- What's New
- Function Overview
- Service Overview
- Billing
-
Getting Started
- Using a Public NAT Gateway to Enable Servers to Share One or More EIPs to Access the Internet
- Using a Public NAT Gateway to Enable Servers to Be Accessed by the Internet
- Using a Private NAT Gateway to Connect Cloud and On-premises Networks
- Using Multiple Public NAT Gateways Together in Performance-Demanding Scenarios
-
User Guide
- Public NAT Gateways
- Private NAT Gateways
- Permissions Management
- Tag Management
- Managing Quotas
- Monitoring
- Auditing
-
Best Practices
- Enabling Private Networks to Access the Internet Using a Cloud Connection and SNAT
- Using a Public NAT Gateway and Direct Connect to Accelerate Internet Access
- Using a Private NAT Gateway and Direct Connect to Enable Communications Between a VPC and an On-premises Data Center
- Using a Public NAT Gateway and VPC Peering to Enable Communications Between VPCs and the Internet
- Preserving Your Network with NAT Gateways During Cloud Migration
-
API Reference
- Before You Start
- API Overview
- Calling APIs
- APIs of Public NAT Gateways
- APIs for Private NAT Gateways
- Application Examples
- Permissions Policies and Supported Actions
- Appendixes
- Out-of-Date APIs
- SDK Reference
-
FAQs
-
Public NAT Gateways
- What Is the Relationship Between a VPC, Public NAT Gateway, EIP Bandwidth, and ECS?
- How Does a Public NAT Gateway Offer High Availability?
- Which Ports Cannot Be Accessed?
- What Are the Differences Between Using a Public NAT Gateway and Using an EIP for an ECS?
- What Should I Do If I Fail to Access the Internet Through a Public NAT Gateway?
- Can I Change the VPC for a Public NAT Gateway?
- Does Public NAT Gateway Support IPv6 Addresses?
- What Security Policies Can I Configure to Implement Access Control If I Use a Public NAT Gateway?
- What Can I Do If Connection Between My Servers and the Internet Fails After I Add SNAT and DNAT Rules?
- Can a Public NAT Gateway Limit the Bandwidth of a Server?
- What Can I Do If the Number of Lost Packets of a Public NAT Gateway Exceeds the Threshold (or EIP Port Allocation Exceeds the Threshold)?
-
Private NAT Gateways
- How Do I Troubleshoot a Network Failure After a Private NAT Gateway Is Configured?
- How Many Private NAT Gateways Can I Buy in a VPC?
- Can I Increase the Numbers of SNAT and DNAT Rules Supported by a Private NAT Gateway?
- Can Private NAT Gateways Translate On-premises IP Addresses Connected to the Cloud Through Direct Connect?
- What Are the Differences Between Private NAT Gateways and Public NAT Gateways?
- Can a Private NAT Gateway Be Used Across Accounts?
-
SNAT Rules
- Why Do I Need SNAT?
- What Are SNAT Connections?
- What Is the Bandwidth of a Public NAT Gateway That Is Used by Servers to Access the Internet? How Do I Configure the Bandwidth?
- How Do I Resolve Packet Loss or Connection Failure Issues When Using a NAT Gateway?
- What Should I Do If My ECS Fails to Access a Server on the Public Network Through a Public NAT Gateway?
- What Are the Relationships and Differences Between the CIDR Blocks in a NAT Gateway and in an SNAT Rule?
- DNAT Rules
-
Public NAT Gateways
- Videos
- Glossary
-
More Documents
-
User Guide (ME-Abu Dhabi Region)
- Overview
- Getting Started
- Managing NAT Gateways
- Managing SNAT Rules
- Managing DNAT Rules
- Monitoring Management
-
FAQs
-
NAT Gateway
- What Is the Relationship Between VPC, NAT Gateway, EIP Bandwidth, and ECS?
- How Does A NAT Gateway Offer High Availability?
- Which Ports Cannot Be Accessed?
- What Can I Do If I Fail to Access the Internet Through the NAT Gateway?
- Can I Change the VPC for a NAT Gateway After It Is Created?
- What Is the Quota of the NAT Gateway?
