Updated on 2025-07-04 GMT+08:00

Creating a DNAT Rule

Function

This API is used to create a DNAT rule.

Constraints

When you are creating a DNAT rule, status of the NAT gateway must be set to ACTIVE.

Calling Method

For details, see Calling APIs.

URI

POST /v3/{project_id}/private-nat/dnat-rules

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Specifies the project ID.

Request Parameters

Table 2 Request header parameters

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

Specifies the user token.

It is a response to the API used to obtain a user token. This API is the only one that does not require authentication.

The value of X-Subject-Token in the response header is the token value.

Table 3 Request body parameters

Parameter

Mandatory

Type

Description

dnat_rule

Yes

CreatePrivateDnatOption object

Specifies the request body for creating a DNAT rule.

Table 4 CreatePrivateDnatOption

Parameter

Mandatory

Type

Description

description

No

String

Provides supplementary information about the DNAT rule. The description can contain up to 255 characters and cannot contain angle brackets (<>).

transit_ip_id

Yes

String

Specifies the ID of the transit IP address.

network_interface_id

No

String

Specifies the port ID of the resource that the NAT gateway is bound to. The resource can be a compute instance, load balancer (v2 or v3), or virtual IP address. Note: Either this parameter or private_ip_address must be specified. Otherwise, an error will be reported.

gateway_id

Yes

String

Specifies the private NAT gateway ID.

protocol

No

String

Specifies the protocol type.

TCP, UDP, and ANY are supported.

The protocol number of TCP, UDP, and ANY are 6, 17, and 0, respectively.

private_ip_address

No

String

Specifies the port IP address that the NAT gateway uses. The resource can be a compute instance, load balancer (v2 or v3), or virtual IP address. Note: Either this parameter or network_interface_id must be specified. Otherwise, an error will be reported.

internal_service_port

No

String

Specifies the port number of the resource, which can be a compute instance, load balancer (v2 or v3), or virtual IP address.

transit_service_port

No

String

Specifies the port number of the transit IP address.

Response Parameters

Status code: 201

Table 5 Response body parameters

Parameter

Type

Description

dnat_rule

PrivateDnat object

Specifies the response body of the DNAT rule.

request_id

String

Specifies the request ID.

Table 6 PrivateDnat

Parameter

Type

Description

id

String

Specifies the DNAT rule ID.

project_id

String

Specifies the project ID.

description

String

Provides supplementary information about the DNAT rule. The description can contain up to 255 characters and cannot contain angle brackets (<>).

transit_ip_id

String

Specifies the ID of the transit IP address.

gateway_id

String

Specifies the private NAT gateway ID.

network_interface_id

String

Specifies the network interface ID. Network interfaces of a compute instance, load balancer (v2 or v3), or virtual IP address are supported.

type

String

Specifies the backend resource type of the DNAT rule.

The type can be:

  • COMPUTE: The backend resource is a compute instance.

  • VIP: The backend resource is a virtual IP address.

  • ELB: The backend resource is a v2 load balancer.

  • ELBv3: The backend resource is a v3 load balancer.

  • CUSTOMIZE: The backend resource is a user-defined IP address.

protocol

String

Specifies the protocol type.

TCP, UDP, and ANY are supported.

The protocol number of TCP, UDP, and ANY are 6, 17, and 0, respectively.

private_ip_address

String

Specifies the port IP address that the NAT gateway uses. The resource can be a compute instance, load balancer (v2 or v3), or virtual IP address.

internal_service_port

String

Specifies the port number of the resource, which can be a compute instance, load balancer (v2 or v3), or virtual IP address.

transit_service_port

String

Specifies the port number of the transit IP address.

enterprise_project_id

String

Specifies the ID of the enterprise project that is associated with the DNAT rule when the DNAT rule is created.

created_at

DateTime

Specifies the time when the DNAT rule was created. It is a UTC time in yyyy-mm-ddThh:mm:ssZ format.

updated_at

DateTime

Specifies the time when the DNAT rule was updated. It is a UTC time in yyyy-mm-ddThh:mm:ssZ format.

status

String

Specifies the DNAT rule status of a private NAT gateway.

The value can be:

  • ACTIVE: The DNAT rule is running properly.

  • FROZEN: The DNAT rule is frozen.

Example Requests

Creating a DNAT rule with the transit IP address ID set to 3faa719d-6d18-4ccb-a5c7-33e65a09663e, the private NAT gateway ID set to 0adefb29-a6c2-48a5-8637-2be67fa03fec, and network interface ID set to dae9393a-b536-491c-a5a2-72edc1104707

POST https://{Endpoint}/v3/da261828016849188f4dcc2ef94d9da9/private-nat/dnat-rules

{
  "dnat_rule" : {
    "description" : "aa",
    "gateway_id" : "0adefb29-a6c2-48a5-8637-2be67fa03fec",
    "transit_ip_id" : "3faa719d-6d18-4ccb-a5c7-33e65a09663e",
    "network_interface_id" : "dae9393a-b536-491c-a5a2-72edc1104707"
  }
}

Example Responses

Status code: 201

DNAT rule created.

