Release notes
Back to All

Nov 4, 2026 — NAT Gateways on VPC (BETA)

about 4 hours ago

A NAT Gateway connects multiple Linodes to the public internet using shared public IPv4 addresses, while automatically blocking unsolicited inbound traffic.

  • Shared public IPv4 addresses. NAT Gateways use shared ports, allowing multiple Linodes to use a single public IPv4 address (a one-to-many NAT setup). This reduces the need for individual public IP assignments.
  • Subnet-level assignments. NAT Gateway objects are assigned to VPC subnets, not individual interfaces. All Linodes in a subnet with an associated NAT Gateway use it for outbound connectivity unless 1:1 NAT is enabled on their interfaces.
  • Connectivity. Linodes using NAT Gateway can initiate connections to the public internet and receive responses. Devices on the public internet can't initiate connections to these Linodes unless NAT hole punching is used.

Portset allocation

A NAT Gateway divides the available outbound ports on a public IPv4 address into equal-sized, isolated blocks called portsets. Each VPC interface on the subnet using the NAT Gateway for outbound traffic receives a unique portset.

When a Linode VPC interface is assigned the portset, for example 4096–8191 on IP address 46.128.8.128, it uses ports from that range to establish new outbound connections.

The number of interfaces a single public IP can support depends on your configured portset size. By default, each public IP assigned to a NAT Gateway supports up to 15 VPC interfaces. When autoscaling is enabled, the NAT Gateway scales dynamically, as Linodes on the subnet are created or deleted.

Address allocation modes

NAT Gateway offers two modes for managing public IPv4 addresses; autoscaling (default) and manual.

Autoscaling mode (Default). The NAT Gateway automatically allocates additional public IPv4 addresses as needed to support more Linodes, up to a defined limit. This helps prevent provisioning deployment failures when adding new workloads to a subnet. The gateway provisions an initial IP address when the first active Linode interface is detected, and scales all the way down to zero IPs if the subnet becomes completely empty. Use autoscaling when your workflows do not require static egress IPs.

  • Example - Autoscaling enabled. A cluster with 60 nodes is deployed inside a VPC subnet connected to a default NAT Gateway with autoscaling enabled. The platform automatically assigns four public IP addresses to provide enough portsets, supporting up to 60 nodes (15 nodes per IP address). When the cluster scales out to 100 nodes, the NAT Gateway dynamically allocates three more public IP addresses, bringing the total to seven and increasing capacity to 105 nodes. As a result, the deployment continues without interruption.

Manual scaling mode. You can manually assign reserved public IPv4 addresses to a NAT Gateway when fixed egress IPs, such as those required for allowlisting on firewall rules, are needed.

  • Example - Manual IP assignments (static IPs). A cluster with 60 nodes is deployed inside a subnet connected to a static NAT Gateway configured with four fixed public IP addresses, supporting up to 60 nodes. When a request is made to scale the cluster to 100 nodes, the platform rejects the operation because the NAT Gateway has reached its capacity. To resolve this, manually reserve and assign three additional public IP addresses to the NAT Gateway, increasing the total capacity to 105 nodes. After updating the configuration, the cluster expansion completes successfully.

1:1 NAT vs NAT Gateway

The current VPC product provides IPv4 connectivity within the VPC and allows you to assign additional public IPv4 addresses to Linodes in the VPC. This setup, known as 1:1 NAT, gives each configured Linode its own public IPv4 address, which is used only by that Linode. Unless restricted by Cloud Firewall, the Linode is accessible from the public internet at this address.

