> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/network-services/nat-gateway/how-tos/configure-nat-gateway.md).
# Configure a NAT Gateway
IONOS CLOUD NAT Gateway: configure a NAT gateway to give private VMs outbound Internet access in a Virtual Data Center using the DCD
Use the [Data Center Designer (DCD)](https://dcd.ionos.com) to add a Managed NAT Gateway to your [Virtual Data Center (VDC)](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#vdc), assign a reserved public IP address, connect it to a private LAN, and create Source NAT (SNAT) rules that define which outbound traffic from your private [Virtual Machines (VMs)](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#vm) is translated.
{% hint style="info" %}
**Prerequisites:** Before you begin, ensure you have the following:
* A VDC in a [supported region](https://docs.ionos.com/cloud/support/general-information/service-catalog#public-cloud-locations).
* A private LAN containing at least one VM.
* A [reserved public IPv4 address](/cloud/network-services/vdc-networking/ip-address/ipv4/how-tos/reserve-ipv4.md). Reserve it before starting, as you must assign a reserved address to the NAT gateway during setup.
* Contract administrator, owner, or **Create Internet Access** permission. Other user types have read-only access and cannot provision changes.
{% endhint %}
## Create a NAT Gateway
1\. In the **DCD**, go to **Menu** > **Virtual Data Centers**.
2\. Select the data center where you want to configure a NAT gateway.
3\. Drag at least one [VM](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#vm) from the Palette to the Workspace to create a private network containing a NAT gateway. You can select a [Dedicated Core Server](/cloud/compute-services/compute-engine/dedicated-core.md), [vCPU Server](/cloud/compute-services/compute-engine/vcpu-server.md), [Cloud GPU VM](/cloud/compute-services/compute-engine/cloud-gpu-vm.md), or a [Confidential VM](/cloud/compute-services/compute-engine/confidential-computing-vm.md).
4\. Drag a **NAT Gateway** element from the Palette to the Workspace.
5\. Connect the source network of the NAT gateway to the private network containing your VM.
6\. Set the properties of the NAT gateway by selecting the element in the Workspace and opening its properties in the Inspector pane. Specify the **Settings** and **Gateway IPs** as mentioned in the following tabs:
{% hint style="success" %}
**Note:** **NAT Rules** can be configured only after you provision your NAT gateway.
{% endhint %}
{% tabs %}
{% tab title="Settings" %}
To configure a NAT gateway, specify the following details:
1. Enter the **Name** of the NAT gateway.
2. Specify **Public IPs** by selecting a [reserved IP address](/cloud/network-services/vdc-networking/ip-address/ipv4/how-tos/reserve-ipv4.md) from the drop-down list. You can add multiple IP addresses.
{% endtab %}
{% tab title="Gateway IPs" %}
After the first provisioning, the current IP address is displayed. *(Optional)* To change the private IP address of the NAT gateway, open the **Gateway IPs** tab. To change it:
1. Select **Remove IP** from the drop-down list next to the current IP address.
2. Select **Add IP** and enter a new IP address.
{% endtab %}
{% endtabs %}
7\. Provision your changes.
{% hint style="success" %}
**Result:** The NAT Gateway is provisioned and connected to your private LAN, with the reserved public IP address assigned. Outbound traffic from your private VMs will not be translated until you create at least one SNAT rule in the next step.
{% endhint %}
### Configure NAT Rules
You must provision the NAT gateway before NAT rules can be configured. Select the **NAT Rules** tab > **Create SNAT Rule**.
Source and target rules determine which traffic the gateway translates and where it is allowed to go. **Source** identifies the private VMs or subnets whose outbound packets the gateway must translate, and which public IP masks them. **Target** optionally restricts the Internet destinations those packets can reach and, for TCP and UDP, the port range allowed. Together, they give you precise control over what leaves your private network and where it can go.
1. Enter a **Name** for the rule.
2. Select a **Protocol**: **TCP**, **UDP**, **ICMP**, or **ALL** from the drop-down list. Configure the source and target:
{% tabs %}
{% tab title="Source" %}
* **Public IP**: Select one of the public IP addresses assigned to the NAT gateway. This address masks the source address of outgoing packets.
* **Subnet**: Enter an individual IP address or a complete subnet in Classless Inter-Domain Routing (CIDR) notation (example: `10.10.10.0/24`) for the VM or network covered by this rule.
{% endtab %}
{% tab title="Target" %}
* **Subnet**: Enter an individual IP address or a complete subnet in CIDR notation (example: `8.8.8.0/24`) to restrict Internet access to a specific destination.
* **Port range** *(optional)*: Enter a start and end port to restrict access to a specific port or range. Port ranges apply to TCP and UDP only. For example, to limit VMs to Google DNS, enter `8.8.8.8/32` as the target subnet and `53` for both the start and end port.
{% endtab %}
{% endtabs %}
3. Select **Create** to save the rule.
4. Provision your changes.
{% hint style="success" %}
**Result:** The SNAT rule is active. The NAT Gateway now translates outbound traffic from the source subnet you defined, masking it behind the public IP address you selected. Traffic that matches the target subnet and port range (if specified) is forwarded to the Internet; traffic that does not match any rule is dropped.
**Note:** The NAT gateway does not inject a default route or DNS servers into the guest OS. After provisioning, configure the network settings manually inside each VM. For step-by-step instructions for Linux, see [Configure the Guest OS to Use the NAT Gateway](/cloud/network-services/nat-gateway/how-tos/configure-guest-os.md).
{% endhint %}
## Next steps
* [Configure the Guest OS to Use the NAT Gateway](/cloud/network-services/nat-gateway/how-tos/configure-guest-os.md)
* [Delete a Managed NAT Gateway](/cloud/network-services/nat-gateway/how-tos/delete-nat-gateway.md)
* [API How-Tos](/cloud/network-services/nat-gateway/api-howtos.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.ionos.com/cloud/network-services/nat-gateway/how-tos/configure-nat-gateway.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.