NAT Gateway:Create VPC peering connections to enable multiple VPCs to use the same Internet NAT gateway

Why share a NAT gateway

Deploying an Internet NAT gateway in every VPC that needs internet access adds cost and operational overhead that scales with the number of VPCs. By connecting VPCs through peering connections and routing their outbound traffic through one centralized NAT gateway, you pay for a single gateway and manage a single set of elastic IP address (EIP) associations. The billable components of this architecture are:

• The Internet NAT gateway (per hour)

• EIP associations on the NAT gateway

• Data transfer through the VPC peering connections

How it works

A VPC peering connection is a private network connection between two VPCs. Traffic between peered VPCs travels over the Alibaba Cloud backbone and does not traverse the public internet.

To share a NAT gateway across VPCs:

1. Create an Internet NAT gateway in the hub VPC (the VPC that owns the NAT gateway).

2. Create a VPC peering connection between the hub VPC and each spoke VPC.

3. Add route entries so spoke VPCs forward their outbound traffic to the hub VPC through the peering connection.

4. Create SNAT entries on the NAT gateway to cover the CIDR blocks of both the hub VPC and each spoke VPC.

To connect more than two VPCs, create a separate peering connection between each pair. For example, to connect VPC1, VPC2, and VPC3, create three peering connections: VPC1–VPC2, VPC2–VPC3, and VPC1–VPC3.

Example scenario

A company has two VPCs in the China (Chengdu) region:

• VPC-A — the hub VPC. Contains vSwitch-A1 (where the NAT gateway is deployed) and vSwitch-A2 (where ECS-A runs).

• VPC-B — the spoke VPC. Contains vSwitch-B1 (where ECS-B runs). CIDR block: 172.16.0.0/16.

Both ECS-A and ECS-B need to access the internet. The solution: peer VPC-A and VPC-B, configure routes, and create SNAT entries on the NAT gateway in VPC-A.

Prerequisites

Before you begin, make sure you have:

• Two VPCs in the same region (this example uses China (Chengdu))

• ECS instances in each VPC that need internet access

• Sufficient permissions to create NAT gateways, VPC peering connections, route entries, and SNAT entries

Step 1: Create an Internet NAT gateway

1. Log on to the NAT Gateway console.

2. On the Internet NAT Gateway page, click Create Internet NAT Gateway.

3. On the NAT Gateway page, configure the following parameters and click Buy Now.

   Parameter	Description
   Region	Select the region where the hub VPC is located.
   Network And Zone	Select the hub VPC and vSwitch. You cannot change these after creation. In this example, select VPC-A and vSwitch-A1.
   Network Type	Select Internet NAT Gateway. An Internet NAT gateway supports EIP association and enables instances to access the public internet. A VPC NAT gateway provides address translation within private networks only.
   Elastic IP Address	Select Purchase And Associate EIP to create and attach a pay-by-traffic BGP (Multi-ISP) EIP automatically. Alternatively, select Select Existing EIP Instance to attach an existing EIP that is in the Not Associated With An Instance state, or select Configure Later to attach an EIP after creation. Note Each EIP associated with a NAT gateway uses one private IP address from the vSwitch. Make sure the vSwitch has enough available private IP addresses.

After the gateway is created, it appears on the Internet NAT Gateway page.

Step 2: Create a VPC peering connection

1. Log on to the VPC console.

2. In the left-side navigation pane, click VPC Peering Connection.

3. In the top navigation bar, select the region. In this example, select China (Chengdu).

4. On the VpcPeer page, click Create VPC Peering Connection.

5. Configure the following parameters and click OK.

   Parameter	Description
   Peering Connection Name	Enter a name for the connection.
   Resource Group	Select a resource group.
   Requester VPC	Select the hub VPC. In this example, select VPC-A.
   Accepter Account Type	Select Same-Account if both VPCs belong to the same Alibaba Cloud account.
   Accepter Region Type	Select Intra-Region if both VPCs are in the same region.
   Accepter VPC	Select the spoke VPC. In this example, select VPC-B.

6. On the VpcPeer page, confirm the connection status is Activated. Once activated, you can view the VPC ID, region, CIDR block, and owner account for both the requester VPC and the accepter VPC.

Step 3: Configure routes

Add route entries to both VPCs so traffic flows correctly through the peering connection.

Expected route table state after this step:

The route in VPC-A sends traffic destined for VPC-B across the peering connection. The route in VPC-B sends all outbound traffic (including internet-bound traffic) to VPC-A, where the NAT gateway handles the translation.

Configure routes for VPC-A (requester):

1. On the VPC Peering Connection page, find the peering connection you created.

2. In the Requester VPC column, click Configure route.

3. In the Configure route dialog, set the following and click OK.

   Parameter	Value
   VPC	Automatically filled with VPC-A.
   Route Table	Select a route table associated with VPC-A.
   Name	Enter a name for the route entry.
   Destination CIDR Block	Select IPv4 CIDR Block and enter 172.16.0.0/16 (VPC-B's CIDR block).
   Next Hop	Automatically filled with the VPC peering connection.

Configure routes for VPC-B (accepter):

1. In the Accepter VPC column, click Configure route.

2. In the Configure route dialog, set the following and click OK.

   Parameter	Value
   VPC	Automatically filled with VPC-B.
   Route Table	Select a route table associated with VPC-B.
   Name	Enter a name for the route entry.
   Destination CIDR Block	Select IPv4 CIDR Block and enter 0.0.0.0/0 to forward all IPv4 traffic to VPC-A through the peering connection.
   Next Hop	Automatically filled with the VPC peering connection.

To verify the routes were added, click the peering connection ID and check the Route Entry List tab.

Step 4: Create an SNAT entry

Create an SNAT entry for each vSwitch that contains instances needing internet access — including vSwitches in VPC-B, because VPC-B's traffic arrives at the NAT gateway in VPC-A and must be covered by an SNAT rule.

1. On the Internet NAT Gateway page, find your NAT gateway and click Configure SNAT in the Actions column.

2. On the SNAT Management tab, click Create SNAT Entry.

3. Configure the following parameters and click Confirm.

   Parameter	Description
   SNAT Entry	Select Specify vSwitch, then choose the vSwitch whose instances need internet access. The CIDR block of the selected vSwitch is displayed automatically. To cover multiple vSwitches, select them all — the system creates one SNAT entry per vSwitch, all using the same EIP.
   Select EIP	Select Use Single IP and choose the EIP associated with the NAT gateway.
   Entry Name	Enter a name for the SNAT entry.

Verify the configuration

Verify that both instances can reach the internet.

1. Log on to ECS-A and ECS-B through the Workbench console.

2. Run the following command on each instance.

   ping 223.5.5.5

   A successful ping confirms that the instance can access the internet through the NAT gateway.

What's next

• To connect additional VPCs to the same NAT gateway, repeat steps 2 through 4 for each new VPC: create a peering connection, configure routes in both VPCs, and add SNAT entries for the new VPC's vSwitches.

• To learn more about VPC peering connections, see VPC peering connections.