NAT Gateway offers another way for Linodes in a VPC to access the public IPv4 internet. With NAT Gateway:

  • Multiple Linodes in the VPC can share the same public IPv4 address (“one-to-many NAT”).
  • Linodes using NAT Gateway can start connections to the public internet and receive responses, but devices on the public internet can't start connections to these Linodes unless NAT hole punching is used.
Feature1:1 NATNAT Gateway
IP AllocationEach Linode gets its own unique public IP.Multiple Linodes share a single public IP.
Traffic DirectionBidirectional. Inbound and outbound connections are allowed by default.Outbound-only. Linodes can connect out, external devices can't connect in.
Use caseWeb servers, API endpoints, or services that need to be publicly accessible.Private backend databases or internal applications that shouldn't be exposed to the publi

Subnet migration and IP recycling

Autoscaled NAT Gateways can be moved dynamically from one subnet to another. For example, if a subnet supporting 60 nodes has its NAT Gateway detached, the gateway automatically releases its active load and scales down to zero public IP addresses. As a result, instances in that subnet immediately lose external network access.

When that same NAT Gateway is subsequently attached to a different subnet containing 65 nodes, it provisions 5 new public IP addresses to support the new compute workloads. These IP addresses are freshly allocated out of the available infrastructure pool and may differ from the addresses previously used, ensuring efficient IP recycling.

📘

NAT Gateways Beta

NAT Gateways is currently in Beta. Review the following operational constraints before deploying in production:

  • Autoscale IP Limit: Autoscaled NAT Gateways can provision up to 20 public IPv4 addresses by default. Higher limits may be approved on a case-by-case basis, subject to applicable conditions. Contact Customer Support to request a limit increase.
  • IAM permissions: Full NAT Gateway functionality is supported for unrestricted account users and IAM Service Accounts. However, restricted users may encounter limitations when creating, configuring, or viewing NAT Gateways.
  • High-Throughput & DDoS Protection: NAT Gateway Beta is designed for lower-throughput outbound traffic, such as API access and IP allowlisting. Traffic from a single public IP that exceeds monitored thresholds may trigger automated DDoS detection or mitigation safety measures. Customers with higher-throughput requirements should continue using 1:1 NAT during Beta.
  • Terraform and CLI: Terraform and CLI support is not available during Beta. You can configure and manage NAT Gateways using Cloud Manager, and the Linode API.

NAT Gateway endpoints (new)

New endpoints to create and manage NAT Gateway objects.

VPC endpoints to configure and view NAT Gateways (updates)

  • Create a VPC subnet. POST vpcs/{vpcId}/subnets
    Assign an existing NAT Gateway to the new subnet by specifying a NAT Gateway ID.
  • List VPC subnets. GET /vpcs/{vpcId}/subnets
    Returns the NAT Gateway configuration routing outbound connections for subnets if a NAT gateway is attached.
  • Get a VPC subnet. GET /vpcs/{vpcId}/subnets/{vpcSubnetId}
    Returns the NAT Gateway configuration routing outbound connections for this subnet if a NAT gateway is attached.
  • Update a VPC subnet. PUT /vpcs/{vpcId}/subnets/{vpcSubnetId}
    Add, change, or remove a NAT Gateways from subnets.
  • Create a VPC. POST /vpcs
    If you define subnets during the creation of a VPC, you can optionally configure each subnet with an existing, compatible NAT Gateway by providing a natgateway id. The NAT Gateway must reside in the same region as the new VPC, and it can't already be used by another subnet. Active Linode interfaces added to a NAT-configured subnet automatically route outbound public internet traffic through the gateway, bypassing any legacy setup.
  • List VPC IP addresses. GET /vpcs/ips
    Provides Information about the NAT Gateway associated with a VPC subnet's IPs. Returns null if the IP address does not belong to a subnet assigned to a NAT Gateway.
  • List a VPC's IP addresses. GET vpcs/{vpvId}/ips
    Provides Information about the NAT Gateway associated with a single VPC subnet's IPs. Returns null if the IP address doesn't belong to a subnet assigned to a NAT Gateway.

Linode interface endpoints (updates)

  • Add a Linode interface. POST /linode/instances/{id}/interfaces
    If you create a VPC interface within a subnet that has an active NAT Gateway, the system automatically allocates one outbound portset to this interface. If no portsets are free, and auto scaling is enabled, it will attempt to autoscale and provision a new public IP for the gateway.
    📘

    Configuration profile interfaces

    Legacy configuration profile VPC interfaces can't be used on subnets with an active NAT Gateway.

