Docs

NAT Gateway

Internet NAT Gateway

Managing an SNAT entry

An Elastic Compute Service (ECS) instance without an associated Elastic IP Address (EIP) can access the internet through the SNAT entry of an Internet NAT Gateway. This topic describes how to create, modify, and delete an SNAT entry.

Create an SNAT entry

After creating an SNAT entry, your ECS instances can share the EIP associated with the SNAT entry to access the internet.

Prerequisites

The Internet NAT Gateway is associated with an EIP.

The CIDR block for the newly created SNAT entry cannot be the same as any existing SNAT entries.

When multiple SNAT entries have overlapping CIDR blocks, the system matches SNAT entries based on the longest subnet mask. That is, the longer the subnet mask of the SNAT entry, the higher the priority. For example, an SNAT entry at granularity of ECS with a subnet mask of /32 has the highest priority due to its longest length.

Make sure the route table linked to your ECS instance's subnet (for the SNAT entry) includes a custom route entry.The recommended destination Classless Inter-Domain Routing (CIDR) block for this entry is 0.0.0.0/0, with the target Internet NAT Gateway instance as the next hop. This ensures the SNAT entry takes effect. For specific actions, see Add route.

tip

If you create your first Internet NAT Gateway in a Virtual Private Cloud (VPC), the system automatically adds a custom route entry with a destination CIDR block of 0.0.0.0/0 and the next hop of the Internet NAT Gateway instance in the system route table, routing traffic to the Internet NAT Gateway.

Procedure

In the top menu bar, select a target region and project.

In the list of Internet NAT Gateways, click the name of the target NAT Gateway.

Select the SNAT rules tab, then click Create SNAT rule.

Configure relevant parameters based on the table below.

Parameter	Description	Sample value
Name	Enter the name of the SNAT rule. Enter the name of the SNAT rule.	snat-1snat-1
Granularity	Set the granularity of the SNAT entry. Subnet: The subnet of the VPC to which your Internet NAT Gateway belongs. All ECS instances that are not associated with any EIPs within this subnet can access the internet through the SNAT entry. VPC: The VPC to which your Internet NAT Gateway belongs. All ECS instances that are not associated with any EIPs within the VPC can access the internet through the SNAT entry. ECS: select an ECS instance within the VPC of the Internet NAT Gateway. The selected instance can access the internet through the SNAT entry. Custom CIDR: The custom CIDR block. All ECS instances that are not associated with any EIPs within the specified CIDR block can access the internet through the SNAT entry.	Subnet subnet-1\|192.XX.XX.0/24
EIP	Select the EIP associated with the Internet NAT Gateway. Select a single EIP: Select a single EIP from the dropdown list. All business connections access the internet through this EIP. Select multiple EIPs: Select multiple EIPs from the dropdown list. Business connections access the internet through relative EIPs assigned by the five-tuple hashing algorithm. tip When a SNAT rule is associated with multiple EIPs, we recommend adding the EIPs to a Bandwidth Package to prevent any traffic packet loss caused by any one EIP reaching its bandwidth limit. If you associate the same EIP with both your DNAT entry and SNAT entry, service preemption may occur. Therefore, we recommend that you associate your DNAT entry and SNAT entry with different EIPs.	12.XX.XX.89\|eip-1

Click OK to complete the action.

Modify an SNAT entry

After creating an SNAT entry, you can modify its name and EIP.

Instructions

Modifying an EIP in an SNAT entry will cause the existing SNAT connection drop. To re-establish the connection, a request made from the ECS instance is required. Proceed with caution.

Procedure

In the top menu bar, select a target region and project.

In the list of Internet NAT Gateways, click the name of the target NAT Gateway.

Select the SNAT rules tab. On the right side of the target SNAT entry list, click Edit to modify the name and EIP.

tip

Note the following when modifying the EIP of the SNAT entry:

Single EIP: If you select a single EIP from the drop-down list, all business connections access the internet through the EIP.

Multiple EIPs: If you select multiple EIPs from the drop-down list, business connections access the internet through relative EIPs assigned by the five-tuple hashing algorithm. It is recommended to add the EIPs to a Shared Bandwidth Package to prevent any traffic packet loss caused by reaching the bandwidth cap of a single EIP.

Click OK to complete the action.

Delete an SNAT entry

If you no longer need an SNAT entry, you can follow this procedure to delete it.

In the top menu bar, select a target region and project.

In the list of Internet NAT Gateways, click the name of the target NAT Gateway.

Select the SNAT rules tab, click Delete on the right side of the target SNAT entry list.

Click Delete to complete the action.