What Is It?
Managed NAT Gateway enables outbound internet connectivity for private resources without public IP addresses. Using network address translation (NAT), the gateway allows VMs and other resources on private LANs to initiate outbound connections to the Internet while remaining unreachable from external networks. The service is deployed with high availability across multiple availability zones, is designed to scale to accommodate growing traffic demand, and supports flow logging for traffic monitoring.
Quick Facts
| Aspect | Details |
|---|---|
| Type | Managed network address translation service |
| Direction | Outbound only (private to public Internet) |
| IP Assignment | Public IP selected from reserved IP pool |
| Availability | High availability with automatic failover |
| Scaling | Highly scalable design; deploy multiple NAT Gateways per VDC to add capacity |
| Flow Logs | Supported (one flow log per NAT Gateway) |
| Management | DCD, Cloud API |
What You Can Do
Outbound Internet Access
Enable private resources to access the Internet without assigning individual public IP addresses. NAT Gateway handles address translation automatically for all outbound connections.
Private Network Security
Keep resources on private LANs unreachable from the Internet while maintaining outbound connectivity. Inbound connections from the Internet are not possible through NAT Gateway.
Automatic IP Management
NAT Gateway requires you to select public IP addresses from your reserved IP pool. Public IP must be selected from your reserved IP pool during setup.
High Availability
Benefit from built-in redundancy and automatic failover. NAT Gateway maintains connectivity even if individual components fail.
Scalable Capacity
The service is designed to be highly scalable to accommodate growing traffic demand. Deploy multiple NAT Gateways per VDC to distribute load and add capacity.
Flow Logging
Attach one flow log per NAT Gateway to monitor outbound traffic patterns. Logs are written to IONOS Cloud Object Storage for analysis.
Best For
| Scenario | Why It Fits |
|---|---|
| Private subnet Internet access | Resources that need outbound connectivity but should not be publicly accessible |
| Security-focused deployments | Prevent inbound Internet connections while allowing outbound |
| Patch and update management | Private servers can download updates without public exposure |
| Third-party API integration | Backend services can call external APIs while remaining private |
| Cost optimization | Avoid per-VM public IP costs for outbound-only connectivity |
Key Considerations
Billing & Costs
- Main billing: Per NAT Gateway per hour
- Public IP fee applies: The public IP must be a reserved public IPv4 address, which is billed separately at the standard reserved-IPv4 rate (not included in the NAT Gateway's per-hour fee)
- Additional costs: Flow logging storage (Object Storage bucket costs)
Limitations
- Outbound only (no inbound connections from Internet)
- One flow log maximum per NAT Gateway
- Public IP selection from reserved IP pool (choose from your reserved addresses)
- IPv6 not supported (IPv4 only)
Management Options
- Data Center Designer (DCD)
- Cloud API
- Flow log configuration
- Attach to private LANs