- What's New
- Function Overview
- Service Overview
- Billing
-
Getting Started
- Using a Public NAT Gateway to Enable Servers to Share One or More EIPs to Access the Internet
- Using a Public NAT Gateway to Enable Servers to Be Accessed by the Internet
- Using a Private NAT Gateway to Connect Cloud and On-premises Networks
- Using Multiple Public NAT Gateways Together in Performance-Demanding Scenarios
-
User Guide
- Public NAT Gateways
- Private NAT Gateways
- Permissions Management
- Tag Management
- Managing Quotas
- Monitoring
- Auditing
-
Best Practices
- Enabling Private Networks to Access the Internet Using a Cloud Connection and SNAT
- Using a Public NAT Gateway and Direct Connect to Accelerate Internet Access
- Using a Private NAT Gateway and Direct Connect to Enable Communications Between a VPC and an On-premises Data Center
- Using a Public NAT Gateway and VPC Peering to Enable Communications Between VPCs and the Internet
- Preserving Your Network with NAT Gateways During Cloud Migration
-
API Reference
- Before You Start
- API Overview
- Calling APIs
- APIs of Public NAT Gateways
- APIs for Private NAT Gateways
- Application Examples
- Permissions Policies and Supported Actions
- Appendixes
- Out-of-Date APIs
- SDK Reference
-
FAQs
-
Public NAT Gateways
- What Is the Relationship Between a VPC, Public NAT Gateway, EIP Bandwidth, and ECS?
- How Does a Public NAT Gateway Offer High Availability?
- Which Ports Cannot Be Accessed?
- What Are the Differences Between Using a Public NAT Gateway and Using an EIP for an ECS?
- What Should I Do If I Fail to Access the Internet Through a Public NAT Gateway?
- Can I Change the VPC for a Public NAT Gateway?
- Does Public NAT Gateway Support IPv6 Addresses?
- What Security Policies Can I Configure to Implement Access Control If I Use a Public NAT Gateway?
- What Can I Do If Connection Between My Servers and the Internet Fails After I Add SNAT and DNAT Rules?
- Can a Public NAT Gateway Limit the Bandwidth of a Server?
- What Can I Do If the Number of Lost Packets of a Public NAT Gateway Exceeds the Threshold (or EIP Port Allocation Exceeds the Threshold)?
-
Private NAT Gateways
- How Do I Troubleshoot a Network Failure After a Private NAT Gateway Is Configured?
- How Many Private NAT Gateways Can I Buy in a VPC?
- Can I Increase the Numbers of SNAT and DNAT Rules Supported by a Private NAT Gateway?
- Can Private NAT Gateways Translate On-premises IP Addresses Connected to the Cloud Through Direct Connect?
- What Are the Differences Between Private NAT Gateways and Public NAT Gateways?
- Can a Private NAT Gateway Be Used Across Accounts?
-
SNAT Rules
- Why Do I Need SNAT?
- What Are SNAT Connections?
- What Is the Bandwidth of a Public NAT Gateway That Is Used by Servers to Access the Internet? How Do I Configure the Bandwidth?
- How Do I Resolve Packet Loss or Connection Failure Issues When Using a NAT Gateway?
- What Should I Do If My ECS Fails to Access a Server on the Public Network Through a Public NAT Gateway?
- What Are the Relationships and Differences Between the CIDR Blocks in a NAT Gateway and in an SNAT Rule?
- DNAT Rules
-
Public NAT Gateways
- Videos
- Glossary
-
More Documents
-
User Guide (ME-Abu Dhabi Region)
- Overview
- Getting Started
- Managing NAT Gateways
- Managing SNAT Rules
- Managing DNAT Rules
- Monitoring Management
-
FAQs
-
NAT Gateway
- What Is the Relationship Between VPC, NAT Gateway, EIP Bandwidth, and ECS?
- How Does A NAT Gateway Offer High Availability?
- Which Ports Cannot Be Accessed?
- What Can I Do If I Fail to Access the Internet Through the NAT Gateway?
- Can I Change the VPC for a NAT Gateway After It Is Created?
- What Is the Quota of the NAT Gateway?
-
SNAT
- Why SNAT Is Used?
- What Are SNAT Connections?
- What Is the Bandwidth of the NAT Gateway When a Server Accesses the Internet Through the NAT Gateway? Where Can I Configure the Bandwidth?
- How Do I Resolve Packet Loss or Connection Failure Issues When Using a NAT Gateway?
- What Are the Relationships and Differences Between the CIDR Blocks in a NAT Gateway and in an SNAT Rule?
- DNAT
-
NAT Gateway
- Change History
- API Reference (ME-Abu Dhabi Region)
-
User Guide (Paris Region)
- Overview
-
Getting Started
- Allowing a Private Network to Access the Internet Using SNAT
- Allowing Internet Users to Access a Service in a Private Network Using DNAT
- Allowing On-Premises Servers to Communicate with the Internet
- Using Private NAT Gateways to Enable Communications Between Cloud and On-premises Networks
- Using Multiple Public NAT Gateways Together in Performance-Demanding Scenarios
- Public NAT Gateways
- Private NAT Gateways
- Permissions Management
- Monitoring
-
FAQs
-
Public NAT Gateways
- What Is the Relationship Between a VPC, Public NAT Gateway, EIP Bandwidth, and ECS?
