Introduction
NAT Gateway is a service that supports IP address translation and provides SNAT and DNAT capabilities, which can provide secure and high-performance internet access services for resources within a VPC. NAT Gateway supports up to 99.99% high availability, 5Gbps bandwidth, and more than 10 million concurrent connections. Its typical use cases are as follows:
- Large bandwidth, high availability public network egress services, such as web crawling and accessing public internet services.
- Secure public network egress services, for example: the CVM needs to communicate with the public network, but for security reasons, you do not want the CVM to be bound to a public IP address.
Network Topology
As shown in the figure below, when CVMs and other resources in a VPC send data packets outward through a NAT Gateway, the data first passes through the router and is routed according to the routing policy. Finally, the NAT Gateway uses the bound EIP address as the source IP address and sends the traffic to the internet.
Differences from Public Network Gateways
CVMs in a VPC can access the internet through a NAT Gateway or a public network gateway. The differences between the two gateways are shown in the following table.
| Attribute | NAT Gateway | Public Gateway |
|---|---|---|
| Availability | Hot standby, automatic hot switch. | Manually switch the faulty gateway. |
| Public Network Bandwidth | Max. 5 Gbps. | Depends on the CVM network bandwidth. |
| Public network IP address | Up to 10 Elastic IPs can be bound. | 1 EIP or common public IP. |
| Public Network Speed Limit | No | Depends on the CVM speed limit. |
| Maximum Connections | 1 million. | 500 thousand. |
| Private IP Address | Does not occupy the VPC user's private network IP. | Occupy IP in the subnet. |
| Security Group | NAT Gateway does not support security group binding, but security group binding can be performed on the backend CVM. | Supports security group binding. |
| Network ACL | NAT Gateway does not support network ACL binding, but you can bind network ACL to the subnet where the backend CVM is located. | Does not support binding network ACL, but you can bind network ACL to the subnet. |
According to the chart above, NAT Gateway has the following strengths:
- Large capacity
Supports up to 10 million concurrent connections, 5 Gbps bandwidth, and 10 Elastic IPs to meet the demands of large-scale users.
- High Availability of the Hot Standby
Automatic switching of stand-alone failures realizes automatic disaster recovery compared to manual switching of public network gateways, ensuring 99.99% service availability.
- Cost Savings
Provides three configurations: high, medium, and low. Users can purchase on demand with elastic billing to save costs.