All Products
Search

This Product

    NAT Gateway:ModifyForwardEntry

    Document Center

    NAT Gateway:ModifyForwardEntry

    Last Updated:Jun 19, 2026

    Modifies a specified DNAT entry.

    Operation description

    • ModifyForwardEntry is an asynchronous operation. After you send a request, the system returns a request ID, but the DNAT entry has not been modified yet. The modification task runs in the background. You can call DescribeForwardTableEntries to query the status of the DNAT entry:

      • If the DNAT entry is in the Pending state, the DNAT entry is being modified. In this state, you can only perform query operations.

      • If the DNAT entry is in the Available state, the DNAT entry is modified.

    • ModifyForwardEntry does not support concurrent modifications of a DNAT entry within the same DNAT table.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    vpc:ModifyForwardEntry

    update

    *ForwardTable

    acs:vpc:{#regionId}:{#accountId}:forwardtable/{#ForwardTableId}

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    ForwardTableId

    string

    Yes

    The ID of the DNAT table to which the DNAT entry belongs.

    ftb-8vbx8xu2lqj9qb334****
    ForwardEntryId

    string

    Yes

    The ID of the DNAT entry to be modified.

    fwd-8vbn3bc8roygjp0gy****
    ExternalIp

    string

    No

    • If you modify a DNAT entry of an Internet NAT gateway, this parameter specifies the public IP address used to provide public network access.

    • If you modify a DNAT entry of a VPC NAT gateway, this parameter specifies the NAT IP address accessed by the external network.

    116.85.XX.XX
    ExternalPort

    string

    No

    • If you modify a DNAT entry of an Internet NAT gateway, this parameter specifies the external port or port range used for port forwarding in the DNAT entry.

      • The port range must be within 1 to 65535.

      • To specify a port range, separate the start and end ports with a forward slash (/), such as 10/20.

      • If you modify both ExternalPort and InternalPort, and ExternalPort is set to a port range, InternalPort must also be set to a port range with the same number of ports. For example, if ExternalPort is set to 10/20, InternalPort must be set to 80/90.

    • If you modify a DNAT entry of a VPC NAT gateway, this parameter specifies the port accessed by the external network. Valid values: 1 to 65535.

    80
    InternalIp

    string

    No

    • If you modify a DNAT entry of an Internet NAT gateway, this parameter specifies the private IP address of the ECS instance that communicates with the Internet through the DNAT entry.

    • If you modify a DNAT entry of a VPC NAT gateway, this parameter specifies the private IP address that needs to communicate through the DNAT rule.

    10.0.0.78
    InternalPort

    string

    No

    • If you modify a DNAT entry of an Internet NAT gateway, this parameter specifies the internal port or port range used for port forwarding in the DNAT entry. Valid values: 1 to 65535.

    • If you modify a DNAT entry of a VPC NAT gateway, this parameter specifies the port of the destination ECS instance to be mapped. Valid values: 1 to 65535.

    80
    IpProtocol

    string

    No

    The protocol type. Valid values:

    • TCP: forwards TCP packets.

    • UDP: forwards UDP packets.

    • Any: forwards packets of all protocols.

    TCP
    ForwardEntryName

    string

    No

    The new name of the DNAT entry.

    The name must be 2 to 128 characters in length and must start with a letter or a Chinese character. It cannot start with http:// or https://.

    test
    RegionId

    string

    Yes

    The region ID of the NAT gateway.

    You can call DescribeRegions to query the region ID.

    cn-hangzhou
    ClientToken

    string

    No

    The client token that is used to ensure the idempotence of the request.

    You can use the client to generate the token, but you must make sure that the token is unique among different requests. The token can contain only ASCII characters.

    Note

    If you do not specify this parameter, the system automatically uses the RequestId of the API request as the ClientToken. The RequestId may be different for each API request.

    123e4567-e89b-12d3-a456-426655440000
    PortBreak

    boolean

    No

    Specifies whether to enable port breaking. Valid values:

    • true: enables port breaking.

    • false: does not enable port breaking. If a DNAT entry and an SNAT entry use the same public IP address and you want to configure a port number greater than 1024, set PortBreak to true.

    false
    DryRun

    boolean

    No

    Specifies whether to perform a dry run. Valid values:

    • true: performs a dry run without modifying the DNAT entry. The system checks the required parameters, request format, and service limits. If the request fails the dry run, an error message is returned. If the request passes the dry run, the DryRunOperation error code is returned.