-
SNAT
- Why SNAT Is Used?
- What Are SNAT Connections?
- What Is the Bandwidth of the NAT Gateway When a Server Accesses the Internet Through the NAT Gateway? Where Can I Configure the Bandwidth?
- How Do I Resolve Packet Loss or Connection Failure Issues When Using a NAT Gateway?
- What Are the Relationships and Differences Between the CIDR Blocks in a NAT Gateway and in an SNAT Rule?
- DNAT
-
NAT Gateway
- Change History
- API Reference (ME-Abu Dhabi Region)
-
User Guide (Paris Region)
- Overview
-
Getting Started
- Allowing a Private Network to Access the Internet Using SNAT
- Allowing Internet Users to Access a Service in a Private Network Using DNAT
- Allowing On-Premises Servers to Communicate with the Internet
- Using Private NAT Gateways to Enable Communications Between Cloud and On-premises Networks
- Using Multiple Public NAT Gateways Together in Performance-Demanding Scenarios
- Public NAT Gateways
- Private NAT Gateways
- Permissions Management
- Monitoring
-
FAQs
-
Public NAT Gateways
- What Is the Relationship Between a VPC, Public NAT Gateway, EIP Bandwidth, and ECS?
- How Does a Public NAT Gateway Offer High Availability?
- Which Ports Cannot Be Accessed?
- What Are the Differences Between Using a NAT Gateway and Using an EIP for an ECS?
- What Should I Do If I Fail to Access the Internet Through a NAT Gateway?
- Can I Change the VPC for a NAT Gateway?
- What Is the Quota of the NAT Gateway?
- Can I Update NAT Gateways and SNAT Rules?
- Does NAT Gateway Support IPv6 Addresses?
- What Security Policies Can I Configure to Implement Access Control If I Use a NAT Gateway?
- What Can I Do If Connection Between My Servers and the Internet Fails After I Add SNAT and DNAT Rules?
-
Private NAT Gateways
- How Do I Troubleshoot a Network Failure After a Private NAT Gateway Is Configured?
- How Many Private NAT Gateways Can I Create in a VPC?
- Can I Increase the Numbers of SNAT and DNAT Rules Supported by a Private NAT Gateway?
- Can an SNAT Rule and a DNAT Rule of a Private NAT Gateway Share the Same Transit IP Address?
- Can Private NAT Gateways Translate On-premises IP Addresses Connected to the Cloud Through Direct Connect?
- What Are the Differences Between Private NAT Gateways and Public NAT Gateways?
- Can a Private NAT Gateway Be Used Across ?
-
SNAT Rules
- Why Do I Need SNAT?
- What Are SNAT Connections?
- What Is the Bandwidth of a NAT Gateway That Is Used by Servers to Access the Internet? How Do I Configure the Bandwidth?
- How Do I Resolve Packet Loss or Connection Failure Issues When Using a NAT Gateway?
- What Should I Do If My ECS Fails to Access a Server on the Public Network Through a NAT Gateway?
- What Are the Relationships and Differences Between the CIDR Blocks in a NAT Gateway and in an SNAT Rule?
- DNAT Rules
-
Public NAT Gateways
- Change History
- API Reference (Paris Region)
-
User Guide (Kuala Lumpur Region)
- Overview
- Getting Started
- Managing NAT Gateways
- Managing SNAT Rules
- Managing DNAT Rules
- Permissions Management
- Monitoring Management
-
FAQs
- NAT Gateway
-
SNAT
- Why Is SNAT Used?
- What Are SNAT Connections?
- What Is the Bandwidth of the NAT Gateway When a Server Accesses the Internet Through the NAT Gateway? Where Can I Configure the Bandwidth?
- How Do I Resolve Packet Loss or Connection Failure Issues When Using a NAT Gateway?
- What Are the Relationships and Differences Between the CIDR Blocks in a NAT Gateway and in an SNAT Rule?
- DNAT
- Change History
- API Reference (Kuala Lumpur Region)
-
User Guide (Ankara Region)
- Service Overview
- Getting Started
- Public NAT Gateways
- Private NAT Gateways
- Permissions Management
- Monitoring
-
FAQs
- Public NAT Gateways
-
Private NAT Gateways
- How Do I Troubleshoot a Network Failure After a Private NAT Gateway Is Configured?