- How Does a Public NAT Gateway Offer High Availability?
- Which Ports Cannot Be Accessed?
- What Are the Differences Between Using a NAT Gateway and Using an EIP for an ECS?
- What Should I Do If I Fail to Access the Internet Through a NAT Gateway?
- Can I Change the VPC for a NAT Gateway?
- What Is the Quota of the NAT Gateway?
- Can I Update NAT Gateways and SNAT Rules?
- Does NAT Gateway Support IPv6 Addresses?
- What Security Policies Can I Configure to Implement Access Control If I Use a NAT Gateway?
- What Can I Do If Connection Between My Servers and the Internet Fails After I Add SNAT and DNAT Rules?
-
Private NAT Gateways
- How Do I Troubleshoot a Network Failure After a Private NAT Gateway Is Configured?
- How Many Private NAT Gateways Can I Create in a VPC?
- Can I Increase the Numbers of SNAT and DNAT Rules Supported by a Private NAT Gateway?
- Can an SNAT Rule and a DNAT Rule of a Private NAT Gateway Share the Same Transit IP Address?
- Can Private NAT Gateways Translate On-premises IP Addresses Connected to the Cloud Through Direct Connect?
- What Are the Differences Between Private NAT Gateways and Public NAT Gateways?
- Can a Private NAT Gateway Be Used Across ?
-
SNAT Rules
- Why Do I Need SNAT?
- What Are SNAT Connections?
- What Is the Bandwidth of a NAT Gateway That Is Used by Servers to Access the Internet? How Do I Configure the Bandwidth?
- How Do I Resolve Packet Loss or Connection Failure Issues When Using a NAT Gateway?
- What Should I Do If My ECS Fails to Access a Server on the Public Network Through a NAT Gateway?
- What Are the Relationships and Differences Between the CIDR Blocks in a NAT Gateway and in an SNAT Rule?
- DNAT Rules
-
Public NAT Gateways
- Change History
- API Reference (Paris Region)
-
User Guide (Kuala Lumpur Region)
- Overview
- Getting Started
- Managing NAT Gateways
- Managing SNAT Rules
- Managing DNAT Rules
- Permissions Management
- Monitoring Management
-
FAQs
- NAT Gateway
-
SNAT
- Why Is SNAT Used?
- What Are SNAT Connections?
- What Is the Bandwidth of the NAT Gateway When a Server Accesses the Internet Through the NAT Gateway? Where Can I Configure the Bandwidth?
- How Do I Resolve Packet Loss or Connection Failure Issues When Using a NAT Gateway?
- What Are the Relationships and Differences Between the CIDR Blocks in a NAT Gateway and in an SNAT Rule?
- DNAT
- Change History
- API Reference (Kuala Lumpur Region)
-
User Guide (Ankara Region)
- Service Overview
- Getting Started
- Public NAT Gateways
- Private NAT Gateways
- Permissions Management
- Monitoring
-
FAQs
- Public NAT Gateways
-
Private NAT Gateways
- How Do I Troubleshoot a Network Failure After a Private NAT Gateway Is Configured?
- How Many Private NAT Gateways Can I Create in a VPC?
- Can Private NAT Gateways Translate On-premises IP Addresses Connected to the Cloud Through Direct Connect?
- What Are the Differences Between Private NAT Gateways and Public NAT Gateways?
- Can a Private NAT Gateway Be Used Across Accounts?
- SNAT Rules
- DNAT Rules
- Change History
-
API Reference (Ankara Region)
- Before You Start
- API Overview
- Calling APIs
- APIs for Public NAT Gateways
- Private Nat API
- Permissions Policies and Supported Actions
- Common Parameters
- Change History
-
User Guide (ME-Abu Dhabi Region)
- General Reference
Copied.
Using a Private NAT Gateway to Connect Cloud and On-premises Networks
Scenarios
You can use a private NAT gateway to enable communications between cloud and on-premises networks.
The following figure shows how a private NAT gateway enables ECSs in a VPC to communicate with your on-premises data center that has been connected to the cloud using Direct Connect.

Operation Process
Procedure |
Description |
---|---|
Create a service VPC and a transit VPC. |
|
Create a VPC peering connection to connect your local data center to a transit VPC. |
|
Buy a private NAT gateway. |
|
Assign a transit IP address so that cloud servers in a VPC can use the same transit IP address. |
|
After the private NAT gateway is created, add an SNAT rule so that servers in the VPC can share a transit IP address to access on-premises data centers or other VPCs. |
|
You can add a route and configure the destination, next hop type, and next hop in the routes to determine where network traffic is directed. |
|
Add an inbound security group rule to allow traffic to servers in the destination VPC. |
Preparations
Before using NAT gateways, sign up for a HUAWEI ID, enable Huawei Cloud services, complete real-name authentication, and top up your account.
- .
- .
- .
Step 1: Create a Service VPC and a Transit VPC
A VPC provides an isolated virtual network for ECSs. You can configure and manage your network as required.
