> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/network-services/nat-gateway/how-tos/configure-guest-os.md).

# Configure the Guest OS to Use the NAT Gateway

Configure the guest OS to use the IONOS CLOUD NAT Gateway: routing, DNS, bastion access, and troubleshooting for Linux server, Netplan for Ubuntu, NetworkManager for Rocky Linux and AlmaLinux

After you provision a NAT gateway and its Source NAT (SNAT) rules, each [<mark style="color:blue;">Virtual Machine (VM)</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#vm) behind the gateway must be configured to route outbound traffic through it. <code class="expression">space.vars.ionos\_cloud</code> does not inject a default route or DNS servers into the guest operating system (OS), so you must configure the network settings manually within each VM. This page covers guest OS configuration for Linux server, how to access VMs behind the gateway, and troubleshooting.

{% hint style="info" %}
**Prerequisites:**

* A provisioned NAT gateway with at least one SNAT rule. If you have not set one up yet, see [<mark style="color:blue;">Configure a NAT Gateway</mark>](/cloud/network-services/nat-gateway/how-tos/configure-nat-gateway.md).
* A VM attached to the private LAN connected to the NAT gateway.
* Secure Shell (SSH) access to the VM (through a bastion host) or access using the [<mark style="color:blue;">Data Center Designer (DCD)</mark>](https://dcd.ionos.com) Remote Console.
* `sudo` or administrator rights within the VM.
  {% endhint %}

Before you start, note the following values from your setup:

| **Value**                                                                             | **Source**                                                                                                                                                                                                             |
| ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| NAT gateway LAN IP address (the private IP address of the NAT gateway on the LAN)     | Log in to the DCD > **NAT Gateway** > **Gateway IPs** tab. For more information, see [<mark style="color:blue;">Configure a NAT Gateway</mark>](/cloud/network-services/nat-gateway/how-tos/configure-nat-gateway.md). |
| VM private IP address and interface name (for example, `ens6`, `eth0`, or `Ethernet`) | Within the VM: `ip -brief addr` (Linux)                                                                                                                                                                                |

In the following examples, replace the placeholders with your own values:

| **Placeholder**  | **Value**                      |
| ---------------- | ------------------------------ |
| `10.7.222.225`   | The NAT gateway LAN IP address |
| `10.7.222.11/24` | The VM private address         |
| `ens6`           | The VM interface name          |

## Linux

### Quick setup

The following commands take effect immediately but are not persistent across restarts. Use them to validate the setup first, then persist the configuration using the appropriate method for your distribution.

```bash
sudo ip route add default via 10.7.222.225
sudo printf 'nameserver 1.1.1.1\nnameserver 8.8.8.8\n' | sudo tee /etc/resolv.conf
```

To confirm the NAT gateway is working, see [<mark style="color:blue;">Verify the configuration</mark>](#verify-the-configuration). If all three checks pass, persist the configuration using the method for your distribution: **Netplan for Ubuntu 22.04 and later**, or **NetworkManager for RHEL-based distributions such as Rocky Linux and AlmaLinux**.

{% tabs %}
{% tab title="Netplan (Ubuntu)" %}

1. Check the interface ID used by the existing Netplan configuration:

```bash
sudo cat /etc/netplan/50-cloud-init.yaml
```

Use the same ID (for example, `ens6`) in the next step. If the IDs differ, Netplan treats them as two definitions of the same Network Interface Controller (NIC) and they can conflict.

2. Create a drop-in file that adds only the default route and DNS servers. The VM keeps its DHCP-assigned address.

```bash
sudo tee /etc/netplan/60-nat-route.yaml > /dev/null <<'EOF'
network:
  version: 2
  ethernets:
    ens6:
      dhcp4: true
      routes:
        - to: default
          via: 10.7.222.225
      nameservers:
        addresses: [1.1.1.1, 8.8.8.8]
EOF
sudo chmod 600 /etc/netplan/60-nat-route.yaml
```

3. Apply the configuration:

```bash
sudo netplan try
```

`netplan try` rolls back automatically after 120 seconds unless you confirm, so you cannot lock yourself out over SSH. Press **Enter** to keep the change.

