> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/home/network-services/nat-gateway/overview.md).

# Overview

IONOS CLOUD NAT Gateway: enable outbound Internet access for VMs without exposing them to inbound traffic

The Managed Network Address Translation (NAT) gateway allows [<mark style="color:blue;">Virtual Machines (VMs)</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#vm) within a [<mark style="color:blue;">Virtual Data Center (VDC)</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#vdc) to access the Internet without requiring a public network interface.

The NAT gateway can act as a default gateway for private networks allowing VMs to initiate connections to the Internet and receive a response (Source NAT (SNAT)). The gateway does not accept inbound connections initiated from the Internet (Destination NAT (DNAT)) and the VMs are "hidden"; hence protecting them from being exposed to Internet threats.

Using a NAT gateway increases security, simplifies the VDC architecture, requires only one public [<mark style="color:blue;">IP address</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#ip-address), and has a fully managed service. For example, a NAT gateway can be used to connect private VMs to public repositories, for software updates, or to NTP (Network Time Protocol) servers. You can use the [<mark style="color:blue;">Backup Service</mark>](/cloud/home/backup-and-storage/backup-service.md) for private VMs. In this case, the VM need not publish any service to the Internet, but only needs to consume services from the Internet. Furthermore, the NAT gateway can be configured only to allow access to specific and trusted Internet services, protecting the application from malicious public endpoints.

For a full list of NAT gateway features and benefits, see [<mark style="color:blue;">Features and Benefits</mark>](/cloud/home/network-services/nat-gateway/overview/features-benefits.md). Managed NAT Gateway is available in all <code class="expression">space.vars.ionos\_cloud</code> data center locations. For the full list, see the [<mark style="color:blue;">Service Catalog</mark>](https://docs.ionos.com/cloud/support/general-information/service-catalog#public-cloud-locations).

## Choosing the right approach

Use this table to decide when Managed NAT Gateway is the right choice versus other IONOS CLOUD networking options.

| **Approach**                                                                                                        | **Use when**                                                                                  | **Not suitable when**                                              |
| ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
| **Managed NAT Gateway**                                                                                             | Multiple private VMs need outbound Internet access without public IP addresses.               | You need inbound connections from the Internet to reach those VMs. |
| **Public NIC**                                                                                                      | A single VM needs full bidirectional Internet access and a fixed public IP address.           | You want to keep VMs hidden from the Internet.                     |
| [<mark style="color:blue;">**Network Load Balancer**</mark>](/cloud/home/network-services/network-load-balancer.md) | You must distribute inbound traffic across multiple VMs, or require DNAT and port forwarding. | You only need outbound access with no inbound requirements.        |
| [<mark style="color:blue;">**VPN Gateway**</mark>](/cloud/home/network-services/vpn-gateway.md)                     | You need encrypted site-to-site connectivity between an on-premises network and your VDC.     | You need general outbound Internet access for VMs.                 |

## How a NAT gateway works

The following diagram shows how traffic flows between private VMs, the NAT gateway, and the Internet.

The VMs sit in a private LAN within a Virtual Data Center (VDC) and have no public Network Interface Controller (NIC), so they have no route to the Internet of their own. The NAT gateway is a separate resource in the same VDC. It has two addresses: a private gateway IP address on the LAN, which the VMs use as their route out, and one or more reserved public IP addresses, which the Internet sees.

Traffic moves through the gateway in three stages:

1. **The VM sends traffic out:** A static route in the guest OS directs the packet to the private gateway IP address of the NAT gateway. The route is not injected automatically, so you must add it within each VM.
2. **The gateway applies the SNAT rule:** The source address of the packet is rewritten from the VM's private address to the public IP address of the gateway. A rule can restrict the protocol, the target subnet, and the target port range, so the VMs reach only the services you allow.
3. **The response comes back:** Replies on connections the VM started are translated back to the original private address and returned to the VM.

