Application Scenarios

If your servers in a VPC need to access the Internet, you can configure SNAT rules to let these servers share an EIP to access the Internet without exposing their private IP addresses. You can configure only one SNAT rule for each subnet in a VPC and select one or more EIPs for each SNAT rule. Public NAT gateways with different specifications provide different numbers of connections, and you can create multiple SNAT rules to meet your service requirements.

Figure 1 shows how servers in a VPC access the Internet using SNAT.

Figure 1 How servers in a VPC access the Internet using SNAT

DNAT rules enable servers in a VPC to provide services accessible from the Internet.

After receiving requests from a specific port over a specific protocol, the public NAT gateway can forward the requests to a specific port of a server through port mapping. The public NAT gateway can also forward all requests destined for an EIP to a specific server through IP address mapping.

One DNAT rule can be configured for each server. If there are multiple servers, you can create multiple DNAT rules to map one or more EIPs to the private IP addresses of these servers.

Figure 2 shows how servers (ECSs or BMSs) in a VPC provide services accessible from the Internet using DNAT

Figure 2 How servers in a VPC provide services accessible from the Internet using DNAT

If a large number of on-premises servers that connect to a VPC through Direct Connect or VPN need secure, high-speed Internet access or need to provide services accessible from the Internet, you can create a NAT gateway and configure SNAT and DNAT rules.

Figure 3 shows how to use SNAT and DNAT to provide high-speed Internet access or provide services accessible from the Internet.

Figure 3 Allowing on-premises servers to communicate with the Internet

EIPs may be attacked and blocked. To improve system reliability, you can bind multiple EIPs to an SNAT rule so that if one EIP is attacked and blocked, another EIP can be used to ensure service continuity.

Each SNAT rule can have up to 20 EIPs. If an SNAT rule has multiple EIPs, the system randomly selects an EIP for servers to access the Internet.

If any EIP is attacked and blocked, manually remove it from the EIP pool.

Figure 4 shows a highly available system using an SNAT rule of a public NAT gateway.

Figure 4 Setting up a highly available system by adding multiple EIPs to an SNAT rule

A single NAT gateway has performance bottlenecks. For example, if there are over one million SNAT connections that need to be handled, or if the maximum bandwidth of 20 Gbit/s cannot meet service requirements, you can use multiple public NAT gateways.

To use multiple public NAT gateways together, associate route tables of the VPC subnets with these NAT gateways.

Figure 5 shows how multiple public NAT gateways are used to overcome the performance bottleneck.

Figure 5 Using multiple public NAT gateways together

• The system does not add a default route for a new public NAT gateway. You need to add a route pointing to the public NAT gateway to the corresponding route table.
• Each public NAT gateway can be associated with one route table. The number of public NAT gateways that can be created in a VPC is determined by the number of route tables allowed in the VPC.

You can configure two private NAT gateways for two VPCs with overlapping CIDR blocks. Then, add SNAT and DNAT rules on the two private NAT gateways to enable servers in the two VPCs to use transit IP addresses to communicate with each other.

Figure 6 Connecting VPCs with overlapping CIDR blocks

Organizations may want to migrate their workloads to the cloud without making any changes to their existing network topology. They may also have to access regulatory agencies from specific IP addresses as required by these agencies. A private NAT gateway is a good choice.

Subnets of different departments in an enterprise network may overlap. A private NAT gateway allows the enterprise to keep the existing network topology unchanged while migrating their workloads to the cloud. In this example, the private NAT gateway maps the IP address of each department to 10.0.0.33 so that each department can use 10.0.0.33 to securely access the regulatory agency.

Figure 7 Migrating workloads to the cloud and accessing regulatory agencies from specific IP addresses