All Products
Search

This Product

    NAT Gateway:Single-zone NAT Gateway

    Document Center

    NAT Gateway:Single-zone NAT Gateway

    Last Updated:Aug 03, 2026

    NAT Gateway offers two deployment modes: cross-zone and single-zone. Cross-zone mode deploys a NAT gateway redundantly across two availability zones with automatic failover. Single-zone mode deploys a NAT gateway in a specific availability zone with device-level high availability within that zone. Choose the mode that fits your workload distribution and disaster recovery strategy. Both public and VPC NAT gateways support these modes.

    Single-zone mode is available in all regions that support NAT Gateway. Contact your account manager to enable it.

    Scenarios

    • Failure domain isolation: You need to contain failure domains at the zone level to prevent cross-zone cascading failures.

    • Per-zone traffic isolation: Workloads in different zones use separate NAT gateways to forward traffic independently.

    • Cost savings: If your workloads run in a single zone and do not need cross-zone redundancy, Single-zone mode saves about 50% on instance fees and 20% on capacity unit (CU) fees.

    We recommend deploying Single-zone NAT gateways in multiple zones at the application layer. This lets each zone forward traffic independently, so a single zone failure does not take down your entire service.

    Cross-zone disaster recovery

    The NAT gateway is redundantly deployed across two zones with automatic failover. Best suited when ECS instances and other resources span multiple zones and share a single NAT gateway for internet access.

    image

    Single-zone disaster recovery

    The NAT gateway is deployed in one zone with high availability scoped to that zone. Best suited when workloads are concentrated in a single zone and use a dedicated NAT gateway.

    image

    Create a Single-zone NAT gateway

    Both public and VPC NAT gateways support Single-zone mode. This topic uses a public NAT gateway as an example. To create a VPC NAT gateway, see Create a VPC NAT gateway instance.

    Console

    1. Go to the NAT Gateway - Public NAT Gateway purchase page to create a Single-zone NAT gateway.

      • Billing Method: Select Pay-As-You-Go.

      • Region: Select the region where you want to create the NAT gateway.

      • Network and Zone: The NAT gateway is deployed in the zone of the selected vSwitch. This cannot be changed after creation. Binding an EIP consumes one private IP from the vSwitch, so make sure the vSwitch has enough available IPs.

      • Disaster Recovery: Select Single-zone disaster recovery.

        If Disaster Recovery is not shown on the purchase page, contact your account manager to enable Single-zone mode.

      • EIP: Choose whether to use an existing EIP, buy a new one, or skip binding for now.

        • Select EIP: Select an EIP that is not bound to an instance.

        • Purchase EIP: Choose this when no EIP is available. A BGP (Multi-ISP) EIP with pay-by-traffic billing is created by default. Set the Maximum Bandwidth as needed.

          To use a BGP (Multi-line) Premium EIP or other billing methods, first Apply for EIPs, then select Select EIP to bind it.

        • Configure Later: The created NAT gateway will not have internet access until you bind an EIP.

          After creation, click EIP in the row of the target NAT gateway to bind an existing or newly purchased EIP.

    2. Configure entries and routes: Set up SNAT entries for internet access and Configure a DNAT entry for inbound services. Then add a 0.0.0.0/0 route entry pointing to the NAT gateway in the route table.

    API

    1. Call CreateNatGateway to create a NAT gateway and set AvailabilityMode to Singlezone.

    2. Call CreateSnatEntry to create a SNAT entry.

    3. Call CreateForwardEntry to create a DNAT entry.

    4. Call AssociateEipAddress to bind an EIP.

    Active-standby high availability with route target groups

    Single-zone mode scopes the failure domain to one zone. To achieve cross-zone high availability, deploy Single-zone NAT gateways in two zones of the same VPC and pair them in active-standby mode using Route target groups. The route target group runs health checks against both NAT gateways and automatically fails traffic over to the standby instance within 30 seconds when the primary's zone goes down.