{% hint style="info" %}
**Note:** On some cloud images, `/etc/resolv.conf` is a stub managed by systemd-resolved. After `netplan try`, systemd-resolved picks up the `nameservers:` block from the YAML and updates the stub. If DNS lookups fail immediately after applying, wait a few seconds and retry. If the issue persists, run `resolvectl status` to confirm that the configured nameservers appear on the correct interface.
{% endhint %}

To confirm the NAT gateway is working, see [<mark style="color:blue;">Verify the configuration</mark>](#verify-the-configuration).
{% endtab %}

{% tab title="NetworkManager (RHEL)" %}

1. Find the active connection name:

```bash
nmcli connection show --active
```

2. Apply the network configuration. Replace `<connection-name>` with the connection name from step 1:

```bash
sudo nmcli connection modify "<connection-name>" \
    ipv4.method manual \
    ipv4.addresses 10.7.222.11/24 \
    ipv4.gateway 10.7.222.225 \
    ipv4.dns "1.1.1.1 8.8.8.8"

sudo nmcli connection up "<connection-name>"
```

To confirm the NAT gateway is working, see [<mark style="color:blue;">Verify the configuration</mark>](#verify-the-configuration).
{% endtab %}
{% endtabs %}

## Verify the configuration

Run the following commands on the VM to confirm that the NAT gateway is being used for outbound traffic.

```bash
# 1. Default route is set to the NAT gateway LAN IP address
ip route
# Expected: default via 10.7.222.225 dev ens6

# 2. DNS is functional
getent hosts docs.ionos.com

# 3. Outbound traffic reaches the Internet via the NAT gateway public IP address
curl -4 -s https://ifconfig.me; echo
# Expected: the public IP address assigned to the NAT gateway
```

{% hint style="success" %}
**Result:** All three checks pass. The NAT gateway is fully configured for this VM. Outbound traffic is routed through the NAT gateway and exits through its assigned public IP address.
{% endhint %}

## Access VMs behind the NAT gateway

The NAT gateway is outbound-only. It does not accept unsolicited inbound connections. To reach a VM behind the NAT gateway for SSH or Remote Desktop Protocol (RDP) access, you must go through a bastion host. A bastion host is a second VM attached to the same LAN with its own public IP address and a firewall rule permitting the required inbound protocol.

### SSH ProxyJump (recommended)

From your workstation, open one SSH session that hops through the bastion to the target VM in a single command:

```bash
ssh -J <USER>@<BASTION_PUBLIC_IP> <USER>@10.7.222.11
```

To persist this configuration, add the following block to `~/.ssh/config`:

```
Host bastion
    HostName <BASTION_PUBLIC_IP>
    User <USER>
    IdentityFile ~/.ssh/id_ed25519

Host natvm
    HostName 10.7.222.11
    User <USER>
    IdentityFile ~/.ssh/id_ed25519
    ProxyJump bastion
```

After saving the file, connect with:

```bash
ssh natvm
```

Your SSH private key remains on your workstation. The bastion only relays the encrypted TCP connection.

### DCD Remote Console

If SSH is unavailable, for example before the guest OS has been configured, use the built-in Remote Console in the DCD to log in with the credentials set at VM creation. To reset a lost password, stop the VM and use the **Reset Password** action.

## Troubleshooting

| **Symptom**                                                                              | **Likely cause and fix**                                                                                                                                                                                                                    |
| ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ip route` shows only the on-link /24 subnet with no default route                       | The guest OS is not configured. Follow the steps mentioned above to configure your OS.                                                                                                                                                      |
| `curl -4 ifconfig.me` returns nothing or times out                                       | The default route is missing, or the SNAT rule Source Subnet does not include this VM IP address. In the DCD, open the NAT Gateway element > **NAT Rules** tab, and confirm that the **Source Subnet** covers this VM's private IP address. |
| `curl -4 ifconfig.me` returns a public IP address that is not the NAT gateway IP address | The VM has its own public IP address taking priority over the NAT route. Detach the public IP address, or lower its route metric.                                                                                                           |
| Numeric IP address requests work but DNS lookups fail                                    | `/etc/resolv.conf` is empty or missing nameservers. Repopulate it using the quick setup `printf` command.                                                                                                                                   |
| DNS worked, then broke after `sudo netplan try`                                          | systemd-resolved reset the resolv.conf stub. Pin resolvers through the Netplan `nameservers:` block, or overwrite `/etc/resolv.conf` directly.                                                                                              |
| A ping from the bastion to the target VM succeeds, but SSH fails                         | The Cloud Firewall on the target VM NIC is missing an inbound rule for TCP/22. Add one in the DCD.                                                                                                                                          |
| SSH from the bastion to the target returns `Permission denied (publickey)`               | The bastion does not hold the SSH private key for the target VM. Use `ssh -J` from your workstation, or forward the SSH agent with `ssh -A`.                                                                                                |
| Remote Console prompts for a password you did not set                                    | Stop the VM in the DCD and use **Reset Password** to generate a new one.                                                                                                                                                                    |

## Next steps

* [<mark style="color:blue;">Limitations</mark>](/cloud/network-services/nat-gateway/overview/limitations.md)
* [<mark style="color:blue;">Flow Logs</mark>](/cloud/network-services/flow-logs.md)
* [<mark style="color:blue;">Delete a Managed NAT Gateway</mark>](/cloud/network-services/nat-gateway/how-tos/delete-nat-gateway.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ionos.com/cloud/network-services/nat-gateway/how-tos/configure-guest-os.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.