Before you start

Review the following before creating a NAT Gateway:

• VPC and Subnet: A VPC and target subnet must already exist in the region where you plan to deploy the NAT Gateway.
• LKE Support: NAT Gateway is supported for LKE Enterprise (LKE-E) deployed within a VPC. Standard LKE doesn't support VPC networking or NAT Gateways.
• Linode Interfaces: All Linodes and LKE-E worker nodes attached to target subnets must use Linode interfaces. Legacy configuration profile interfaces are not supported.
  • To ensure newly provisioned Linodes and cluster instances automatically use Linode interfaces, in account settings, set Network Interface Type to: linode_default_but_legacy_config_allowed or linode_only.

    ❗️

    Network Interface Type

    Since Network Interface Type is a global account setting, test it on an account without production workloads first.

  • You can upgrade Linodes using Legacy configuration profile interfaces to use Linode interfaces.
  • If existing worker nodes were provisioned prior to updating your account's Network Interface Type, recycle the cluster's node pools.
• NAT Gateway and 1:1 NAT: All Linodes in a subnet with an associated NAT Gateway use it for outbound connectivity unless 1:1 NAT is enabled on their interfaces.
• Reserved IPv4 Addresses (Manual scaling only): If you choose Manual scaling, you must have unassigned, reserved public IPv4 addresses available in your account within the same region as the NAT Gateway.
• IAM Permissions: Full NAT Gateway functionality is supported for unrestricted account users and IAM Service Accounts. However, restricted users may encounter limitations when creating, configuring, or viewing NAT Gateways.

Create a NAT Gateway

1. Log in to Cloud Manager and navigate to NAT Gateways in the main navigation menu.
2. Click Create NAT Gateway (or Create).
3. In the NAT Label field, enter a name for your NAT Gateway.
   Labels must be 1–64 characters long and consist only of ASCII letters, numbers, and single hyphens (-). Consecutive hyphens (--) are not allowed.
4. Select the Region where your VPC and Linodes reside.
   The NAT Gateway must be located in the same region as the VPC subnet it will be attached to.
5. Under IP Address Allocation, configure how public IPv4 addresses are assigned to the gateway:
   • Ports per Linode: Select your desired portset size from the dropdown (default: 4096 (15 Linodes per IP)). This Beta release supports portset sizes of 4096, (up to 15 nodes per IP), 8192 (up to 7 nodes per IP), and 16384 (up to 3 nodes per IP).
   • Allocation Type: Choose your preferred IP management mode:
     • Autoscaling (Recommended): The platform automatically provisions and releases public IPv4 addresses based on the number of Linodes in the assigned subnet (up to a default maximum of 20 IPs). Best for dynamic workloads with changing capacity needs.
     • Manual scaling: Manually assign unassigned, pre-reserved public IPv4 addresses owned by your account. Best when static outbound IPs are required for external firewall allowlists.
6. In the VPC Subnet Assignment section, choose the network where the gateway will provide outbound internet access:
   • Select a VPC from the dropdown.
   • Select a Subnet from the dropdown.

📘

Attached subnets must contain only Linodes configured with VPC Linode interfaces. Legacy config profile interfaces are not supported for routing outbound traffic on non-1:1 NAT interfaces. Service interfaces, such as NodeBalancer backends and DBaaS, automatically bypass the NAT Gateway.

7. Review your configuration in the Summary card, including the hourly rate.
8. Click Create NAT Gateway.

👍

View Code Snippets

You can click View Code Snippets at the bottom of the form at any time to inspect or copy the cURL payload generated from your selected UI options. This is useful if you want to automate NAT Gateway creation using the Linode API or command-line scripts.