A VPC NAT Gateway connects multiple Linodes in a private subnet to the public internet using shared public IPv4 addresses while blocking unsolicited inbound traffic.

Before you start

• LKE Support: NAT Gateway is supported for LKE Enterprise (LKE-E) deployed within a VPC. Standard LKE doesn't support VPC networking or NAT Gateways.

• Linode Interfaces: All Linodes and LKE-E worker nodes attached to target subnets must use Linode interfaces. Legacy configuration profile interfaces are not supported.
  
  

  🚧

  Network Interface Type

  To ensure newly provisioned Linodes and cluster instances automatically use Linode interfaces, in account settings, set Network Interface Type to: linode_default_but_legacy_config_allowed or linode_only. Since Network Interface Type is a global account setting, test it on an account without production workloads first.

  If your compute instances currently use a legacy configuration profile interfaces, upgrade them to use Linode Interfaces before creating a NAT Gateway.

  If existing worker nodes were provisioned prior to updating your account's Network Interface Type, recycle the cluster's node pools so replacement worker nodes spin up with Linode interfaces.

• Linode Power State: Existing Linodes must be Powered Off before modifying their network interfaces or assigning them to a VPC subnet.

• IAM: Full NAT Gateway functionality is supported for unrestricted account users and IAM Service Accounts. However, restricted users may encounter limitations when creating, configuring, or viewing NAT Gateways.

• Cluster Access: To enable NAT Gateway for an LKE-Enterprise (LKE-E) cluster, kubectl configured with administrative access to the LKE-Enterprise cluster is required.

NAT Gateway workflow for Linode compute instances

1. Create a VPC and subnets if you are not using an existing VPC. Set up the subnets where your workloads will run. You can also create VPCs and subnets when you create new Linodes.
2. Create or assign Linodes:
   • Create a new Linode directly in your target VPC subnet. When creating a new Linode, don't select Allow public IPv4 access (1:1 NAT). If 1:1 NAT is enabled, the Linode will use the 1:1 NAT IP instead of NAT Gateway.
   • Assign an existing Linode to your VPC subnet. Before assigning an existing Linode to a subnet, power it off and make sure it uses Linode interfaces. After assigning it to the subnet, power the Linode back on. Legacy config profile interfaces are not supported and prevent NAT Gateway attachment.

     📘

     Each VPC interface in the subnet consumes exactly one portset allocation, regardless of whether the Linode is booted or powered off.

3. Determine if your NAT Gateway will use:
   • Autoscaling (Default): The platform automatically allocates and releases public IPv4s as needed (up to a limit of 20 IPs by default). The first IP is provisioned as soon as a VPC interface is created in the subnet (even if the Linode is powered off). Best for dynamic workloads with changing capacities that do not require fixed egress IPs.
   • Manual scaling: You explicitly assign pre-reserved public IPv4s to maintain fixed egress IP addresses. Best for workloads that require permanent, known outbound IP addresses that can be allowlisted.
4. Reserve public IPv4 addresses (manual scaling only). If using manual scaling, reserve your public IPv4 addresses first. Reserved IPs must be unassigned and located in the same region as your VPC and Linodes.
5. Create a NAT Gateway.
   • Define the region, label, and IP address allocation mode (autoscaling or manual scaling).
   • Choose your portset size for each Linode. The default is 4,096 ports (up to 15 Linodes per IP), but this can be configured from 64 ports (~1,008 Linodes per IP) up to 16,384 ports (3 Linodes per IP).

     📘

     Available portset sizes for BETA include;

     • 4,096 (default) - supports up to 15 nodes per IP
     • 8,192 - supports up to 7 nodes per IP
     • 16,384 - supports up to 3 nodes per IP

   • Associate the NAT Gateway with a subnet. All VPC interfaces in this subnet will immediately use the NAT Gateway for outbound connectivity on all VPC IPs, unless 1:1 NAT is explicitly enabled.
     (Service subnets, such as those used by NodeBalancer backends or DBaaS, automatically bypass the NAT Gateway.)
6. View and manage your NAT Gateway and monitor its capacity.

NAT Gateway workflow for LKE-Enterprise

To enable NAT Gateway for an LKE-Enterprise (LKE-E) cluster:

1. Create an LKE-Enterprise cluster:

   • For Cluster Tier, select LKE Enterprise.
   • For VPC, select Automatically generate a VPC for this cluster (or choose an existing VPC and IPv4 subnet).
     If you auto-generate a VPC, note the generated VPC ID and IPv4 Subnet ID from the cluster summary page after provisioning completes.

2. Create and attach the NAT Gateway.

   • Define the region, label, and IP address allocation mode (autoscaling or manual scaling).
   • Choose your portset size for each Linode. The default is 4,096 ports (up to 15 Linodes per IP), but this can be configured from 64 ports (~1,008 Linodes per IP) up to 16,384 ports (3 Linodes per IP).

     📘

     Available portset sizes for BETA include;

     • 4,096 (default) - supports up to 15 nodes per IP
     • 8,192 - supports up to 7 nodes per IP
     • 16,384 - supports up to 3 nodes per IP

   • Associate the NAT Gateway with a subnet. All VPC interfaces in this subnet will immediately use the NAT Gateway for outbound connectivity on all VPC IPs, unless 1:1 NAT is explicitly enabled.
     (Service subnets, such as those used by NodeBalancer backends or DBaaS, automatically bypass the NAT Gateway.)

3. Deploy a routing DaemonSet to install and maintain the required routing rules on every worker node, including nodes added through manual scaling or autoscaling.

   The DaemonSet routes selected outbound traffic through the NAT Gateway, while other traffic continues to use the worker node’s public interface.

   Install the following DaemonSet in the cluster using kubectl. Before applying the DaemonSet:

   • Replace 203.0.113.1 with your specific target IP or CIDR block.
   • Replace 10.0.0.1 with the default gateway IP of your cluster's VPC subnet.

kubectl apply -f - <<'EOF'
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: lke-route-installer
  namespace: kube-system
  labels:
    app: route-installer
spec:
  selector:
    matchLabels:
      app: route-installer
  template:
    metadata:
      labels:
        app: route-installer
    spec:
      priorityClassName: system-node-critical
      hostNetwork: true
      tolerations:
      - operator: "Exists"
      containers:
      - name: route-maintainer
        image: alpine:latest
        securityContext:
          privileged: true
        command: ["/bin/sh", "-c"]
        args:
          - |
          echo "Starting route maintainer loop..."
          while true; do
            ip route replace 203.0.113.1 dev eth0 via 10.0.0.1
            sleep 30
          done
        resources:
          limits:
            cpu: 50m
            memory: 50Mi
EOF

4. View and manage your NAT Gateway and monitor its capacity.