Quartz 5

Azure NAT Gateway

Properties2
tagsnetworking, outbound, nat, az-104
aliasesNAT Gateway, NAT, outbound gateway, source NAT, SNAT

3 min read

Azure NAT Gateway

What it is

Azure NAT Gateway is a managed service for outbound internet connections. Attach it to one or more subnets in one virtual network and give it public IP addresses or a public-IP prefix. New outbound connections from those subnets use a NAT Gateway public address, while the workloads themselves can remain private.

Why it exists

Private workloads often need to download updates, call a payment provider, or reach another public endpoint. NAT Gateway gives them a predictable source address without assigning every VM a public IP. It also provides managed source-NAT port allocation for outbound scale.

What it does—and does not do

  • It permits return packets for a connection started from the subnet. It does not accept unsolicited inbound internet connections or publish an application.
  • It works at the subnet boundary. One subnet cannot use multiple NAT Gateways; multiple subnets in the same VNet can share one.
  • A NAT Gateway normally takes precedence over other outbound methods for new connections, such as a VM-level public IP, Load Balancer outbound rules, or Azure Firewall. A UDR that sends 0.0.0.0/0 to a virtual appliance or virtual-network gateway overrides the NAT Gateway internet path.
  • Since March 31, 2026, new VNets default to private subnets and do not receive default outbound access. Deliberately choose an outbound method—often NAT Gateway—rather than assuming a VM can reach the internet.

Northwind example

Northwind’s private ordering VMs need to call a shipping partner that allowlists source IP addresses. Maya attaches NAT Gateway to snet-orders and gives it a stable public IP. The partner allowlists that IP; the VMs still have no public IPs and cannot be contacted from the internet through NAT Gateway. If Northwind instead routes all 0.0.0.0/0 traffic to Azure Firewall, the firewall route takes control, so Maya designs the two services together rather than attaching both and guessing.

Not the same as

  • application-gateway: receives and routes inbound HTTP/HTTPS requests.
  • load-balancer: distributes traffic across backends; a public load balancer can publish an application.
  • vpn-gateway: terminates encrypted hybrid or remote-access VPN connections.

Choose a SKU intentionally

Standard NAT Gateway is zonal or nonzonal. StandardV2 is zone-redundant and adds capabilities including IPv6 support, but it requires StandardV2 public IP resources and cannot be upgraded in place from Standard. Confirm the SKU, region, IP, and availability requirements before deployment.

gateway · vnet · subnet · public-ip-address · load-balancer · azure-firewall

📘 Source: Microsoft Learn — What is Azure NAT Gateway?

Graph View

Backlinks