{
  "dnat_rule" : {
    "id" : "24dd6bf5-48f2-4915-ad0b-5bb111d39c83",
    "project_id" : "da261828016849188f4dcc2ef94d9da9",
    "description" : "aa",
    "gateway_id" : "0adefb29-a6c2-48a5-8637-2be67fa03fec",
    "transit_ip_id" : "3faa719d-6d18-4ccb-a5c7-33e65a09663e",
    "enterprise_project_id" : "2759da7b-8015-404c-ae0a-a389007b0e2a",
    "network_interface_id" : "dae9393a-b536-491c-a5a2-72edc1104707",
    "type" : "COMPUTE",
    "protocol" : "any",
    "internal_service_port" : "0",
    "transit_service_port" : "0",
    "private_ip_address" : "192.168.1.72",
    "created_at" : "2019-04-29T07:10:01",
    "updated_at" : "2019-04-29T07:10:01",
    "status" : "ACTIVE"
  },
  "request_id" : "70505c941b9b4dfd82fd351932328a2f"
}

SDK Sample Code

The SDK sample code is as follows.

Creating a DNAT rule with the transit IP address ID set to 3faa719d-6d18-4ccb-a5c7-33e65a09663e, the private NAT gateway ID set to 0adefb29-a6c2-48a5-8637-2be67fa03fec, and network interface ID set to dae9393a-b536-491c-a5a2-72edc1104707

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.nat.v2.region.NatRegion;
import com.huaweicloud.sdk.nat.v2.*;
import com.huaweicloud.sdk.nat.v2.model.*;


public class CreatePrivateDnatSolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");
        String projectId = "{project_id}";

        ICredential auth = new BasicCredentials()
                .withProjectId(projectId)
                .withAk(ak)
                .withSk(sk);

        NatClient client = NatClient.newBuilder()
                .withCredential(auth)
                .withRegion(NatRegion.valueOf("<YOUR REGION>"))
                .build();
        CreatePrivateDnatRequest request = new CreatePrivateDnatRequest();
        CreatePrivateDnatOptionBody body = new CreatePrivateDnatOptionBody();
        CreatePrivateDnatOption dnatRulebody = new CreatePrivateDnatOption();
        dnatRulebody.withDescription("aa")
            .withTransitIpId("3faa719d-6d18-4ccb-a5c7-33e65a09663e")
            .withNetworkInterfaceId("dae9393a-b536-491c-a5a2-72edc1104707")
            .withGatewayId("0adefb29-a6c2-48a5-8637-2be67fa03fec");
        body.withDnatRule(dnatRulebody);
        request.withBody(body);
        try {
            CreatePrivateDnatResponse response = client.createPrivateDnat(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}

Creating a DNAT rule with the transit IP address ID set to 3faa719d-6d18-4ccb-a5c7-33e65a09663e, the private NAT gateway ID set to 0adefb29-a6c2-48a5-8637-2be67fa03fec, and network interface ID set to dae9393a-b536-491c-a5a2-72edc1104707

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# coding: utf-8

import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdknat.v2.region.nat_region import NatRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdknat.v2 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = os.environ["CLOUD_SDK_AK"]
    sk = os.environ["CLOUD_SDK_SK"]
    projectId = "{project_id}"

    credentials = BasicCredentials(ak, sk, projectId)

    client = NatClient.new_builder() \
        .with_credentials(credentials) \
        .with_region(NatRegion.value_of("<YOUR REGION>")) \
        .build()

    try:
        request = CreatePrivateDnatRequest()
        dnatRulebody = CreatePrivateDnatOption(
            description="aa",
            transit_ip_id="3faa719d-6d18-4ccb-a5c7-33e65a09663e",
            network_interface_id="dae9393a-b536-491c-a5a2-72edc1104707",
            gateway_id="0adefb29-a6c2-48a5-8637-2be67fa03fec"
        )
        request.body = CreatePrivateDnatOptionBody(
            dnat_rule=dnatRulebody
        )
        response = client.create_private_dnat(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)

Creating a DNAT rule with the transit IP address ID set to 3faa719d-6d18-4ccb-a5c7-33e65a09663e, the private NAT gateway ID set to 0adefb29-a6c2-48a5-8637-2be67fa03fec, and network interface ID set to dae9393a-b536-491c-a5a2-72edc1104707

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    nat "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/nat/v2"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/nat/v2/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/nat/v2/region"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")
    projectId := "{project_id}"

    auth := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        WithProjectId(projectId).
        Build()

    client := nat.NewNatClient(
        nat.NatClientBuilder().
            WithRegion(region.ValueOf("<YOUR REGION>")).
            WithCredential(auth).
            Build())

    request := &model.CreatePrivateDnatRequest{}
	descriptionDnatRule:= "aa"
	networkInterfaceIdDnatRule:= "dae9393a-b536-491c-a5a2-72edc1104707"
	dnatRulebody := &model.CreatePrivateDnatOption{
		Description: &descriptionDnatRule,
		TransitIpId: "3faa719d-6d18-4ccb-a5c7-33e65a09663e",
		NetworkInterfaceId: &networkInterfaceIdDnatRule,
		GatewayId: "0adefb29-a6c2-48a5-8637-2be67fa03fec",
	}
	request.Body = &model.CreatePrivateDnatOptionBody{
		DnatRule: dnatRulebody,
	}
	response, err := client.CreatePrivateDnat(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.

Status Codes

Status Code

Description

201

DNAT rule created.

Error Codes

See Error Codes.