CLOUD CONCEPT

Network Address Translation

Network Address Translation rewrites IP addresses, and sometimes transport-layer ports, as packets move between networks.

Cloud Concepts Hub →

What is Network Address Translation

Network Address Translation allows workloads to communicate using addresses different from those assigned to their network interfaces. Cloud architectures commonly use it to give private workloads outbound IPv4 connectivity, conserve public addresses, or connect networks that require address remapping.

Network Address Translation, commonly abbreviated NAT, changes source or destination IP addresses as packets cross a network boundary. Source NAT changes the sender's address, while destination NAT changes the receiver's address. Many outbound implementations also translate TCP or UDP ports, allowing multiple private addresses to share one public IPv4 address. A stateful translator records these mappings so that response packets reach the correct originating workload.

For example, an application server at 10.0.2.15 might download operating-system updates from an internet repository. An outbound NAT device replaces the server's private source address with an externally reachable address and may replace its source port. The repository responds to that translated address and port, and the translator reverses the mapping. The application server does not need its own public IPv4 address.

In AWS, a typical design places application servers in private subnets and a public NAT gateway in a public subnet. The private subnet's route table sends internet-bound IPv4 traffic, commonly through a 0.0.0.0/0 route, to the NAT gateway. The gateway's subnet routes internet traffic to an internet gateway, and the public NAT gateway has an Elastic IP address. More precisely, the NAT gateway first translates the workload's source address to its own private address, and the internet gateway maps that address to the Elastic IP. Both routing stages must be correct.

A route to an internet gateway alone does not give an IPv4-only instance with only a private address internet access. Likewise, adding a NAT gateway does not automatically change subnet routes. A private NAT gateway serves a different purpose: it translates traffic toward connected private networks, such as networks reached through a transit gateway or virtual private gateway, rather than providing internet access. Transit gateways provide routing connectivity; they do not automatically translate overlapping addresses.

NAT is not a replacement for security policy. An outbound NAT gateway permits response traffic for connections initiated behind it, but it does not expose arbitrary inbound connections to those workloads. General-purpose NAT implementations can support inbound destination mappings, so NAT as a concept is not synonymous with outbound-only access. Security groups, network ACLs, firewalls, and application authorization remain necessary. AWS NAT gateways do not have security groups; workload security groups and subnet network ACLs still affect connectivity. Security groups are stateful, whereas network ACLs are stateless and must allow the required traffic in both directions.

Availability and performance depend on the implementation. With zonal NAT gateways, placing a gateway in each workload Availability Zone and using same-zone routes avoids depending on another zone and can avoid cross-zone transfer charges. A single shared gateway reduces gateway-hour charges but introduces a shared failure dependency and potentially additional data-transfer costs. NAT instances offer control over software and configuration, but engineers must size them, patch them, disable EC2 source/destination checks, and implement failover. Their connection tracking, CPU, and network capacity can become bottlenecks.

Cost comparisons must include gateway hours, processed data, public IPv4 charges, applicable transfer charges, and operational effort. A small NAT instance can cost less for modest traffic, but it is not operationally equivalent to a managed gateway. Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB can keep eligible traffic off the NAT path. Interface endpoints can also provide private service access, but their hourly and processing charges require a separate comparison.

When troubleshooting, follow the complete forward and return paths. Check route-table associations, gateway availability, internet-gateway attachment, public address assignment, workload security-group egress, and network ACL rules, including ephemeral return ports. Confirm DNS resolution separately from IP connectivity. Use VPC Flow Logs and NAT gateway metrics to investigate rejected traffic, packet drops, or source-port allocation failures. Many simultaneous connections to the same destination can exhaust translation capacity even when bandwidth usage appears low.

IPv6 usually does not require address translation for internet access. In AWS, an egress-only internet gateway supports outbound-initiated IPv6 communication without performing NAT. NAT64 is a separate translation mechanism that allows IPv6 clients to reach IPv4 destinations, often combined with DNS64. Distinguishing ordinary IPv6 routing, outbound-only IPv6 access, and address-family translation prevents incorrect gateway choices.

Key aspects of Network Address Translation

Effective NAT design combines correct translation and routing with independent security controls, sufficient capacity, resilient placement, and cost-aware traffic paths.

Address rewriting and connection mappings

NAT changes source or destination addresses; implementations that also translate ports can share an address across many workloads. Stateful mappings allow return traffic to reach the original sender.

Explicit forward and return paths

NAT only works when route tables direct traffic through the translator and responses return through a compatible translation path. Creating a gateway does not automatically configure workload routing.

Connectivity is distinct from security

Outbound NAT commonly prevents unsolicited inbound connections, but it does not inspect application intent or replace access controls. Apply workload security groups, subnet network ACLs, and any required egress filtering separately.

Availability and scaling boundaries

Translation devices have connection, port, and throughput limits. For zonal deployments, same-zone gateways reduce cross-zone dependencies, while self-managed instances require explicit capacity planning and failover.

Total-cost optimization

Compare fixed gateway or instance costs, data processing, transfer, public addresses, and operational work. Use private service endpoints when their connectivity and pricing provide a better alternative to the NAT path.

Observable failure modes

Broken routes, blocked return ports, failed DNS resolution, and exhausted translation mappings can produce similar application symptoms. Correlate route inspection, flow logs, and gateway metrics rather than assuming every timeout is a firewall problem.

IPv4 and IPv6 require different designs

Private IPv4 workloads commonly use NAT for internet access, while IPv6 workloads can use globally routable addresses with appropriate controls. Egress-only IPv6 gateways do not translate addresses; NAT64 specifically bridges IPv6 clients to IPv4 destinations.

Cloud services for Network Address Translation

Amazon VPC supplies the routing and network controls around a translation path. Private-subnet routes can send outbound IPv4 traffic to a public NAT gateway, whose subnet reaches an internet gateway; security groups and network ACLs independently control permitted traffic. Amazon EC2 provides an alternative implementation through a self-managed NAT instance when custom behavior or a carefully evaluated cost advantage justifies the maintenance burden.

CloudWatch metrics and VPC Flow Logs help distinguish translation-capacity problems from routing or filtering failures. VPC endpoints can remove supported service traffic from the NAT path, reducing processed data and external connectivity dependencies. Choose endpoint types and gateway placement using both availability requirements and the complete traffic-cost model.

Amazon VPC

Provides the subnets, route tables, internet gateways, network ACLs, and security groups that determine how translated traffic flows. Its gateway and interface endpoints can provide alternative paths that avoid NAT for supported service traffic.

Open Amazon VPC →

Amazon EC2

Can host a self-managed NAT instance using operating-system forwarding and translation rules. This requires disabling source/destination checks and managing security groups, patching, capacity, and failover.

Open Amazon EC2 →

Amazon CloudWatch

Exposes NAT gateway metrics for traffic, connection activity, packet drops, and port allocation errors. CloudWatch Logs can also receive VPC Flow Logs to support investigation of routing and filtering symptoms.

Open Amazon CloudWatch →