> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/home/network-services/nat-gateway/nat-gateway-faq.md).

# FAQ

Frequently asked questions about IONOS CLOUD Managed NAT Gateway: setup, networking, access, DNS, security, integrations, and troubleshooting

## General

### What is a Managed NAT Gateway?

The Managed Network Address Translation (NAT) gateway lets [<mark style="color:blue;">VMs</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#vm) inside a Virtual Data Center ([<mark style="color:blue;">VDC</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#vdc)) reach the Internet without a public network interface. It acts as a default gateway for private networks, translating private IP addresses to a public IP address (Source NAT or SNAT) for outbound traffic, while blocking all unsolicited inbound connections from the Internet. For more information, see [<mark style="color:blue;">Overview</mark>](/cloud/home/network-services/nat-gateway/overview.md).

### Does the NAT gateway allow inbound connections from the Internet?

No. The Managed NAT Gateway performs Source NAT (SNAT) only. Connections initiated from the Internet (Destination NAT, or DNAT) are not accepted, which keeps your private VMs from being exposed to Internet threats. Return traffic for established outbound sessions works normally. If you must publish a service, use a [<mark style="color:blue;">Network Load Balancer</mark>](/cloud/home/network-services/network-load-balancer.md) or a public Network Interface Controller (NIC) instead.

### What protocols does the NAT gateway support?

The NAT gateway supports TCP, UDP, and ICMP. When you create a SNAT rule you can also select **ALL** to apply the rule to all supported protocols. Target port ranges can only be applied to TCP and UDP rules.

### How many private networks can I connect to a NAT gateway?

A NAT gateway supports up to six private networks (LANs).

### How many NAT gateways can I have?

The default resource limit is five NAT gateways per account, and you can deploy multiple NAT gateways per VDC. If you need a higher limit, contact [<mark style="color:blue;">IONOS CLOUD Support</mark>](https://docs.ionos.com/cloud/support/general-information/contact-information).

### Can I assign multiple public IP addresses to a NAT gateway?

Yes. You can assign multiple [<mark style="color:blue;">reserved public IP addresses</mark>](/cloud/home/network-services/vdc-networking/ip-address/ipv4/how-tos/reserve-ipv4.md) to a single NAT gateway and define multiple SNAT rules, each masking traffic behind a chosen public IP address.

### Is the NAT gateway highly available?

Yes. The service is deployed across multiple Availability Zones in a region, so outbound connectivity continues even if a single component fails. The service also scales automatically to accommodate growing traffic demands.

### What is the difference between NAT Gateway and VPN Gateway?

Managed NAT Gateway provides outbound-only Internet access for private VMs. It translates private IP addresses to a public IP (SNAT) so VMs can reach the Internet without being reachable from it. [<mark style="color:blue;">VPN Gateway</mark>](/cloud/home/network-services/vpn-gateway.md) creates an encrypted tunnel between your VDC and an external network, such as an on-premises site or another cloud. Use NAT Gateway for general Internet access from private VMs; use VPN Gateway when you need secure, private connectivity between two networks.

### What is the difference between NAT Gateway and Network Load Balancer?

Managed NAT Gateway handles outbound traffic only. It lets private VMs initiate connections to the Internet. [<mark style="color:blue;">Network Load Balancer</mark>](/cloud/home/network-services/network-load-balancer.md) distributes inbound traffic across multiple VMs and supports DNAT and port forwarding. If you must expose a service to the Internet on a specific port, use a Network Load Balancer. If you only need private VMs to reach the Internet, use NAT Gateway.

### Which regions support Managed NAT Gateway?

Managed NAT Gateway is available in all <code class="expression">space.vars.ionos\_cloud</code> data center locations. For the full list of locations, see the [<mark style="color:blue;">Service Catalog</mark>](https://docs.ionos.com/cloud/support/general-information/service-catalog#public-cloud-locations).

### How much does Managed NAT Gateway cost?

Pricing depends on your usage. For detailed pricing information, refer to the [<mark style="color:blue;">Price List</mark>](https://docs.ionos.com/cloud/support/general-information/price-list). You can also estimate costs using the [<mark style="color:blue;">Cloud Price Calculator</mark>](https://cloud-price-calculator.ionos.com/).

