The NAT gateway provides virtual machines in a VPC with the ability to communicate with external networks through a shared NAT IP. The NAT IP is an IP address allocated from the NAT gateway address block of an external subnet.
When implementing communication between virtual machines in a VPC and external networks, the NAT gateway translates the private addresses of virtual machines to external subnet addresses. That is, after a NAT gateway is associated with a VPC subnet, all virtual machines in that subnet can communicate with external networks through the NAT IP.
The NAT gateway supports SNAT and DNAT:
SNAT: Virtual machines in the VPC can actively access external networks through the NAT gateway.
Supported protocols: ICMP, TCP, UDP
Port range: 32768–65535, the source port range of TCP or UDP packets after SNAT.
DNAT: External networks can actively access services inside the VPC through the NAT gateway.
Supported protocols: TCP, UDP
Port range: 1–32768, the destination port range for TCP or UDP that external networks can actively access.
Using TCP or UDP as an example, the NAT gateway processes packets as shown in the following figure:
SNAT: The NAT gateway translates the source IP (VM_IP) of the first packet to NAT_IP and the source port (VM_PORT) to NAT_PORT, and records the mapping for that TCP or UDP flow. For subsequent packets in the same flow, it translates NAT_IP back to VM_IP and NAT_PORT back to VM_PORT based on the recorded mapping.
DNAT: The NAT gateway translates the destination IP (NAT_IP) of the first packet to VM_IP and the destination port (NAT_PORT) to VM_PORT based on the configured DNAT rules, and records the mapping for that TCP or UDP flow. For subsequent packets in the same flow, it translates VM_IP back to NAT_IP and VM_PORT back to NAT_PORT based on the recorded mapping.
