FAQ - NAT Gateway - Alibaba Cloud Documentation Center

This topic lists frequently asked questions to help you troubleshoot when using NAT Gateway.

Usage and configuration

Instance configuration

Why can't I create a NAT gateway in some zones?

NAT gateways are not deployed in all zones due to resource planning. Call ListEnhancedNatGatewayAvailableZones to query the zones that support NAT Gateway creation.

A NAT gateway in any available zone can serve instances across the entire VPC.

Can I change the vSwitch or private IP of a NAT gateway?

No. To change the vSwitch, create a new NAT gateway and update the route entries.

Can a NAT gateway process fragmented packets?

Yes. NAT gateways support fragmented TCP, UDP, and ICMP packets.

Can a NAT gateway be used without a VPC?

No. A NAT gateway must be associated with a VPC. When you create an Internet or VPC NAT gateway, you must specify the VPC. The gateway works with resources such as vSwitches and ECS instances in the VPC to provide address translation.

SNAT configuration

How are SNAT entries prioritized when source CIDR blocks overlap?

The system uses longest prefix match to determine priority:

ECS-level entries: Source CIDR mask is /32 (longest mask, highest priority, matched first).
Other entries: Longer subnet masks have higher priority.

What is the SNAT idle timeout?

TCP: 900 seconds.
UDP: 60 seconds.

Can an ECS use SNAT to access a DNAT service on the same NAT gateway?

Yes, after you switch the NAT gateway to NAT mode and configure both SNAT and DNAT entries on the same instance.

How do I check if the NAT gateway is in NAT mode?
Call DescribeNatGateways and check whether the EipBindMode field returns NAT.
How do I switch to NAT mode?
Call ModifyNatGatewayAttribute and set the EipBindMode field to NAT.

What determines the SNAT outbound bandwidth?

The outbound bandwidth is determined by the EIP bound to the NAT gateway, not by the ECS instance's own internet bandwidth. For example, if the ECS has 1 Mbps internet bandwidth but the EIP has 100 Mbps, the ECS can reach 100 Mbps through SNAT.

The ECS internet bandwidth only applies when the ECS accesses the internet directly through its own public IP. When multiple ECS instances share the same EIP through one SNAT entry, they share the bandwidth — each instance gets less as others generate traffic.

DNAT configuration

Can I create a DNAT entry for an ECS that already has an EIP?

Yes, but external users cannot access the ECS through the DNAT entry while the EIP is bound. Disassociate the EIP first to enable DNAT access.

Does DNAT support domain-based routing?

No. DNAT operates at the transport layer (Layer 4) and performs destination address translation only on IP addresses and ports, mapping public IPs and ports to private IPs and ports. DNAT does not parse application-layer traffic and cannot identify domain names, HTTP Host headers, or TLS SNI information, so it cannot implement domain-based request routing. Network Load Balancer (NLB) also operates at Layer 4 and cannot achieve domain-based request routing.

For domain-based Layer 7 routing, consider:

Use Application Load Balancer (ALB). ALB operates at Layer 7 and supports domain- and path-based routing rules. It also provides SNI multi-domain certificate hosting for HTTPS.
Deploy a reverse proxy such as Nginx on the ECS to route requests by domain.

DNAT vs. directly binding an EIP to an ECS — what's the difference?

With DNAT, the EIP is bound to the NAT gateway and traffic flows through it. With a directly bound EIP, the EIP is on the ECS and traffic bypasses the NAT gateway. Key differences:

Traffic path: DNAT — inbound traffic goes through the NAT gateway (EIP → NAT gateway → ECS). Response traffic returns the same way. Outbound access requires a separate SNAT entry. Direct EIP — the ECS directly sends and receives traffic (EIP → ECS).
Port exposure: DNAT supports specific port (only mapped ports exposed) or any port (all ports forwarded to one ECS). Direct EIP exposes all ports allowed by the security group.
Management: DNAT requires binding an EIP to the NAT gateway, then configuring entries on the DNAT Management tab. For outbound access, add SNAT entries on the SNAT Management tab. Direct EIP is bound in the ECS console — simpler.
Cost: DNAT — multiple ECS instances can share one EIP via port multiplexing, reducing EIP costs. Direct EIP — each ECS needs its own EIP.
Mutual exclusion: An ECS cannot use both at once. Once an EIP is bound to the ECS, DNAT access fails — unbind the EIP first.
Domain routing: Neither supports domain-based routing (both are Layer 4). Use ALB or a reverse proxy for domain-level routing.