## Setup and configuration

### What permissions are required to create a NAT gateway?

Only contract owners, administrators, or users with the **Create Internet Access** permission can provision a NAT gateway. Other user types have read-only access and cannot provision changes.

### When can I configure NAT rules?

You must provision the NAT gateway first before you can configure NAT rules. Provision your changes first, then open the **NAT Rules** tab and create your SNAT rules.

### Does the NAT gateway automatically configure routing inside my VMs?

No. <code class="expression">space.vars.ionos\_cloud</code> does not inject a default route or DNS servers into the guest OS. After provisioning the NAT gateway, you must manually configure the default route and DNS resolvers inside each VM. For step-by-step instructions, see [<mark style="color:blue;">Configure the Guest OS to Use the NAT Gateway</mark>](/cloud/home/network-services/nat-gateway/how-tos/configure-guest-os.md).

### How do I delete a NAT gateway using the DCD?

Select the NAT Gateway element in the Workspace, delete all SNAT rules from the **NAT Rules** tab, then delete the element and provision your changes. For the full steps and warnings, see [<mark style="color:blue;">Delete a Managed NAT Gateway</mark>](/cloud/home/network-services/nat-gateway/how-tos/delete-nat-gateway.md).

### How do I restrict a VM to only specific Internet destinations?

When creating an SNAT rule, set a specific IP address or subnet in the **Target** > **Subnet** field. Optionally, set a port range in **Target** > **Port range** to restrict access to a specific port or range of ports. For example, to limit VMs so they can only send HTTPS traffic to a specific external API gateway, set the target subnet to `198.51.100.0/24` and both the start and end port to `443`. Port ranges apply to TCP and UDP only. A VM limited this way can't resolve DNS or run the checks in [<mark style="color:blue;">Verify the configuration</mark>](/cloud/home/network-services/nat-gateway/how-tos/configure-guest-os.md#verify-the-configuration) unless you add SNAT rules for that traffic.

## Networking and routing

### Can I connect a public LAN to the NAT gateway?

No. Only private LANs can be connected to a Managed NAT Gateway.

### Can I change a LAN from private to public while it is connected to a NAT gateway?

No. You cannot change a LAN attribute from "private" to "public" while the LAN is connected to a Managed NAT Gateway. You must detach the LAN from the NAT gateway first.

### Does the NAT gateway support IPv6?

No. The NAT gateway currently translates IPv4 addresses only. IPv6 SNAT is not supported.

### Can I use the NAT gateway to expose a service to the Internet (port forwarding)?

No. The NAT gateway does not support Destination NAT (DNAT) or port forwarding. To expose a VM service on a specific public port, use a Network Load Balancer or attach a public IP address directly to the VM.

### Why is DNS not working on my VM after I configure the default route?

DNS queries use UDP. If the VM's default route points to the NAT gateway, you must have a SNAT rule that permits UDP traffic. Without it, DNS queries cannot reach external resolvers. Verify that your SNAT rules include UDP and that the **Source Subnet** covers the VM's private IP address. You must also configure a DNS resolver address (for example, `1.1.1.1` or `8.8.8.8`) inside the VM, as the NAT gateway does not provide DNS.

{% hint style="info" %}
**Note:** To restrict DNS to a single resolver, set the SNAT rule target subnet to that resolver address (for example `8.8.8.8/32`) and set both the start and end port to `53`. The VM can then reach only that resolver, and only on port 53. Update the DNS settings inside the VM to list only that resolver. Otherwise, lookups to `1.1.1.1` from the examples in [<mark style="color:blue;">Configure the Guest OS to Use the NAT Gateway</mark>](/cloud/home/network-services/nat-gateway/how-tos/configure-guest-os.md) time out. Add separate SNAT rules for any other traffic the VM needs, such as TCP port `443` for the `https://ifconfig.me` check in [<mark style="color:blue;">Verify the configuration</mark>](/cloud/home/network-services/nat-gateway/how-tos/configure-guest-os.md#verify-the-configuration).
{% endhint %}

## Access and security

### How do I SSH into a VM behind the NAT gateway?

The NAT gateway is outbound-only and does not accept inbound connections. To reach a VM through Secure Shell (SSH), you need a bastion host, which is a second VM on the same LAN with its own public IP address and a firewall rule permitting inbound TCP/22. From your workstation, use SSH ProxyJump:

```bash
ssh -J <USER>@<BASTION_PUBLIC_IP> <USER>@<VM_PRIVATE_IP>
```

For a persistent `~/.ssh/config` setup, see [<mark style="color:blue;">Configure the Guest OS to Use the NAT Gateway</mark>](/cloud/home/network-services/nat-gateway/how-tos/configure-guest-os.md).

