NAT Gateway
Network Address Translation gateway: allows instances in a private subnet to access the internet while preventing inbound connections. Keeps your backend servers invisible to the public.
What is NAT Gateway?
In short
A NAT gateway is a managed network device that lets servers in a private subnet make outbound connections to the internet (for example to download updates or call an external API) while blocking anyone on the internet from starting a connection back to them. It does this by translating the private IP addresses of your servers into a single shared public IP on the way out.
What a NAT gateway actually is
NAT stands for Network Address Translation. A NAT gateway sits at the edge of a private network and rewrites the source IP address of outbound packets so they appear to come from one public IP instead of from the many private IPs behind it.
The point is asymmetry. Your backend servers (database hosts, application workers, build runners) live in a private subnet with addresses like 10.0.2.15 that are not routable from the public internet. They still need to reach out: pull a Docker image, install an OS patch, send a webhook to Stripe. The NAT gateway gives them a path out without giving the outside world a path in.
Because the translation only sets up state for connections that start from inside, an attacker scanning the internet has nothing to connect to. There is no public IP mapped to your private hosts that they can target directly.
How it works under the hood
When a private server sends a packet to an external address, the route table sends it to the NAT gateway instead of straight to the internet. The gateway swaps the private source IP and port for its own public IP and a port it picks, and it records that mapping in a translation table.
When the reply comes back to the gateway's public IP on that port, the gateway looks up the table, rewrites the destination back to the original private IP and port, and forwards it inside. This is often called PAT, port address translation, because many private hosts share one public IP distinguished only by port number. A single public IP supports tens of thousands of simultaneous connections this way.
On AWS the NAT gateway lives in a public subnet, holds an Elastic IP, and the private subnet's route table points 0.0.0.0/0 at it. The public subnet in turn routes to an internet gateway. The flow is private host to NAT gateway to internet gateway to internet, and back the same way.
When to use it and the trade-offs
Use a NAT gateway when private instances need outbound internet access but must never accept inbound connections. That covers most app and data tiers in a well segmented network.
The main trade-off is cost. A managed NAT gateway is not free: AWS charges roughly 0.045 dollars per hour plus about 0.045 dollars per gigabyte processed, so a chatty workload pushing terabytes through it can run into hundreds or thousands of dollars a month. Teams often cut this by routing traffic to AWS services through VPC endpoints, which skip the NAT gateway entirely.
It is also not a firewall and not a load balancer. It only handles outbound-initiated flows. For inbound traffic you still need a load balancer or a reverse proxy in a public subnet. For high availability you deploy one NAT gateway per availability zone, because a zonal gateway is a single point of failure for that zone.
A concrete example
Picture a typical three tier app on AWS. A public-facing Application Load Balancer sits in the public subnet. Behind it, EC2 instances or ECS tasks run in a private subnet, and an RDS database sits in a third, even more locked down subnet.
Users reach the app through the load balancer, never touching the private instances directly. But those instances still need to send transactional email through SES, fetch a secret from an external vault, and run nightly OS updates. All of that outbound traffic exits through the NAT gateway under one Elastic IP.
If you later need an external partner to allowlist your servers by IP, you give them that one Elastic IP. Every server behind the gateway shows up to the partner as the same address, which is exactly what makes IP allowlisting practical at scale.
Where it is used in production
Amazon Web Services
Offers NAT Gateway as a fully managed VPC component, the most common way private subnets reach the internet on AWS.
Google Cloud
Provides Cloud NAT as a software-defined, regional managed service so private VMs and GKE pods get outbound access without external IPs.
Microsoft Azure
Ships Azure NAT Gateway, which gives a subnet outbound connectivity through a static public IP and avoids SNAT port exhaustion.
Kubernetes on managed clouds
EKS and GKE node pools in private subnets pull container images and reach control planes through a NAT gateway by default.
Frequently asked questions
- What is the difference between a NAT gateway and an internet gateway?
- An internet gateway gives a subnet full two way internet access, so resources there can both initiate and receive connections and need public IPs. A NAT gateway only allows outbound-initiated traffic and hides private IPs, so the hosts behind it stay unreachable from the internet.
- Does a NAT gateway protect against inbound attacks?
- It blocks unsolicited inbound connections as a side effect of only tracking outbound-initiated flows, but it is not a firewall. You still need security groups, network ACLs, or a dedicated firewall for real inbound filtering and inspection.
- Why is my AWS NAT gateway bill so high?
- AWS charges per hour and per gigabyte processed, so high-volume outbound traffic adds up fast. The usual fix is to send traffic to AWS services like S3 and DynamoDB through VPC endpoints, which bypass the NAT gateway and avoid the data processing fee.
- Do I need one NAT gateway per availability zone?
- For production, yes. A NAT gateway is zonal, so if its availability zone fails, private subnets routed to it lose outbound access. Deploying one per zone and routing each zone to its local gateway removes that single point of failure.
- Can a NAT gateway handle inbound traffic to my servers?
- No. It only supports connections started from inside the private network. To accept inbound traffic you put a load balancer or reverse proxy in a public subnet, and that forwards requests to your private instances.
Learn NAT Gateway hands-on
This page explains the idea. The full lesson lets you step through the ring as servers join and leave, read the implementation, and check yourself with a quiz. It is one of 760+ lessons in the System Design Masterclass, from your first API call to distributed consensus. Eleven Foundation lessons are free, no signup. Lifetime access is ₹499 in India or $7.99 worldwide, one payment, no subscription.
See also
Related glossary terms you might want to look up next.
VPC
Virtual Private Cloud: a logically isolated section of the cloud where you launch resources in a virtual network you define. Controls IP ranges, subnets, route tables, and gateways.
IP
Internet Protocol: the addressing scheme that routes packets across the internet. Every device gets an IP address (IPv4 or IPv6) so packets know where to go.
Reverse Proxy
A server that sits in front of your backend servers and forwards client requests to them. Handles SSL termination, caching, and load balancing.
Virtual Machine
A software emulation of a physical computer running its own OS on shared hardware. Heavier than containers but provides stronger isolation.
Hypervisor
Software that creates and manages virtual machines by abstracting physical hardware. Type 1 (bare-metal) runs directly on hardware; Type 2 runs on an OS.
Cloud Region
A geographic area containing one or more data centers (availability zones). Choosing the right region reduces latency and satisfies data residency requirements.