    To avoid flapping caused by network jitter, traffic does not automatically switch back when the primary instance recovers. Manually switch back during off-peak hours.
    image

    Differences from cross-zone NAT gateways

    Both cross-zone NAT gateways and Single-zone NAT gateways paired with route target groups can achieve cross-zone disaster recovery. However, they differ fundamentally in failover mechanism, failure domain granularity, and user control.

    Dimension

    Cross-zone mode

    Single-zone with route target group

    Deployment

    A single instance spans two zones with resource scheduling managed by the system.

    Two independent instances in different zones, paired as active-standby through a VPC route target group.

    Failover mechanism

    Automatic and transparent to users.

    Health-check-driven automatic failover with manual switchback support.

    Failover time

    Automatic failover and recovery, < 10 minutes.

    Failover: < 30 seconds (health-check triggered)

    Switchback: < 10 seconds (manual)

    Failure domain

    Both zones share the same instance. Failure domain is instance-level.

    Instances are fully independent. Failure domain is strictly isolated per zone.

    Controllability

    Out of the box, no extra configuration. However, you cannot control which zone handles traffic.

    Full control over primary and standby zones, supports DR drills and on-demand switchback.

    Applicable scenarios

    Simple setup, no failover control needed.

    Requires strict failure domain isolation, predictable traffic paths, and DR drill capability.

    Configure route-based disaster recovery

    • Single-zone NAT gateways created in different zones of the same VPC.

    • Both NAT gateways have ICMP reply enabled so the route target group can health-check them.

      ICMP reply is on by default. Check ICMP Retrieval on the NAT gateway details page.

    Console

    1. Create a route target group: Go to the VPC - Route Target Groups page, select the NAT gateway region from the top navigation bar, and click Create Target Group.

      • VPC: Select the VPC to which both NAT gateways belong.

      • Mode: Select Active/Standby Mode.

      • Member Type: Select NAT Gateway.

      • Member Settings:

        • Primary instance: Select an zone, then pick the corresponding Single-zone NAT gateway. Weight is fixed at 100. Handles all traffic under normal conditions.

        • Standby instance: Select another zone, then pick the corresponding Single-zone NAT gateway. Weight is fixed at 0. Takes over traffic automatically when the primary fails.

      • Instance Name and Resource Group and Tags: Optional, for easier resource management.

    2. Point a route entry to the route target group: Go to the VPC - Route Tables page, and click the target route table ID. Choose one of the following:

      • Create a new route entry: If no route points to the NAT gateway, go to the Custom Route tab and click Add Route Entry. Enter 0.0.0.0/0 as the destination, set Next Hop Type to Route Target Group, and select the route target group.

      • Modify an existing route entry: On the Custom Route tab, find the route entry, click Edit, change Next Hop Type to Route Target Group, and select the route target group.

    API

    1. Call CreateRouteTargetGroup to create a route target group.

    2. Call CreateRouteEntry to create a custom route entry, and set NextHopType to RouteTargetGroup.

    3. Call ModifyRouteEntry to modify the next hop of the custom route entry, and set NextHopType to RouteTargetGroup.

    Manual active-standby switchover (optional)

    Manually trigger traffic switchover between primary and standby instances for DR drills or planned maintenance. Switchover is blocked when an instance is unhealthy.

    Console

    1. Go to the VPC - Route Target Groups page, and click the route target group ID.

    2. Click Switch Member in the upper-right corner.

    API

    Call SwitchActiveRouteTarget to trigger active-standby switchover.

    Resource cleanup

    When you no longer need the active-standby setup, clean up resources in the following order. NAT gateways referenced by route target groups cannot be deleted directly — remove route entries and the route target group first.

    Console

    1. Delete route entries: Go to the VPC - Route Tables page, click the target route table ID, find the route entry with the route target group as next hop on the Custom Route tab, and click Delete.