  • List Linode interfaces. GET /linode/instances/{linodeId}/interfaces
    For VPC interface types, information about the NAT Gateway linked to an interface’s subnet is provided. If no NAT Gateway is associated, the value returned is null.
  • Get a Linode interface. GET /linode/instances/{linodeId}/interfaces/{interfaceId}
    For a VPC interface, information about the NAT Gateway linked to an interface’s subnet is provided. If no NAT Gateway is associated, the value returned is null.
  • Delete a Linode interface. DELETE /linode/instances/{linodeId}/interfaces/{interfaceId}
    NAT Gateway downscaling (VPC interfaces only)
    • If you delete a VPC interface on a subnet with an active autoscaled NAT Gateway, and it was the last active portset using a specific IP address on the NAT Gateway, that IP address is deallocated and returned to the shared platform pool.
    • Because autoscaled NAT Gateway IP addresses are released automatically, you may lose access to these public IP addresses when deleting VPC interfaces. If your external systems depend on allowlisting these specific egress IPs, configure your NAT Gateway to use manual address management.
    • Powering down or shutting down a Linode does not free its NAT Gateway portset. Outbound ports remain reserved for the VPC interface as long as it exists. To free the portset and trigger downscaling, you must explicitly delete the VPC interface or Linode.

Linode IP addresses endpoint (update)

  • Get networking information. GET /linode/instances/{linodeId}/ips
    If the Linode has a VPC IP address, you receive information about the NAT Gateway associated with the subnet for that VPC IP address. If the IP address does not belong to a subnet assigned to a NAT Gateway, the response returns null.

Networking IP addresses endpoints (updates)

  • List IP addresses. GET /networking/ips
    Now includes natgateway as a possible assigned_entity type for each IP address. The type can be linode, nodebalancer, or natgateway (new).
  • Get an IP address. GET /networking/ips/{address}
    Now includes natgateway as a possible assigned_entity type for the IP address. The type can be linode, nodebalancer, or natgateway (new).
  • Share IP addresses. POST /networking/ips/share
    A public IPv4 address can't be shared if it's actively assigned to a NAT Gateway.
  • Update an IP address. PUT /networking/ips/{address}
    • If the IP address is assigned to a NAT Gateway, you can't configure reverse DNS. Setting the rdns property in your request payload under this condition will result in a 400 Bad Request.
    • You can toggle the reserved status of IP addresses assigned to NAT Gateways. Unreserving an IP removes it from your reserved list and makes it unavailable for assignment. This action can't be undone.

Reserved IP endpoints (updates)

  • List reserved IP addresses. GET /networking/reserved/ips
    Now includes natgateway as a possible assigned_entity type for the reserved IPs address on your account. The type can be linode, nodebalancer, or natgateway (new).
  • Get a reserved IP address. GET /networking/reserved/ips/{address}
    Now includes natgateway as a possible assigned_entity type for the reserved IP address on your account. The type can be linode, nodebalancer, or natgateway (new).
  • Unreserve an IP address. DELETE /networking/reserved/ips/{address}
    If you unreserve an IP address that is actively assigned to a NAT Gateway or a NodeBalancer:
    • The reservation is removed, stopping billing charges and the IP address remains assigned to and actively used by the NAT Gateway.
    • NAT translation and outbound connectivity will not be interrupted. The IP simply transitions from a reserved state to an ephemeral state owned by the underlying platform service.

Regions and Accounts endpoints (updates)

  • Get a region. GET /regions/{regionId}
    Lists regional capability for NAT Gateway if it's available.
  • Get your account. GET /account
    Lists new capability for NAT Gateway on your account if it's available.

New events

  • natgateway_create
  • natgateway_delete
  • natgateway_update
  • natgateway_add_address
  • natgateway_remove_address