### What if I cannot SSH into the VM at all?

Use the DCD Remote Console to log in with the credentials set at VM creation. If you do not know the password, stop the VM in the DCD and use the **Reset Password** action to generate a new one.

### Does the NAT gateway replace the Cloud Firewall?

No. The Cloud Firewall on each VM NIC applies independently of the NAT gateway. A firewall rule that blocks a port on a NIC will still block that traffic even when routing through the NAT gateway is otherwise correct.

## Maintenance

### When is the NAT gateway maintenance window?

<code class="expression">space.vars.ionos\_cloud</code> reserves a weekly maintenance window every Monday between 02:00 and 04:00 local time of the data center hosting the service.

### Is there downtime during maintenance?

A service interruption of up to five seconds may occur during the maintenance window. No further service impact is anticipated. Urgent security patches may be deployed outside the scheduled window.

## Integrations

### Can I monitor traffic passing through the NAT gateway?

Yes. Flow Logs capture IPv4 and IPv6 network traffic for NAT gateways. Logs are stored in an <code class="expression">space.vars.ionos\_cloud\_object\_storage</code> bucket. For more information, see [<mark style="color:blue;">Flow Logs</mark>](/cloud/home/network-services/flow-logs.md).

### Can I manage NAT gateways programmatically?

Yes. You can create, list, update, and delete NAT gateways and NAT rules through the Cloud API, and through configuration management tools such as Ansible and Terraform. For more information, see [<mark style="color:blue;">API How-Tos</mark>](/cloud/home/network-services/nat-gateway/api-howtos.md).

### Can I use NAT Gateway with Managed Kubernetes?

Yes. Deploy your Kubernetes worker nodes in a private subnet and route outbound traffic through a NAT Gateway. This lets nodes pull container images from registries and reach external APIs without exposing them to the Internet. For a full setup example, see [<mark style="color:blue;">Use Cases</mark>](/cloud/home/network-services/nat-gateway/use-cases.md#scenario-4-container-workloads-pulling-images-from-registries).

### Can private VMs use the Backup Service through a NAT gateway?

Yes. Because the VM only needs to consume services from the Internet rather than publish any, it can reach the [<mark style="color:blue;">Backup Service</mark>](/cloud/home/backup-and-storage/backup-service.md) from behind a NAT gateway without a public NIC.

## Troubleshooting

### What should I check if my VM has no default route after configuration?

The guest OS configuration was not applied or did not persist across a restart. Follow the steps in [<mark style="color:blue;">Configure the Guest OS to Use the NAT Gateway</mark>](/cloud/home/network-services/nat-gateway/how-tos/configure-guest-os.md) and use a persistent method (Netplan, NetworkManager, or PowerShell) appropriate for your OS.

### What should I check if `curl` times out but the route looks correct?

Open the NAT Gateway element in the DCD > **NAT Rules** tab and confirm that an SNAT rule exists with a **Source Subnet** that covers this VM's private IP address. If no rule matches, outbound traffic is not translated and is dropped.

### Why does `curl -4 ifconfig.me` return a public IP that is not the NAT gateway IP?

The VM has its own public IP address assigned, which takes routing priority over the NAT gateway route. Detach the public IP address from the VM, or adjust the route metric so the NAT gateway route is preferred.

### Why did DNS stop working after running `sudo netplan apply`?

On some Ubuntu and Debian images, systemd-resolved manages `/etc/resolv.conf` as a stub. After `netplan apply`, systemd-resolved regenerates the stub from the Netplan configuration. Wait a few seconds and retry. If the problem persists, run `resolvectl status` to confirm that the nameservers from the Netplan `nameservers:` block appear on the correct interface.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ionos.com/cloud/home/network-services/nat-gateway/nat-gateway-faq.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.