- How Many Private NAT Gateways Can I Create in a VPC?
- Can Private NAT Gateways Translate On-premises IP Addresses Connected to the Cloud Through Direct Connect?
- What Are the Differences Between Private NAT Gateways and Public NAT Gateways?
- Can a Private NAT Gateway Be Used Across Accounts?
- SNAT Rules
- DNAT Rules
- Change History
-
API Reference (Ankara Region)
- Before You Start
- API Overview
- Calling APIs
- APIs for Public NAT Gateways
- Private Nat API
- Permissions Policies and Supported Actions
- Common Parameters
- Change History
-
User Guide (ME-Abu Dhabi Region)
- General Reference
- Scenarios
- Solution Architecture
- Solution Advantages
- Resource and Cost Planning
- Prerequisites
- Procedures
- Creating a VPC
- Creating a Security Group
- Creating an ECS
- Configuring Private NAT Gateways
- Configuring a VPC Peering Connection
- Configuring Routes
- Verifying that Department A Can Access the Regulatory Agency
Show all
Copied.
Using a Specified IP Address to Access Hosts Outside a VPC
Scenarios
The existing network architecture of the on-premises data center needs to be migrated to the cloud without any changes. In addition, servers can access external resources with a specified IP address.
In this best practice, department A needs to use a specified IP address (10.1.0.55) to access servers in a regulatory agency to upload required data after migrating its workloads to the cloud.
Solution Architecture
- The regulatory agency allows requests only from specified IP address (10.1.0.55).
- The server (192.168.0.3) in department A uses a private NAT gateway to translate 192.168.0.3 to the specified IP address (10.1.0.55) to periodically access the industry regulatory agency (10.10.0.5).

Solution Advantages
You can flexibly assign a transit IP address. All servers in the VPC can then use the transit IP address to access hosts outside the VPC.
Resource and Cost Planning
Resource |
Parameter |
CIDR Block/IP Address |
Subnet Name |
Description |
---|---|---|---|---|
VPC (CN-Hong Kong) |
vpc-departmentA |
192.168.0.0/24 |
subnet-A |
VPC that workloads of department A are migrated to |
vpc-transit1 |
10.1.0.0/24 |
ext_sub_T1 |
Transit VPC required by private NAT gateways |
|
vpc-regulation |
10.10.0.0/24 |
subnet-W |
Simulated VPC of the regulatory agency |
|
ECS (CN-Hong Kong) |
ecs-departmentA |
192.168.0.3 |
N/A |
Server in department A, which can access servers in the industry regulatory agency |
ecs-regulation |
10.10.0.5 |
N/A |
Simulated host of the regulatory agency |
|
Transit IP address (vpc-transit1) |
Transit IP address of department A |
10.1.0.55 |
N/A |
IP address assigned by the regulatory agency. Servers in department A use this IP address to access the regulatory agency. |
Prerequisites
- A Huawei Cloud account is available.
- Your account is not in arrears and the account balance is sufficient to pay for the resources involved in this best practice.
- A private NAT gateway is available.
- You have performed operations in Enabling Mutual Access Between Servers in Overlapping Subnets on the Cloud.
Procedures
Creating a VPC
- Log in to the Huawei Cloud management console and select the CN-Hong Kong region.
- Under Networking, select Virtual Private Cloud. On the Virtual Private Cloud page displayed, click Create VPC.
- Configure a VPC for the regulatory agency based on Table 1 and click Create Now.
- Region: Select CN-Hong Kong.
- Name: Set it to vpc-regulation.
- IPv4 CIDR Block: Set it to 10.10.0.0/24.
- AZ: Select AZ1.
- Name: Set it to subnet-W.
- IPv4 CIDR Block: Retain the default value.
- For parameters not mentioned, retain their default values or configure them as prompted.
Creating a Security Group
- Under Networking, select Virtual Private Cloud. In the navigation pane on the left, choose Access Control > Security Groups and click Create Security Group in the upper right corner.
- Configure the security group parameters and click OK.
- Name: Set it to sg-regulation.