    2. Delete the route target group: Go to the VPC - Route Target Groups page, find the target group, and click Delete in the Actions column.

    3. Delete the NAT gateway: Go to the NAT Gateway list page, find the target NAT gateway, and click the instance ID to open the details page.

      • Delete configured entries: Delete the configured entries on the SNAT and DNAT tabs.

      • Unbind and release the EIP: On the Associated EIP tab, unbind the EIP. Unbinding only removes the association — you will still be charged the EIP configuration fee. Go to the EIP page to release it.

        If entries are not yet deleted, you can Disassociate.

      • Delete the NAT gateway: Click Actions for the target NAT gateway instance, and then click Delete.

        If you haven't unbound the EIP or deleted entries, you can select Force Delete (Delete the NAT gateway and associated SNAT/DNAT entries) to let the system delete the instance and its associated resources.

        Deletion protection prevents accidental deletion. Disable it before deleting the instance.

    API

    1. Call DeleteRouteEntry to delete the route entry whose next hop is the route target group.

    2. Call DeleteRouteTargetGroup to delete the route target group.

    3. Call DeleteSnatEntry and DeleteDnatEntry to delete SNAT and DNAT entries.

    4. Call UnassociateEipAddress to unbind the EIP.

    5. Call DeleteNatGateway to delete the NAT gateway.

    Performance metrics

    Deployment mode

    Performance metric

    New connections per second (CPS)

    Throughput

    Concurrent connections

    Packet processing speed (PPS)

    Cross-zone

    Baseline

    20,000

    5 Gbps

    500,000

    800,000

    Elastic limit

    100,000

    15 Gbps

    2,000,000

    2,500,000

    Single-zone

    Baseline

    20,000

    10 Gbps

    500,000

    800,000

    Elastic limit

    100,000

    20 Gbps

    2,000,000

    2,500,000

    Single-zone mode delivers 2x the throughput of cross-zone mode. In cross-zone mode, the primary and standby instances split the throughput capacity, while Single-zone mode concentrates all resources in one zone. Other metrics (CPS, concurrent connections, PPS) are identical across both modes.

    Billing

    Single-zone NAT gateways use pay-as-you-go billing only (instance fee + CU fee). Subscription and resource packs are not supported.

    Instance fee

    Instance fee = Unit price (USD/hour) × Usage duration (hours)

    Region

    Cross-zone instance unit price (USD/hour)

    Single-zone instance unit price (USD/hour)

    China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu)

    0.034

    0.017

    China (Hong Kong), Japan (Tokyo), South Korea (Seoul), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta), Philippines (Manila), Thailand (Bangkok), Malaysia (Johor), Germany (Frankfurt), UK (London), US (Silicon Valley), US (Virginia), UAE (Dubai)

    0.043

    0.0215

    Saudi Arabia (Riyadh) - Partner

    0.052

    0.026

    Prices are for reference only. See the purchase page for actual pricing.

    Capacity unit CU fee

    Hourly CU fee = CU unit price (USD/CU/hour) × CUs consumed in the hour

    CUs consumed in the hour = Total traffic processed / 1 GB.

    Region

    Cross-zone CU unit price (USD/CU/hour)

    Single-zone CU unit price (USD/CU/hour)

    China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu)

    0.034

    0-1,000,000 CUs: 0.027
    Above 1,000,000 CUs: 0.016

    China (Hong Kong), Japan (Tokyo), South Korea (Seoul), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta), Philippines (Manila), Thailand (Bangkok), Malaysia (Johor), Germany (Frankfurt), UK (London), US (Silicon Valley), US (Virginia), UAE (Dubai)

    0.043

    0-1,000,000 CUs: 0.034
    Above 1,000,000 CUs: 0.021

    Saudi Arabia (Riyadh) - Partner

    0.052

    0-1,000,000 CUs: 0.042
    Above 1,000,000 CUs: 0.025

    Prices are for reference only. See the purchase page for actual prkanicing.