We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningIntermediate · Cloud Infrastructure
Network Address Translation gateway: allows instances in a private subnet to access the internet while preventing inbound connections. Keeps your backend servers invisible to the public.
In short
A NAT gateway is a managed network device that lets servers in a private subnet make outbound connections to the internet (for example to download updates or call an external API) while blocking anyone on the internet from starting a connection back to them. It does this by translating the private IP addresses of your servers into a single shared public IP on the way out.
In short
A NAT gateway is a managed network device that lets servers in a private subnet make outbound connections to the internet (for example to download updates or call an external API) while blocking anyone on the internet from starting a connection back to them. It does this by translating the private IP addresses of your servers into a single shared public IP on the way out.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers NAT Gateway across a run of lessons, not one page. These 4 alone are about 88 minutes of step-by-step reading, every one with a quiz.
Managed NAT for private subnets, outbound internet without inbound exposure.
The door between your private cloud network and the public internet.
Network Address Translation, how millions of devices share a single public IP address.
Every mechanism in this chapter running in one component in front of everything, what that concentration costs, and how to keep it from becoming an application.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with NAT Gatewaypay once,
yours for life
NAT stands for Network Address Translation. A NAT gateway sits at the edge of a private network and rewrites the source IP address of outbound packets so they appear to come from one public IP instead of from the many private IPs behind it.
The point is asymmetry. Your backend servers (database hosts, application workers, build runners) live in a private subnet with addresses like 10.0.2.15 that are not routable from the public internet. They still need to reach out: pull a Docker image, install an OS patch, send a webhook to Stripe. The NAT gateway gives them a path out without giving the outside world a path in.
Because the translation only sets up state for connections that start from inside, an attacker scanning the internet has nothing to connect to. There is no public IP mapped to your private hosts that they can target directly.
When a private server sends a packet to an external address, the route table sends it to the NAT gateway instead of straight to the internet. The gateway swaps the private source IP and port for its own public IP and a port it picks, and it records that mapping in a translation table.
When the reply comes back to the gateway's public IP on that port, the gateway looks up the table, rewrites the destination back to the original private IP and port, and forwards it inside. This is often called PAT, port address translation, because many private hosts share one public IP distinguished only by port number. A single public IP supports tens of thousands of simultaneous connections this way.
On AWS the NAT gateway lives in a public subnet, holds an Elastic IP, and the private subnet's route table points 0.0.0.0/0 at it. The public subnet in turn routes to an internet gateway. The flow is private host to NAT gateway to internet gateway to internet, and back the same way.
Use a NAT gateway when private instances need outbound internet access but must never accept inbound connections. That covers most app and data tiers in a well segmented network.
The main trade-off is cost. A managed NAT gateway is not free: AWS charges roughly 0.045 dollars per hour plus about 0.045 dollars per gigabyte processed, so a chatty workload pushing terabytes through it can run into hundreds or thousands of dollars a month. Teams often cut this by routing traffic to AWS services through VPC endpoints, which skip the NAT gateway entirely.
It is also not a firewall and not a load balancer. It only handles outbound-initiated flows. For inbound traffic you still need a load balancer or a reverse proxy in a public subnet. For high availability you deploy one NAT gateway per availability zone, because a zonal gateway is a single point of failure for that zone.
Picture a typical three tier app on AWS. A public-facing Application Load Balancer sits in the public subnet. Behind it, EC2 instances or ECS tasks run in a private subnet, and an RDS database sits in a third, even more locked down subnet.
Users reach the app through the load balancer, never touching the private instances directly. But those instances still need to send transactional email through SES, fetch a secret from an external vault, and run nightly OS updates. All of that outbound traffic exits through the NAT gateway under one Elastic IP.
If you later need an external partner to allowlist your servers by IP, you give them that one Elastic IP. Every server behind the gateway shows up to the partner as the same address, which is exactly what makes IP allowlisting practical at scale.
Amazon Web Services
Offers NAT Gateway as a fully managed VPC component, the most common way private subnets reach the internet on AWS.
Google Cloud
Provides Cloud NAT as a software-defined, regional managed service so private VMs and GKE pods get outbound access without external IPs.
Microsoft Azure
Ships Azure NAT Gateway, which gives a subnet outbound connectivity through a static public IP and avoids SNAT port exhaustion.
Kubernetes on managed clouds
EKS and GKE node pools in private subnets pull container images and reach control planes through a NAT gateway by default.
An internet gateway gives a subnet full two way internet access, so resources there can both initiate and receive connections and need public IPs. A NAT gateway only allows outbound-initiated traffic and hides private IPs, so the hosts behind it stay unreachable from the internet.
It blocks unsolicited inbound connections as a side effect of only tracking outbound-initiated flows, but it is not a firewall. You still need security groups, network ACLs, or a dedicated firewall for real inbound filtering and inspection.
AWS charges per hour and per gigabyte processed, so high-volume outbound traffic adds up fast. The usual fix is to send traffic to AWS services like S3 and DynamoDB through VPC endpoints, which bypass the NAT gateway and avoid the data processing fee.
For production, yes. A NAT gateway is zonal, so if its availability zone fails, private subnets routed to it lose outbound access. Deploying one per zone and routing each zone to its local gateway removes that single point of failure.
No. It only supports connections started from inside the private network. To accept inbound traffic you put a load balancer or reverse proxy in a public subnet, and that forwards requests to your private instances.
VPC
Virtual Private Cloud: a logically isolated section of the cloud where you launch resources in a virtual network you define. Controls IP ranges, subnets, route tables, and gateways.
IP
Internet Protocol: the addressing scheme that routes packets across the internet. Every device gets an IP address (IPv4 or IPv6) so packets know where to go.
Reverse Proxy
A server in front of your web servers that receives every request first, passes it to one of them and returns the answer. It handles TLS, load balancing, caching and routing, and hides the servers behind it.
Virtual Machine
A software emulation of a physical computer running its own OS on shared hardware. Heavier than containers but provides stronger isolation.
Hypervisor
Software that creates and manages virtual machines by abstracting physical hardware. Type 1 (bare-metal) runs directly on hardware; Type 2 runs on an OS.
Cloud Region
A geographic area containing one or more data centers (availability zones). Choosing the right region reduces latency and satisfies data residency requirements.
This page explains the idea. The "NAT Gateway" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the NAT Gateway lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about NAT Gateway in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