    • false (default): performs a dry run and sends the request. If the request passes the dry run, an HTTP 2xx status code is returned and the DNAT entry is modified.

    false

    Response elements

    Element

    Type

    Description

    Example

    object

    The request ID.

    RequestId

    string

    The request ID.

    2315DEB7-5E92-423A-91F7-4C1EC9AD97C3

    Examples

    Success response

    JSON format

    {
  "RequestId": "2315DEB7-5E92-423A-91F7-4C1EC9AD97C3"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 UnsupportedFeature.PortSegment The feature of PortSegment is not supported.
    400 ExclusiveParam.%sAnd%s The param of %s and %s are mutually exclusive. You cannot specify %s and %s at the same time.
    400 InvalidIp.NotInNatgw The specified Ip not belong to natgateway.
    400 DuplicatedParam.InternalPort The param of %s is duplicated. Duplicate or occupied InternalPort parameter
    400 DuplicatedParam.ExternalPort The param of %s is duplicated. The DNAT public network port has been used repeatedly.
    400 OperationFailed.AnyPortConfig Operation failed because any port correspondence any protocol The operation failed. There is a conflict with another entry, any port or any protocol type.
    400 OperationUnsupported.ForwardEntry Duplicated destination ip port is unsupported. You cannot specify duplicate destination IP addresses or destination ports.
    400 IncorrectStatus.NatIp The status of %s [%s] is incorrect. The status of NatIp is incorrect.
    400 Forbidden.IpHasBeenUsedInSnat The source ip can't be used. Because it has been used in snat.
    400 IncorrectStatus.ForwardEntry The status of %s [%s] is incorrect. The DNAT entry to be deleted is in an invalid state.
    400 InvalidExternalIp.Malformed The specified ExternalIp is not a valid IP address.
    400 InvalidInternalIp.Malformed The specified InternalIp is not a valid IP address.
    400 InvalidExternalPort.Malformed The specified ExternalPort is not a valid port.
    400 InvalidInternalPort.Malformed The specified InternalPort is not a valid port.
    400 Forbidden.DestnationIpOutOfVpcCIDR The specified Destination Ip is Out of VPC CIDR.
    400 InvalidProtocal.ValueNotSupported The specified IpProtocol does not support.
    400 IncorretForwardEntryStatus Some Forward entry status blocked this operation..
    400 QuotaExceeded Forward entry quota exceeded in this route table. A route table can only have 200 custom route entries at most.
    400 ForwardEntry.Duplicated The specified ExternalIp, IpProtocol, ExternalPort,InternalIp, InternalPort is duplicated
    400 Forbidden.ExternalIp.UsedInSnatTable The specified ExternalIp is already used in SnatTable
    400 Forbidden.Already.Bounded The specified instance already bounded
    400 InvalidIp.NotFound The specified ip does not exist.
    400 InvalidParameter.Name.Malformed The specified Name is not valid.
    400 IncorretStatus.ForwardEntry The Specified forwardEntry is not stable status, can not operation
    400 IllegalParam.AnyPortNotZero Any port port must be zero. You must set the destination port and source port to 0 when IpProtocol is set to Any.
    400 Duplicated.DestinationPort The specified param DestinationPort is duplicated.
    400 InvalidForwardEntryId.NotFound Specified forward entry ID does not exist
    400 OperationUnsupported.EipInBinding Create snat entry with eip in associating status is unsupported. You cannot use an associated EIP when you create an SNAT entry.
    400 QuotaExceeded.ForwardEntrySessionManytoOne The dnat session quota is exceed. The number of DNAT sessions exceeds the upper limit.
    400 OperationFailed.ForwardEntryNotAllowSrcIpEqualDstIp The source IP of forward entry is not allowed to equal destination IP. The public IP address of the DNAT entry is not allowed to be equal to the private IP address.
    404 ResourceNotFound.NatIp The specified resource of %s is not found.
    404 ResourceNotFound.ForwardEntry The specified resource of %s is not found. The specified %s resource does not exist.
    404 InvalidRegionId.NotFound The specified RegionId does not exist in our records.
    404 InvalidForwardEntryId.NotFound Specified forward entry ID does not exist
    404 InvalidExternalIp.NotFound Specified External Ip address does not found on the VRouter
    404 InvalidForwardTableId.NotFound Specified forward table does not exist.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.