Configure an internet NAT gateway for SAE applications - Serverless App Engine

SAE application instances do not have public IP addresses and cannot directly access the internet. Create an internet NAT gateway in the VPC of your SAE application to enable outbound internet access for all instances.

When SAE applications use an internet NAT gateway, the gateway translates the source IP addresses of all application instances into a single, static public IP address. This is ideal for most use cases, such as adding the static public IP address to a database whitelist when accessing a public database service. Commands run inside an SAE container, such as hostname -I, ifconfig, or ip addr, return the container's private IP address (for example, 192.168.x.x), not the public egress EIP of the NAT gateway. External IP lookup services such as curl ipconfig.me return the NAT EIP. Use the EIP bound to the NAT gateway when you configure a firewall whitelist. Even if you have configured a Service or Ingress to allow inbound internet access to your SAE application, you still need an internet NAT gateway for outbound internet access from your application instances.

For special scenarios where each SAE application instance requires a unique public IP address to connect to other public services, use an alternative solution: Bind an Elastic IP Address (EIP) to each SAE application instance. Note that this public IP address is dynamic, as instances can be created or destroyed at any time.

Procedure

Step 1: Create an internet NAT gateway

If no internet NAT gateway exists in the VPC where your SAE application is deployed, follow these steps to create one.

If a gateway already exists, skip this step and configure it directly. We recommend creating only one internet NAT gateway per VPC to avoid potential route conflicts.

How to find the VPC of your SAE application

An SAE application belongs to a namespace. The namespace is associated with a VPC, and all SAE application instances are deployed in that VPC. To view this information:

In the SAE application list, select the target region and namespace at the top, and then click the target Application ID to go to the application details page.
In the navigation pane on the left, click Basic Information, and then click the Application Information tab.
In the Application Information section, you can view the VPC where the application is located. Click the VPC ID to go to the VPC details page.

How to check if an internet NAT gateway exists in the VPC

On the VPC details page, click the Resource Management tab.
In the Access to Internet section, view the number of Internet NAT Gateway instances in the current VPC.
Click the instance count to go to the Internet NAT Gateway list.

Log on to the NAT Gateway console.
In the top navigation bar, select the region where you want to create the Internet NAT gateway.
On the Internet NAT Gateway page, click Create Internet NAT Gateway.
當您首次建立網際網路 NAT 閘道時，請在購買頁面的建立服務連結角色注意事項區塊中，按一下建立以建立服務連結角色。服務連結角色建立完成後，您即可建立網際網路 NAT 閘道。
如需更多資訊，請參閱服務連結角色。
Configure the following parameters, and then click Buy Now and Activate Now. For billing details, see NAT Gateway billing.
1. Region: Select the region where your SAE application is deployed.
2. Network and Zone: Select the VPC of your SAE application, the availability zone where you want to deploy the internet NAT gateway instance, and either an existing vSwitch or a new one.
3. Network Type: Select Internet NAT Gateway.
4. Elastic IP Address (EIP): Select Purchase EIP and configure the Maximum Bandwidth, or select an Select EIP EIP. The created internet NAT gateway instance is automatically bound to this Elastic IP Address (EIP) instance.
On the Internet NAT Gateway page, you can view the created internet NAT gateway instance and the bound Elastic IP Address (EIP).

Step 2: Configure an SNAT entry

On the Internet NAT Gateway page, find the NAT gateway that you want to manage and click Configure SNAT in the Actions column.
On the SNAT tab, click Create SNAT Entry.
Configure the following parameters and click OK.
1. SNAT Entry: We recommend selecting Select vSwitch and then all vSwitches where the SAE application instances are deployed.
  How to find the vSwitches of your SAE application instances
  When creating an SAE application, you select one or more vSwitches where the instances are deployed. To find the vSwitches:
  
  In the SAE application list, select the target region and namespace at the top, and then click the target Application ID to go to the application details page.
  
  In the navigation pane on the left, click Basic Information, and then click the Application Information tab.
  
  In the Application Information section, you can view one or more vSwitches where the application is located. Click a vSwitch ID to go to the vSwitch details page.
2. Select EIP: Select the public IP address of the EIP bound to your internet NAT gateway.
In the SNAT Entry List, you can view the created SNAT entry, including its source CIDR block and the translated public IP address.