feature of SecurityProtectionEnabled is not supported.
400	OperationFailed.RegionConvert	Operation failed because do not find region info.
400	UnsupportedFeature.VpcNat	The feature of VpcNat is not supported.
400	InvalidVSWITCHID.NotFound	The specified resource of %s is not found.
400	Forbidden.OperateShareResource	Operate share resource is forbidden.
400	IncorrectStatus.VSWITCH	The status of VSWITCH is incorrect.
400	OperationFailed.VpcNatGatewayInventoryNotEnough	The operation is failed because of inventory is not enough.
400	OperationFailed.VpcNatGatewayCheckInventory	The operation is failed because of check inventory result is unexpected
400	ExclusiveParam.%sAnd%s	The param of %s and %s are mutually exclusive.	You cannot specify %s and %s at the same time.
400	SecurityGroupType.NotSupported	The specified security group type is not supported.	The security group is already hosted and cannot be used.
400	SecurityGroup.NotExist	The specified security group is not exist.	The security group does not exist in this VPC.
400	OperationFailed.ContainForbiddenLabel	There is a label that prohibits ordering, please contact your distributor for processing.	There is a label that prohibits ordering, please contact your distributor for processing.
400	OperationDenied.PrePaidInstance	The operation is not allowed because prepaid instance is no longer supported.	Prepaid instance is no longer supported.
400	UnsupportedFeature.Geneve	The feature of Geneve is not supported.	The feature of Geneve is not supported.
400	OperationFailed.NoAvailableResource	The Zone have no available resource.	No resources are available in the region.
400	ExclusiveParam.AccessModeValueAndAccessTunnelType	The specified param AccessModeValue and AccessTunnelType are mutually exclusive.	The specified input AccessMode.ModeValue and AccessMode.TunnelType conflict
400	ExclusiveParam.PrivateLinkModeAndAccessMode	The specified param PrivateLinkMode and AccessMode are mutually exclusive.	The specified input PrivateLinkMode conflicts with the AccessMode.
400	ExclusiveParam.PrivateLinkEnabledAndAccessMode	The specified paramPrivateLinkEnabled and AccessMode are mutually exclusive.	The specified input PrivateLinkEnabled conflicts with the AccessMode.
400	UnsupportedFeature.AccessModeValue	The feature of AccessMode.ModeValue(%s) is not supported.	This operation is not supported for the VPC NAT AccessMode.ModeValue attribute
400	IllegalParam.AccessTunnelType	The request parameter AccessMode.TunnelType is illegal.	The request parameter AccessMode.TunnelType is illegal.
400	IllegalParam.AccessModeValue	The request parameter AccessMode.ModeValue is illegal.	The request parameter AccessMode.ModeValue is illegal.
400	OperationFailed.VSwitchStatusError	The vSwitch is creating .	The vSwitch is being created.
400	UnsupportedFeature.PrivateLinkMode	The feature of %s is not supported.	The feature of reverse access is not supported.
400	OperationFailed.EcsNetworkInterfaceQuotaNotSatisfy	ECS network interface quota is not satisfy.	The ECS ENI quota does not meet the requirements.
400	OperationFailed.NoNameAuthentication	You have not passed the real name authentication and do not meet the purchase conditions. Please log in to the user center for real-name authentication.	You have not passed the real name authentication and do not meet the purchase conditions. Please log in to the user center for real-name authentication.
400	Mismatch.NatIpAndNatIpCidr	The %s and %s are mismatched.	The specified %s and %s do not match.
400	Mismatch.Ipv4PrefixAndNatIpCidr	The %s and %s are mismatched.
400	ResourceAlreadyExist.NatIp	The specified resource of NatIp has already exist.	Configured NatIp already exists
400	Mismatch.Ipv4PrefixAndCidrReservations	The %s and %s are mismatched.	The reserved network segments of the Ipv4Prefix and VSwitch do not match.
400	ResourceAlreadyAssociated.Ipv4Prefix	%s is already associated.	Ipv4Prefix have been allocated.
400	ResourceNotEnough.Ipv4Prefix	The resource of %s is not enough.	Insufficient Ipv4Prefix resources.
400	ResourceNotFound.Ipv4Prefix	The resource of s% is not found.	The resource Ipv4Prefix does not exist.
400	ResourceAlreadyAssociated.NatIp	The resource of %s was already associated.	NatIp resources have been allocated.
400	ResourceNotEnough.NatIp	The specified resource of NatIp is not enough.	Insufficient IP addresses in the specified CIDR block.
400	ResourceNotFound.NatIp	The specified resource of %s is not found.	The specified NatIp parameter is not found.
400	IllegalParam.Ipv4Prefix	The param of %s is illegal, must be /28 network segment.	The parameter Ipv4Prefix is invalid and must be/28 network segment.
400	IllegalParam.NatIp	The param of %s is illegal.	The parameter NatIp is illegal.
400	OperationUnsupported.EnhancedRegion	Region not support.	The current region is temporarily not supported.
400	IncorrectStatus.RouteTableStatus	The route table status is invaild. Please try again later.	The routing table status does not support this operation. Please try again later.
400	OperationUnsupported.User	The current user does not support this operation.	The current user does not support this operation.
400	OperationUnsupported.EnhancedCURegion	Operation failed because of this region not unsupported.	Operation failed due to unsupported pay-as-you-go region
400	OrderError.NoAvailablePaymentMethod	Order payment parameter is not available.	Order error. The payment type parameter is not available.
400	OrderError.BasicInfoUncompleted	Order basic parameter is not completed.	Order error, basic parameter information incomplete.
400	OperationUnsupported.Region	Operation unsupport this region parameter.	This operation does not support the region parameter
400	InvalidParameter.SingleZone	Operation failed because current user not support create single zone nat.	current user is not allowed to create a single az nat
500	OrderError.NatGateway	The Account failed to create order.
500	OperationFailed.AccessTunnelId	AccessTunnelId param do operation failed.	VPC NAT failed to generate tunnel ID. Try again later
500	OperationFailed.EnhancedCheckInventory	The NAT gateway in the current zone is not in service, or the resource inventory is insufficient.	The NAT gateway in the current zone is not in service, or the resource inventory is insufficient.
404	InvalidRegionId.NotFound	The specified RegionId does not exist in our records.
404	InvalidVpcId.NotFound	Specified value of VpcId is not found in our record.	The VPC does not exist. Check whether the specified VPC is valid.
404	InvalidZoneId.NotFound	Specified value of ZoneId is not exists.
404	VPC_ONLY_CAN_CREATE_ONE_NAT_GATEWAY	NatGateway in one vpc support only one.
404	OperationFailed.CrateEntryTimeOut	Operation failed because create custom routeEntry timeout.
404	Forbidden.CreateSpecialSpecNatGateway	You are not authorized to create special spec nat gateway.
404	UnsupportedZoneForFwNat	The zone is unsupported for FW NAT.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.