NAT gateway: connect private servers through one public IP

When a server in the private network sends a request to an outside address, the request follows the default route to the NAT gateway. The NAT gateway replaces the sender address with its own public IP, sends it out to the internet, and passes the returning response back to the server it remembered. Servers keep only private addresses and connect to package repositories, external APIs and time servers as usual.

Connections started from outside are blocked by default. Only responses to connections started by private servers come back, so databases and admin tools are never exposed directly to the internet. The most common setup has a load balancer or a single web server with a public IP receive requests that must come in from outside, such as user connections, and keeps the rest of the servers inside.

One NAT gateway attaches to one private network, and all the servers in that network share it. Adding or deleting servers leaves the gateway settings unchanged, so even services that scale servers up and down often manage their outbound path in one place.

NAT gateway S, handling up to 100Mbit/s, is $11.93 per month. M, up to 1Gbit/s, is $22.40 per month, and L, up to 3Gbit/s, is $201.45 per month, with the outbound public IPv4 address included in the prices in the table.

Choose the size by how much your private servers send and receive outward at the same time. For updates and API calls, S is enough; if you often download container images or exchange large files with external storage, choose M. For large services with many nodes talking to the outside at once, L is the right fit.

Payment is made with USDT. Pay the first month when you order, then renew at the same amount on each renewal date. We connect the private network for free, so you can easily work out the total cost from just the server and NAT gateway fees.

First, group the servers you will keep inside into a private network in the same region. Once your first payment is confirmed, tell us the servers on the support page and our team connects them for free. Let servers that do not need to be visible outside, such as databases and worker servers, talk to each other only over private addresses, and open only the web servers or load balancers that receive visitor traffic on public addresses. Separating the front and the inside like this first makes the setup clear at a glance.

Next, order a NAT gateway on the order page and tell us the private network to connect on the support page. Once our team attaches the gateway and sends you its private address, set the default route of the inside servers to the gateway's private address and confirm outbound access with a package update or an external API call. From outside, traffic appears from the gateway's single public IP.

Finally, register the gateway's public IP in the allow lists of partners and external services, and open only the needed ports on front servers with the cloud firewall. When you add servers later, ask us to attach the new server to the same private network and just set the default route, and it joins the same setup right away.