Because the gateway performs SNAT only, this flow works in one direction. Connections that the Internet initiates are not translated and have nowhere to go, so they are dropped at the edge of the VDC. The private VMs are not reachable from the Internet, which is what allows them to consume external services, such as package repositories, NTP servers, and the Backup Service, without being exposed to them.

{% hint style="info" %}
**Note:**

* The addresses in the diagram are examples. `10.7.228.225` is the private gateway IP address, and `185.48.117.20` is the reserved public IP address. Substitute the values from your own VDC.
* Private VMs reach the Internet through the gateway's public IP address. Connections initiated from the Internet are dropped.
  {% endhint %}

<figure><picture><source srcset="https://1737632334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MifAzdGvKLDTtvJP8sm%2Fuploads%2Fgit-blob-81e364dfaa5bb57fb250658e84cae19e187c6888%2Fnat-gateway-architecture-dark.webp?alt=media" media="(prefers-color-scheme: dark)"><img src="https://1737632334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MifAzdGvKLDTtvJP8sm%2Fuploads%2Fgit-blob-5c5dfa193c8bd42c4e4cf24fd3dd4ee334b6ce0e%2Fnat-gateway-architecture-light.webp?alt=media" alt="Managed NAT Gateway diagram: three VMs in the private LAN 10.7.228.0/24 send traffic through the NAT gateway at 10.7.228.225, which uses SNAT to reach the Internet with the public IP address 185.48.117.20. Replies return through the gateway, and connections started from the Internet are blocked at the gateway."></picture><figcaption><p>Traffic flow through the Managed NAT Gateway</p></figcaption></figure>

## Workflow

1. [<mark style="color:blue;">Reserve a public IPv4 address</mark>](/cloud/home/network-services/vdc-networking/ip-address/ipv4/how-tos/reserve-ipv4.md) to assign to the NAT gateway.
2. [<mark style="color:blue;">Create and provision the NAT gateway</mark>](/cloud/home/network-services/nat-gateway/how-tos/configure-nat-gateway.md) in your VDC.
3. [<mark style="color:blue;">Create SNAT rules</mark>](/cloud/home/network-services/nat-gateway/how-tos/configure-nat-gateway.md) for the traffic the gateway translates.
4. [<mark style="color:blue;">Configure the guest OS</mark>](/cloud/home/network-services/nat-gateway/how-tos/configure-guest-os.md) of each VM to route outbound traffic through the NAT gateway.

## Routing tables

The routing table must be modified for private VMs to send traffic to the NAT gateway. The default route must point to the NAT gateway or, if that is not an option, a dedicated route must be created for every service or target to be consumed from the Internet.

{% hint style="info" %}
**Note:**

Ensure proper UDP SNAT rules are configured if [<mark style="color:blue;">DNS resolution</mark>](/cloud/home/network-services/vdc-networking/networks-faq.md#do-you-have-a-dns-resolver) is required for a VM routed through the SourceNAT gateway. Failing to do so may result in the default DNS resolution **not working**.
{% endhint %}

## Maintenance window

<code class="expression">space.vars.ionos\_cloud</code> regularly maintains the Managed NAT Gateway to provide the latest software versions and features. To apply these updates, <code class="expression">space.vars.ionos\_cloud</code> reserves a weekly maintenance window every Monday between 02:00 and 04:00 AM (local time of the hosting data center).

During this window, a service interruption of up to 5 seconds may occur. Aside from this brief pause, the gateway will continue operating as configured with no further service impact. Urgent updates, such as critical security patches, may occasionally be deployed outside of this scheduled window.

## Next steps

* [<mark style="color:blue;">Features and Benefits</mark>](/cloud/home/network-services/nat-gateway/overview/features-benefits.md)
* [<mark style="color:blue;">Limitations</mark>](/cloud/home/network-services/nat-gateway/overview/limitations.md)
* [<mark style="color:blue;">Configure a NAT Gateway</mark>](/cloud/home/network-services/nat-gateway/how-tos/configure-nat-gateway.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ionos.com/cloud/home/network-services/nat-gateway/overview.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.