- Template: Select General-purpose web server.
- For parameters not mentioned, retain their default values or configure them as prompted.
- Locate sg-regulation and click Manage Rule in the Operation column. On the sg-regulation details page, click the Inbound Rules tab and delete all rules displayed.
- Click Add Rule to allow only the IP address 10.1.0.55 to access the regulatory agency. Configure the following parameters and click OK.
- Priority: Set it to 1.
- Action: Select Allow.
- Protocol & Port: Select All.
- Type: Select IPv4.
- Source: Enter 10.1.0.55.
Creating an ECS
- Under Compute, select Elastic Cloud Server. On the Elastic Cloud Server page displayed, click Buy ECS.
- Based on Table 1, configure basic information about the ECS of the regulatory agency and click Next: Configure Network.
- Billing Mode: Select Pay-per-use.
- Region: Select CN-Hong Kong.
- Specifications: You can select ECS specifications based on your project requirements. This example uses c6.large.2 as an example.
- Image: Select Public image. This example uses a CentOS 8.0 image as an example.
- For parameters not mentioned, retain their default values or configure them as prompted.
- Configure the ECS network information and click Next: Configure Advanced Settings.
- Network: Select VPC vpc-regulation, select Manually specify IP address, and set the IP address to 10.10.0.5 planned in Table 1.
- Security Group: Select sg-regulation.
- EIP: Select Not required.
- For parameters not mentioned, retain their default values or configure them as prompted.
- Set the ECS name and password and click Next: Confirm.
- ECS Name: Set it to ecs-regulation.
- Login Mode: Select Password and enter a password.
- For parameters not mentioned, retain their default values or configure them as prompted.
- Confirm the ECS information, read the agreement and select the Agreement option, and click Submit to finish the ECS creation for the regulatory agency.
- In the ECS list, locate the ECS for the regulatory agency and click Remote Login in the Operation column. In the displayed dialog box, click Log In under Other Login Modes.
- Log in to the ECS as user root and check whether the private IP address of the ECS is the one you planned.
ifconfig
Configuring Private NAT Gateways
To assign a transit IP address
- On the management console, under Networking, select NAT Gateway. In the left navigation pane, choose Private NAT Gateways. Click the Transit IP Addresses tab.
- Click Assign Transit IP Address and configure the parameters as follows:
- Transit VPC: Select vpc-transit1.
- Transit Subnet: Select ext_sub_T1.
- Transit IP Address: Select Manual.
- IP Address: Enter 10.1.0.55.
- Click the Private NAT Gateways tab and click private-nat-A.
- On the SNAT Rules tab, click Add SNAT Rule.
- Subnet: Select Existing. The system automatically displays the subnet of department A.
- Transit Subnet: Select ext_sub_T1.
- Transit IP Address: Enter 10.1.0.55.
- After the SNAT rule parameters are configured, click OK.
- Go back to Network Console. In the navigation pane on the left, choose Route Tables and click rtb-vpc-departmentA. Confirm that the route from department A to private NAT gateway private-nat A has been added.
Configuring a VPC Peering Connection
- Under Networking, select Virtual Private Cloud. In the navigation pane on the left, choose VPC Peering Connections.
- Configure the following parameters and click OK.
- Name: Set it to peering-TtoW.
- Local VPC: Select vpc-transit1.
- Peer VPC: Select vpc-regulation.
- For parameters not mentioned, retain their default values or configure them as prompted.
Configuring Routes
- Choose Networking > Virtual Private Cloud. In the navigation pane on the left, choose Route Tables.
- Click rtb-vpc-transit1 to delete the existing 0.0.0.0/0 routing rule.
- Click Add Route, configure required parameters, and click OK.
- Destination: Set it to 0.0.0.0/0.
- Next Hop Type: Select VPC peering connection.
- Next Hop: The system automatically displays the VPC peering connection.
- Go back to the Route Tables page, click rtb-vpc-regulation, and click Add Route.
- Configure route information and click OK.
- Destination: Set it to 0.0.0.0/0.
- Next Hop Type: Select VPC peering connection.
- Next Hop: The system automatically displays the VPC peering connection.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot