All Products
Search

This Product

    NAT Gateway:VPC NAT Gateway

    Document Center

    NAT Gateway:VPC NAT Gateway

    Last Updated:Aug 31, 2026

    A VPC NAT Gateway translates private IPv4 addresses in a VPC to NAT IP addresses, resolving address conflicts between overlapping networks and enabling access through fixed private IP addresses.

    • Resolve private IP address conflicts: VPCs with overlapping CIDR blocks cannot connect to each other. You can add an additional CIDR block and create a VPC NAT Gateway to resolve the address conflict.

    • Enable access with specified IP addresses: In regulated industries like finance and securities, a VPC NAT Gateway allows cloud-based services to access on-premises data centers through fixed, specified private IP addresses.

    VPC NAT Gateway supports two disaster recovery modes:

    NAT gateways with single-zone disaster recovery are currently available in the Germany (Frankfurt) and UK (London) regions. To use this feature, contact your account manager.

    • Cross-zone disaster recovery (default): The NAT gateway deploys redundantly across zones, with automatic failover if a zone fails.

    • Single-zone disaster recovery: The NAT gateway deploys within a single zone and only provides high availability within that zone. The instance fee is approximately 50% of the cross-zone option, and the CU fee is approximately 80%.

    How it works

    The following example shows how cloud and on-premises resources communicate through fixed NAT IP addresses.

    • Cloud services access an on-premises data center: ECS instances in a VPC access the data center through a specified NAT IP address.

      1. Route forwarding: The VPC route table forwards packets from ECS instances to the VPC NAT Gateway.

      2. SNAT (Source Network Address Translation): The VPC NAT Gateway translates the source IP from the ECS instance IP (for example, 192.168.1.10) to the specified NAT IP (192.168.10.2) and records the mapping in its session table.

      3. Sending to the peer private network: The VPC NAT Gateway sends the translated packet to the data center. The request appears to originate from the NAT IP address.

      4. Response and reverse translation: The data center responds to the NAT IP address. The VPC NAT Gateway restores the original private IP from its session table and forwards the response to the ECS instance.

    • On-premises data center accesses cloud services: The data center sends a request to the NAT IP address (192.168.10.2). The VPC NAT Gateway translates the destination IP to the private IP of the target ECS instance (for example, 192.168.1.10) based on a DNAT entry.

    A VPC NAT Gateway only performs address translation. The VPC route table controls whether traffic reaches the NAT gateway and where it goes after translation.

    Connectivity with other VPCs or on-premises data centers requires products such as Cloud Enterprise Network (CEN) and Express Connect.

    • Configure VPC egress routing (VPC to external network): Add a route entry with the destination set to the peer network and the next hop set to the VPC NAT Gateway. This forwards outbound VPC traffic to the NAT gateway for SNAT.

    • Declare the NAT IP CIDR block: When using a custom NAT IP CIDR block, add a route entry with the destination as the NAT IP CIDR block and the next hop as the VPC NAT Gateway. This ensures DNAT inbound traffic and SNAT return traffic route correctly within the VPC.

    • Configure external network routing (external network to VPC): Add a route in the peer network with the destination set to the NAT IP CIDR block, so that return traffic and inbound requests reach the NAT gateway.

    image

    Create a VPC NAT Gateway

    Console

    Go to the NAT Gateway - VPC NAT Gateway purchase page.

    • Billing Method: pay-as-you-go.

    • Region: Select the region where you want to create the VPC NAT Gateway.

    • Disaster Recovery: Select the disaster recovery deployment mode for the NAT gateway.

      • Cross-zone disaster recovery (default): The gateway deploys across primary and secondary zones, with automatic failover.

      • Single-zone disaster recovery: The gateway deploys in a single zone with device-level redundancy. The instance fee is approximately 50% of the cross-zone option, and the CU fee is approximately 80%.

    • Network and Zone: Select the VPC and vSwitch. Use a dedicated vSwitch for the VPC NAT Gateway for easier route management.

    • Private IP (Optional): Specify a NAT IP address from the vSwitch CIDR block. If not specified, the system assigns one automatically.

    • Private IP Prefix (Optional): Create NAT IP addresses in bulk. First create a reserved CIDR block for the vSwitch. The gateway divides the reserved block into /28 prefixes, and each prefix adds 16 NAT IP addresses.

    API

    Call the CreateNatGateway API to create a VPC NAT Gateway. Use the AvailabilityMode parameter to specify the disaster recovery type: CrossAZ (default, cross-zone disaster recovery) or SingleAZ (single-zone disaster recovery).

    Configure NAT IP addresses and CIDR blocks

    NAT IP addresses are used in SNAT and DNAT entries to replace private IP addresses of ECS instances during address translation. NAT IP addresses must be allocated from a NAT IP CIDR block.

    • Default NAT IP CIDR block: The system uses the CIDR block of the vSwitch to which the VPC NAT Gateway belongs as the default NAT IP CIDR block.

      • The private IP address configured during creation serves as the default NAT IP address. You can specify this address during creation, or let the system assign one. You can add more NAT IP addresses later.

      • You can configure a private IP prefix from the vSwitch's reserved CIDR block to create NAT IP addresses in bulk.

    • Create a new NAT IP CIDR block: Allocate NAT IP addresses from a CIDR block that does not belong to the gateway's vSwitch.

      • We recommend using RFC private CIDR blocks 10.0.0.0/16, 172.16.0.0/16, 192.168.0.0/16 and their subnets. Supported subnet mask length: 16 to 32 bits.

      • To use a public CIDR block, you must use a user-defined CIDR block to ensure it is within the VPC's address range, and then use it as a NAT IP CIDR block.

      • The new NAT IP CIDR block cannot overlap with the VPC's private CIDR block. To translate a private IP address to another address within the VPC's private CIDR block, create a vSwitch within that block and create a new VPC NAT Gateway in that vSwitch.

    Console

    Configure NAT IP CIDR block

    • Default NAT IP CIDR block: The system uses the CIDR block of the VPC NAT Gateway's vSwitch by default. This cannot be deleted.

    • Create a new NAT IP CIDR block: Go to the VPC NAT Gateway page, click the ID of the target VPC NAT Gateway instance, and then select the NAT IP Address tab, and then click Create CIDR Block.

    Configure NAT IP

    • Add from the default NAT IP CIDR block:

      • The private IP address configured when you create the VPC NAT Gateway serves as the default NAT IP. You can specify this IP address, or let the system assign one automatically. The default NAT IP cannot be deleted.

      • Add NAT IP addresses individually: Go to the VPC NAT Gateway page, click the ID of the target VPC NAT Gateway instance, and then select the NAT IP Address tab, and click Add NAT IP Address.

        • Select CIDR Block: Select the default NAT IP CIDR block under the VPC NAT Gateway.

        • Allocation Method: Choose Randomly Allocate, or Manually Allocate by specifying an IP Address from the selected CIDR block.

      • Add NAT IP addresses in bulk by using an IP Prefix: Go to the VPC NAT Gateway page, click the ID of the target VPC NAT Gateway instance, on the NAT IP Address tab, select NAT IP prefix, and then click Add IP prefix.

        • Bulk add: Select Assign random IP prefix and specify the number of IP prefixes to assign. The system will randomly add the specified number of unassigned IP prefixes with a /28 mask from the reserved CIDR block of the gateway's vSwitch.

        • Add individually: Select Manually allocate IP prefix and specify an unassigned IP prefix with a /28 mask from the reserved CIDR block of the gateway's vSwitch.

    • Add from a new NAT IP CIDR block: Click the ID of the target VPC NAT Gateway instance, and then select the NAT IP Address tab, and click Add NAT IP Address.

      • Select CIDR Block: Select a new NAT IP CIDR block under the VPC NAT Gateway.

      • Allocation Method: Choose Randomly Allocate, or Manually Allocate by specifying an IP Address from the selected CIDR block.

    API

    Configure SNAT entry

    Console

    Go to the VPC NAT Gateway page, click SNAT in the Actions column of the target VPC NAT Gateway instance, and then click Create SNAT Entry.

    • SNAT Entry: The scope of the SNAT rule.

      • Specify VPC: All ECS instances in the VPC can access external networks through the configured SNAT rule.

      • Specify vSwitch: Only ECS instances in the specified vSwitch can access external networks.

      • Specify ECS Instance: Only the specified ECS instances or elastic network interfaces (ENIs) can access external networks.

      • Specify Custom CIDR Block: Resources within the specified CIDR block can access external networks.

    • Select NAT IP Address: Select one or more NAT IP addresses from the drop-down list to be used for accessing external private networks. You can also select Create NAT IP Address to create and select a new IP address.

    • NAT IP Affinity: If you select multiple NAT IP addresses and do not enable affinity, a private IP address may use different NAT IP addresses for a single destination. Enabling affinity fixes the NAT IP per destination, but may cause port allocation failures under high concurrency. Monitor the port allocation failure drops metric.

    After creation, you can click Edit in the Actions column of the target entry to modify the NAT IP address and NAT IP affinity.

    API

    Configure DNAT entry

    Console

    Go to the VPC NAT Gateway page, click DNAT in the Actions column of the target VPC NAT Gateway instance, and then click Create DNAT Entry.

    • Select NAT IP Address: Select the NAT IP address to be accessed by the external private network. A single NAT IP address can be used for both a DNAT entry (port mapping) and an SNAT entry simultaneously.

    • Select Private IP Address: Select the private IP address of the backend server that will receive the translated traffic. You can select it via an ECS instance or elastic network interface (ENI), or enter it manually.

    • Port Settings: Configure the DNAT mapping.

      • Any Port: This is an IP mapping. All traffic to this NAT IP address is forwarded to the destination ECS instance.

        • The destination ECS instance can also use this NAT IP address to access external networks. This NAT IP address cannot be used by any other DNAT or SNAT entries.

        • If a NAT gateway is configured with both a DNAT IP mapping and an SNAT entry, the ECS instance prioritizes using the NAT IP address from the DNAT IP mapping to access external networks.

      • Specific Port: This is a port mapping. It forwards requests to the NAT IP address to a specified port on the destination ECS instance based on a specified protocol and port. Configure the Frontend Port (the port on the NAT IP accessed by the external network), the Backend Port (the port of the mapped destination ECS instance), and the Protocol (the protocol for the forwarded port).

        • The port range must be between 1 and 65535. Forwarding within a port range is not supported.

        • To use a port greater than 1024 on a NAT IP with an existing SNAT entry, you must Remove Port Limits because the default SNAT port allocation range is 1025–65535.

          Important

          Enabling port override may cause brief interruptions to existing SNAT connections, which can be restored by reconnecting. Proceed with caution.

    After creation, you can click Edit in the Actions column of the target entry to modify the NAT IP address, private IP address, and port settings.

    API

    Clean up resources

    You are charged an instance fee from creation to release, and a Capacity Unit (CU) fee when the gateway processes traffic. To avoid unnecessary charges, clean up resources you no longer need:

    Console

    1. Delete configured entries: On the instance details page, go to the SNAT and DNAT tabs and delete the configured entries.

    2. Delete NAT IP addresses:

      • Manually added NAT IP addresses: On the instance details page, go to the NAT IP Address tab, click Delete in the Actions column of the target NAT IP address, or select multiple NAT IP addresses and click Delete at the bottom of the page.

      • NAT IP addresses added by using an IP Prefix: On the instance details page, go to the NAT IP Address tab, select NAT IP prefix, and click Delete in the Actions column of the target NAT IP Prefix. This deletes the NAT IP Prefix and all of its associated NAT IP addresses.

    3. Delete a new NAT IP CIDR block: On the instance details page, go to the NAT IP Address tab and click the Delete icon to the right of the target NAT IP CIDR block.

    4. Delete the VPC NAT Gateway: Click Delete in the Actions column of the target instance.

      If you have not deleted the associated NAT IP addresses and entries, you can select Force Delete (Delete the NAT gateway and associated SNAT/DNAT entries) to delete the instance and all related resources at once.

      On the instance details page, you can enable Deletion Protection to prevent accidental deletion. To delete the instance, you must first disable deletion protection.

    API

    1. Call DeleteSnatEntry and DeleteForwardEntry to delete SNAT and DNAT entries, respectively.

    2. Call DeleteNatIp to delete NAT IP addresses.

    3. Call DeleteNatIpCidr to delete a NAT IP CIDR block.

    4. Call DeleteNatGateway to delete a VPC NAT Gateway.

    Production environment considerations

    Best practices

    • Network planning: For easier route management, plan and use a dedicated vSwitch for the VPC NAT Gateway.

    • Fine-grained control: Use SNAT entries with vSwitch-level or ECS-level granularity. Follow the principle of least privilege by granting access only to resources that need to access external networks.

    • High availability and disaster recovery: VPC NAT Gateway supports cross-zone disaster recovery (default) and single-zone disaster recovery. In cross-zone mode, the gateway deploys redundantly across zones with automatic failover. Single-zone mode deploys within one zone at lower cost, suitable for scenarios where business services already have availability zone separation.

    Risk management

    • Security group configuration: The VPC NAT Gateway performs address translation, but backend ECS instance security relies on security groups and network ACLs. Configure strict inbound security group rules, allowing only necessary ports.

    • Monitoring and alerts: Configure alert rules for key VPC NAT Gateway metrics such as concurrent connections and inbound/outbound bandwidth to receive timely notifications and scale resources as needed.

    • Connection limits: The maximum concurrent connections per destination is N × 55,000, where N is the number of NAT IP addresses configured in the SNAT entry. Plan sufficient NAT IP addresses and monitor the port allocation failure drops metric.

    More information

    Billing

    VPC NAT Gateway is billed based on instance fees and Capacity Unit (CU) fees.

    image

    Quotas

    Quota ID

    Description

    Default limit

    Increase quota

    natgw_quota_nat_num_per_vpc

    The number of NAT gateways that can be created in a single VPC.

    5

    Go to the Quota Management page or Quota Center to request a quota increase.

    natgw_quota_nat_ip_num_per_vpc_nat

    The number of NAT IP addresses that can be created for each VPC NAT Gateway.

    15

    natgw_quota_snat_entry_num

    The number of SNAT entries that can be created in each NAT gateway.

    40

    natgw_quota_dnat_entry_num

    The number of DNAT entries that can be created in each NAT gateway.

    100