Recommended scenarios:

Multiple ECS instances sharing a public entry point with port multiplexing: DNAT is recommended.
A single ECS instance independently providing services: directly binding an EIP is recommended.
Fine-grained port-level control (exposing only specific ports): DNAT is recommended.
Multiple ECS instances sharing a public outbound entry (outbound access): NAT Gateway with SNAT is recommended.

Can a single ECS instance bind multiple EIPs through DNAT?

Yes. You can create multiple DNAT entries for the same ECS instance, each binding a different EIP and port, to achieve multi-EIP DNAT mapping. When configuring, ensure that the port mapping combinations (public port + private port + protocol) of different DNAT entries do not conflict within the same NAT Gateway. Each NAT Gateway supports up to 100 DNAT entries.

For example, on the same ECS instance (private IP: 10.20.1.243), you can configure two DNAT entries: Entry 1 uses EIP-A port 80 mapped to private port 80 (TCP), and Entry 2 uses EIP-B port 443 mapped to private port 443 (TCP). The port mapping combinations do not conflict, so both entries can take effect simultaneously.

Additionally, the same EIP can be used for both SNAT and DNAT entries without affecting each other.

EIP configuration

Why can't I find my EIP when creating a NAT entry?

The EIP and NAT gateway are in different regions. Select an EIP in the same region or create one in the NAT gateway's region.

Can I use the same EIP or NAT IP for both DNAT and SNAT?

Yes. However, if the DNAT entry is set to any port, that EIP or NAT IP cannot be used for other DNAT or SNAT entries. If the DNAT entry uses a specific port greater than 1024, it may conflict with SNAT ports and cause transient connection drops.

Does an ECS instance with an EIP still use the NAT Gateway?

If an ECS instance has an associated EIP, the instance uses that EIP for outbound internet traffic instead of the NAT Gateway. To use the NAT Gateway for outbound traffic, disassociate the EIP from the instance.

What are the differences between the two EIP binding modes?

Internet NAT Gateways created through the console default to NAT mode. Multi-EIP visible mode can only be created by calling CreateNatGateway and specifying the EipBindMode parameter.

To use the NAT Gateway with an IPv4 Gateway, you must use NAT mode.
For greater EIP management flexibility, you can choose multi-EIP visible mode.

Dimension	NAT mode	Multi-EIP visible mode
Switching binding mode	Cannot be switched to multi-EIP visible mode.	Console: Follow this guide to switch. OpenAPI: Call ModifyNatGatewayAttribute. Set `EipBindMode` to `NAT`. When the number of EIPs bound to the NAT Gateway is ≤ 5, you can switch directly through the API. When the number of EIPs bound to the NAT Gateway is > 5, contact your account manager to apply. Note During the EIP binding mode switch, network connections may experience brief interruptions (lasting longer as the number of EIPs increases). Perform the switch during off-peak hours. Before switching, ensure that the vSwitch where the NAT Gateway is deployed has sufficient available IP addresses.
Does adding EIPs consume available IP addresses in the vSwitch?	Each additional EIP consumes one private IP address from the vSwitch. The private IP is bound to the EIP. When an ECS instance uses SNAT/DNAT entries for forwarding, data is first received through the private IP bound to the EIP, and then forwarded to the corresponding EIP.	Adding EIPs does not consume available IP addresses in the vSwitch. When an ECS instance uses SNAT/DNAT entries for forwarding, data is forwarded directly through the corresponding EIP.
IPv4 Gateway support	Supported.	Not supported.
ECS accessing DNAT on the same NAT Gateway instance via SNAT	Supported.	Not supported.
Creation method	Created by default through the console. Call CreateNatGateway and specify `EipBindMode` as `NAT`.	Call CreateNatGateway and specify `EipBindMode` as `MULTI_BINDED`.