You need to create two VPCs, one for your services, and one as the transit VPC.
For details, see .
Step 2: Create a VPC Peering Connection
Create a Direct Connect connection to link your on-premises data center to the cloud (the region). In this example, a VPC peering connection is used.
Create a VPC peering connection to connect your local data center to a transit VPC. For details, see .
For details about how to use Direct Connect to connect your data center (the destination VPC in the VPC peering connection) to the transit VPC, see .
Step 3: Buy a Private NAT Gateway
- On the Create Private NAT Gateway page, configure required parameters.
Table 1 Descriptions of private NAT gateway parameters Parameter
Description
Region
The region where the private NAT gateway is located.
Name
The name of the private NAT gateway. Enter up to 64 characters including only digits, letters, underscores (_), and hyphens (-).
VPC
The service VPC that the private NAT gateway belongs to.
The selected VPC cannot be changed after the private NAT gateway is created.
Subnet
The subnet that the private NAT gateway belongs to.
The subnet must have at least one available IP address.
The selected subnet cannot be changed after the private NAT gateway is created.
Specifications
The specifications of the private NAT gateway.
Enterprise Project
The enterprise project that the private NAT gateway belongs to. If you have not configured any enterprise project, select the default enterprise project.
You can configure the enterprise project to which the private network NAT gateway belongs only after the enterprise project function is enabled for you.
Tag
The private NAT gateway tag. A tag is a key-value pair. You can add up to 20 tags to each private NAT gateway.
Description
Supplementary information about the private NAT gateway. Enter up to 255 characters. Angle brackets (<>) are not allowed.
- Click Create Now.
- In the private NAT gateway list, check the gateway status.
Step 4: Assign a Transit IP Address
- On the Private NAT Gateways page, click Transit IP Addresses < Assign Transit IP Address.
- Configure required parameters. For details, see Table 2.
Table 2 Parameter descriptions of a transit IP address Parameter
Example
Description
Transit VPC
-
The VPC to which the transit IP address belongs.
Transit Subnets
-
A transit subnet is a transit network and is the subnet to which the transit IP address belongs.
The subnet must have at least one available IP address.
Transit IP Address
Automatic
The transit IP address can be assigned in either of the following ways:
Automatic: The system automatically assigns a transit IP address.
Manual: You need to manually assign a transit IP address.
Enterprise Project
default
The enterprise project to which the transit IP address belongs.
Tag
Not required
The transit IP address tag, which consists of a key and value pair. You can add up to 20 tags to each transit IP address.
- Click OK.
Step 5: Add an SNAT Rule
- On the Private NAT Gateways page, click the name of the private NAT gateway on which you need to add an SNAT rule.
- On the SNAT Rules tab, click Add SNAT Rule.
- Configure required parameters. For details, see Table 3.
Table 3 Descriptions of SNAT rule parameters Parameter
Example
Description
Subnet
Existing
The subnet type of the SNAT rule. Select Existing or Custom.
Select a subnet where IP address translation is required in the service VPC.
Monitoring
-
You can create alarm rules to watch the number of SNAT connections.
Transit IP Address
-
The transit IP address you assigned in Step 4: Assign a Transit IP Address.
Description
Not required
Supplementary information about the SNAT rule. Enter up to 255 characters. Angle brackets (<>) are not allowed.
- Click OK.
- View details in the SNAT rule list. If Status is Running, the rule has been added.
Step 6: Add a Route
- In the route table list, click the name of the route table associated the service VPC.
- Click Add Route and configure required parameters.
Table 4 Route parameters Parameter
Example
Description
Destination
10.0.0.0/24
The destination CIDR block.
Set it to the CIDR block used by your on-premises data center.
Next Hop Type
NAT gateway
Type of the next hop.
Next Hop
private-nat-01
Set Next Hop to the private NAT gateway.
Description
Not required
(Optional) Supplementary information about the route.
Enter up to 255 characters. Angle brackets (<>) are not allowed.
- Click OK.
Step 7: Add a Security Group Rule
- Locate the target security group and click Manage Rules in the Operation column.
The page for configuring security group rules is displayed.
- On the Inbound Rules tab, click Add Rule. In the displayed dialog box, configure required parameters.
You can click + to add more inbound rules.
Table 5 Description of inbound rule parameters Parameter
Example
Description
Priority
1
Priority of a rule. A smaller value indicates a higher priority.
Action
Allow
Allow or Deny
- If the Action is set to Allow, access from the source is allowed to ECSs in the security group over specified ports.
- If the Action is set to Deny, access from the source is denied to ECSs in the security group over specified ports.
Protocol & Port
TCP
Protocol: Network protocol. The value can be All, TCP, UDP, ICMP, or GRE.
22 or 22-30
Port: The port or port range over which the traffic can reach your ECS. The value ranges from 1 to 65535.
Source
0.0.0.0/0
Source of the security group rule. The value can be a single IP address, an IP address group, or a security group, to allow access from the specified IP address, IP address group, or instances in another security group.
Description
Not required
(Optional) Supplementary information about the security group rule.
Enter up to 255 characters. Angle brackets (<>) are not allowed.
- Click OK.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot