NATgateways

A NAT gateway is a managed network appliance that enables resources in a private subnet to access external networks, such as the internet, while preventing unsolicited inbound connections from those networks. It performs network address translation by mapping private IP addresses to a public IP address for outbound traffic and translating replies back to the originating private address. In most cloud environments, the gateway is deployed in a public subnet and assigned a public IP address.

Traffic from private subnets is routed to the NAT gateway via the cloud provider’s route tables. The gateway then translates the source IP and forwards the request to the internet, and the responses are translated back and delivered to the private host. Inbound connections initiated from the internet are not allowed through the NAT gateway; only replies to outbound requests are permitted. NAT gateways are designed to scale automatically and are typically managed by the cloud provider.

NAT gateways differ from NAT instances. A NAT instance is a traditional virtual machine you configure yourself, which can offer more customization but requires ongoing maintenance and capacity planning. A NAT gateway is a fully managed service with built-in high availability and simpler operation, typically priced by hour and by data processed. Availability and performance characteristics vary by platform and region.

Typical use cases include enabling software updates for private servers, outbound access for private subnets, and centralized egress control. Security considerations include using route tables, security groups, and network ACLs to control traffic to and from the NAT gateway. If inbound access to private resources is required, alternatives such as public load balancers or bastion hosts should be used.