Network connectivity troubleshooting

Cannot access the internet through SNAT

Check the default route pointing to the NAT Gateway:
On the NAT Gateway instance details page, view VPC routes that point to the NAT gateway and confirm whether a route entry pointing to the NAT Gateway exists. If missing, configure a route with the destination set to 0.0.0.0/0 and the next hop set to the NAT Gateway in the relevant route table.
Verify SNAT rule configuration:
- On the SNAT tab of the NAT Gateway instance details page, confirm that the SNAT entry status is Available.
- Confirm that the source address accessing the internet is within the Source CIDR Block.
Troubleshoot non-NAT issues:
- Cross-border access: the network path is unstable.
- Domain access: check whether the domain's ICP filing and DNS resolution are normal.
- Access control: check whether the destination has configured access control policies or added the EIP to a whitelist.
Check IPv4 Gateway configuration: When using an IPv4 Gateway, ensure that the NAT Gateway is in NAT mode and routes are configured correctly.

New ECS cannot access the internet through SNAT

An ECS in a newly created vSwitch cannot access the internet through SNAT, while instances in other vSwitches can.

Confirm whether the SNAT entries include the CIDR block of the new vSwitch:
The NAT Gateway does not automatically configure SNAT entries for newly created vSwitches. On the SNAT tab of the instance details page, check whether the Source CIDR Block of existing SNAT entries includes the CIDR block of the new vSwitch. If not, manually configure a SNAT entry.
If the new vSwitch is associated with a custom route table, confirm whether a route entry with the destination 0.0.0.0/0 and next hop set to the NAT Gateway is configured. If not, manually add the route entry.

ECS cannot access the internet with multiple NAT gateways

This happens when the VPC uses only the system route table with a single 0.0.0.0/0 route pointing to one NAT gateway. If that gateway's SNAT entry does not cover a specific vSwitch, its ECS instances cannot access the internet.

If you do not need multiple NAT Gateways, delete the unnecessary ones and add SNAT entries to the remaining NAT Gateway to cover the vSwitch's CIDR block.
If you need multiple NAT Gateways, refer to this guide for configuration.

Cannot access an FTP server through SNAT

Possible causes:

Active FTP mode: SNAT supports only outbound access. FTP active mode requires inbound data connections, which SNAT cannot handle. Use passive mode instead.
Multiple EIPs in the SNAT entry: FTP control and data connections may use different EIPs, breaking the session. Enable EIP affinity so the same client always uses the same EIP. Or create a separate SNAT rule with a single EIP for the FTP client.

Service unreachable after DNAT is configured

Check the default route pointing to the NAT Gateway:
When the ECS instance configured in the DNAT entry responds to incoming traffic, it also needs a route back to the NAT Gateway. Confirm whether the system route table or custom route table has a route with the destination 0.0.0.0/0 and next hop set to the NAT Gateway. If not, manually add the route entry.
Verify DNAT rule configuration:
- On the DNAT tab of the NAT Gateway instance details page, confirm that the DNAT entry status is Available.
- Confirm that the port, protocol, and target address parameters in the DNAT rule are correct.
Check security groups, firewalls, and service port status:
- Run telnet <ECS private IP> <private port> on another ECS instance in the same VPC to check whether the private port of the ECS instance configured in the DNAT entry is accessible.
  - If the output shows unable connect to remote host: Connection timed out, the private port is not accessible from within the VPC, which means it is also not accessible from the internet.
  - If the output shows Connected to <ECS private IP>, the private port is accessible.
- When the private port is accessible, confirm that the ECS instance's security group rules allow public access to the corresponding port and that the firewall has the port open.
Troubleshoot domain resolution issues: If access through the domain fails but direct EIP access works, check the domain's DNS resolution and ICP filing status.
Check IPv4 Gateway configuration: When using an IPv4 Gateway, ensure that the NAT Gateway is in NAT mode and routes are configured correctly.
Verify ENI consistency: When the ECS has multiple ENIs, check whether the inbound and outbound ENIs are consistent. Refer to this guide for configuration.

Using with IPv4 Gateway

Difference between IPv4 gateway and Internet NAT gateway

An IPv4 gateway and an Internet NAT gateway can be used together. See Internet access for details on how these networking components relate to each other.

Component	IPv4 gateway	Internet NAT gateway
Purpose	A VPC boundary component that controls public IPv4 traffic	A Network Address Translation (NAT) device inside the VPC
Scenarios	Centralized control of Internet access traffic	Unified egress for Internet-bound traffic
Provides Internet access	No. Controls traffic only.	Provides Internet access by associating EIPs (EIPs provide the connectivity; the NAT gateway itself does not provide Internet access.)

