Help Center/ GaussDB/ User Guide/ Instance Management/ Binding or Unbinding a NAT Gateway Address for GaussDB
Updated on 2026-09-09 GMT+08:00
View PDF
Share

Binding or Unbinding a NAT Gateway Address for GaussDB

Scenarios

In public access scenarios, you typically use an Elastic IP (EIP) to connect to a DB instance. However, binding an EIP directly to an instance increases security risk. If security rules are misconfigured or a vulnerability is exploited, an attacker may obtain your access credentials and perform malicious operations on database resources.

To mitigate this risk, GaussDB allows you to bind a NAT gateway address instead. With a NAT gateway, public access is implemented as a one-way DNAT rule on the public NAT gateway. Only inbound traffic on the ports you configure can reach the instance's private IP address, meeting your access requirements while limiting exposure and reducing the attack surface.

If you no longer need to access the instance through an EIP, you can unbind the NAT gateway address.

Precautions

  • Binding or unbinding NAT gateways is only available for authorized users. To apply for the permissions needed, submit a service ticket.
  • The system-defined policy GaussDB FullAccess does not include the permissions required to bind or unbind NAT gateway addresses. To configure the permissions needed, create a custom policy and add the required actions. For details, see Permission Management.
  • When binding a DNAT gateway to a GaussDB instance, you are advised to select IAM project authorization for policy-based authorization. Enterprise project authorization is not supported.
  • To ensure database access, verify that the security group associated with the database allows traffic on the database port. For example, if the port is 8000, make sure the security group has an inbound rule that permits access from the visitor network's IP address on port 8000. You can obtain the database port from the Network Information area on the Basic Information page of the instance. For details about how to configure a security group, see Configuring Security Group Rules for a GaussDB Instance.
  • Before binding the NAT gateway address, create a public NAT gateway first and ensure that its VPC and subnet match those of the GaussDB instance. For details about how to create a public NAT gateway, see Buying a Public NAT Gateway.
  • A single VPC can have multiple public NAT gateways. However, only the first public NAT gateway created is automatically associated with a default route (destination: 0.0.0.0/0). For subsequent NAT gateways, you must manually update the route to point to the NAT gateway you want to use. For details, see Checking Whether Default Route Pointing to the Public NAT Gateway Is Configured in the Route Table.
  • When you connect to a distributed instance through JDBC via a NAT gateway, the autoBalance parameter is not supported.
  • After a NAT gateway is bound to a GaussDB instance, do not delete the DNAT rule on the NAT gateway's DNAT Rules page. If the DNAT rule is deleted, it will not be removed from the GaussDB console, and the EIP will no longer be usable for connecting to the DB instance.

Billing

You need to pay for the NAT Gateway and EIP services separately. For details about the NAT Gateway billing, see NAT Gateway Pricing Details. For details about the EIP billing, see EIP Pricing Details.

Procedure

  1. Log in to the GaussDB console.
  2. On the Instances page, click the name of an instance to go to the Basic Information page.
  3. In the Node List area, click Bind Gateway Address in the Operation column.

    For a distributed instance using independent deployment, switch to CN in the filter area first and then bind an EIP.
    Figure 1 Binding a gateway address (for a distributed instance using independent deployment)

    Figure 2 Binding a gateway address (for a centralized instance)

  4. In the displayed dialog box, select the gateway and EIP to be bound, enter a port number, and click OK.

    Figure 3 Binding a gateway address

    Table 1 Parameter description

    Parameter

    Description

    Gateway

    Public NAT gateway.

    If no gateway is available, click View Gateway to go to the network console and purchase a public NAT gateway. For details, see Buying a Public NAT Gateway.

    The VPC and subnet of the NAT gateway must match those of the GaussDB instance.

    EIP

    EIP to be bound.

    If no available EIPs are displayed, click View EIPs to go to the network console and purchase an EIP. For details, see Assigning an EIP.

    Port

    Port used to provide services to external systems. You can connect to the DB instance using the EIP and this port number. The value ranges from 1 to 65535.

  5. In the Node List area, check the binding result in the Gateway column. If the Gateway column shows an IP address and port, the binding is successful.

    The IP address displayed in the Gateway column is the bound EIP, and the port is the one you specified when binding the gateway address.

    Figure 4 Checking the binding result

  1. Log in to the GaussDB console.
  2. On the Instances page, click the name of the instance that has been bound with a gateway address.
  3. In the Node List area, click Unbind Gateway Address in the Operation column.

    For a distributed instance, switch to CN in the filter area first and then click Unbind Gateway Address in the Operation column.

    Figure 5 Unbinding a gateway address (for a distributed instance)

    Figure 6 Unbinding a gateway address (for a centralized instance)

  4. In the displayed dialog box, click OK.
  5. If you have enabled operation protection, click Send Code in the displayed Identity Verification dialog box and enter the obtained verification code. Then, click OK.

    Two-factor authentication improves the security of your account. For details about how to enable operation protection, see Identity and Access Management User Guide.

  6. In the Node List area, check the unbinding result in the Gateway column. If the Gateway column is empty, the unbinding is successful.

    To bind a gateway address to the instance again, see Binding a NAT Gateway Address.

FAQ

What Can I Do If Connection Between My Servers and the Internet Fails After I Add SNAT and DNAT Rules?

Parent Topic: Instance Management