After you create an IPv4 gateway, vSwitches fall into two categories:

Public vSwitch: The associated route table contains a route entry with Destination CIDR Block set to 0.0.0.0/0 and Next Hop set to the IPv4 gateway. Resources in this vSwitch can access the Internet after associating a public IP address.
Private vSwitch: The associated route table does not contain a route pointing to the IPv4 gateway. Resources in this vSwitch cannot directly access the Internet even if they have a public IP address.

When using an Internet NAT gateway together with an IPv4 gateway, deploy the Internet NAT gateway in a public vSwitch. ECS instances in a private vSwitch must have a route pointing to the Internet NAT gateway so their Internet-bound traffic flows through the NAT gateway, which uses its associated public IP address to reach the Internet. Note the following:

Make sure the EipBindMode of the Internet NAT gateway is set to NAT mode for compatibility with the IPv4 gateway.
- Internet NAT gateways created in the console default to NAT mode. When calling CreateNatGateway, set EipBindMode to NAT. After creation, call ModifyNatGatewayAttribute to change the EipBindMode.
- If an Internet NAT gateway with EipBindMode set to MULTI_BINDED mode already exists, it is incompatible with the IPv4 gateway, and you cannot create an IPv4 gateway.
- If an IPv4 gateway already exists and you call CreateNatGateway to create an Internet NAT gateway with EipBindMode set to MULTI_BINDED mode, you cannot associate EIPs with that NAT gateway.
To prevent resources in private vSwitches from losing Internet access after the IPv4 gateway is activated, complete route configuration before activation.

What happens when I switch to NAT mode?

After switching, the NAT gateway can work with an IPv4 gateway. Instances with both SNAT and DNAT entries can use SNAT to access a DNAT service on the same gateway.

Billing: Free, no additional costs.
Service: Brief network interruptions (seconds) may occur. Duration depends on the number of bound EIPs.
Configuration:
- Public egress IP and existing configurations remain unchanged.
- Each EIP consumes one private IP from the NAT gateway's vSwitch. Ensure sufficient available addresses.
- The switch is irreversible — IPv4 gateway compatibility mode cannot be disabled afterward.

Performance and monitoring

Connection timeouts or slow downloads

Monitor traffic
- View EIP monitoring to check for packet loss from bandwidth limits. If detected, upgrade the EIP bandwidth.
- For VPCs with many ECS instances, use NAT gateway traffic monitoring to identify the source of unusual traffic.
Optimize the Linux kernel
- Cause: When multiple Linux ECS instances concurrently access a Linux server through SNAT, the kernel may drop TCP SYN packets, causing timeouts.
- Solution: Disable net.ipv4.tcp_tw_recycle on the server, or disable net.ipv4.tcp_timestamps on the client.

What do port allocation failure drops mean?

The number of connections dropped because TCP/UDP port allocation failed due to excessive concurrent connections through the NAT gateway.

Cause: A single EIP or NAT IP provides limited SNAT ports. When too many sessions target the same destination with too few EIPs or NAT IPs, port allocation fails.

Solution: Add more EIPs or NAT IPs to the SNAT rule when drops keep increasing.

Billing and quotas

Why did my NAT gateway costs increase?

NAT gateway is pay-as-you-go. Higher costs usually mean more traffic. Troubleshoot:

View monitoring: In CloudMonitor, check the NAT Gateway instance's inbound/outbound traffic, connection count, and other metrics to identify traffic peaks.
View billing details: Use Billing and Cost console to view hourly billing details for the NAT Gateway and pinpoint the exact time when costs increased.
Enable traffic logs: Enable the NAT Gateway's traffic logs (session log and flow log) and deliver them to Log Service for analysis to precisely identify the traffic source.

Can I get a refund for a NAT gateway resource package?

NAT Gateway resource packages support five-day unused refund and non-full refund. For details, refer to the Rules for unsubscribing from resources.

Why am I still billed after deleting a NAT gateway?

After deleting a NAT gateway, you may still receive bills due to delayed billing. These bills cover usage before deletion. Check the usage period in your billing details to confirm.

How many NAT gateways can I create?

No limit. You can create any number of NAT gateways per Alibaba Cloud account.