By Ryan Cassily, Solutions Architect
What it is, how it works, when to use it, and how to optimize it.
Network Address Translation (NAT) has been around for a long time, playing a critical role in extending the lifespan of IPv4 as well as providing breathing room for deploying IPv6. Enterprises have been using it for decades in their corporate and data center networks as an integral part of their network management and security portfolio.
As organizations change the way they use cloud-based services, IT teams look to tighten their security while scaling their private subnets with ease. To solve this problem, NAT gateway is a natural addition to their network. We look at how it works, when to use it, and how you can get more from it.
A Network Address Translation (NAT) gateway allows your resources located in a private subnet to safely access the public internet and other external resources, without allowing inbound connections back to them. These resources are virtual machines (VMs) like databases, app servers, or even managed services, often running with extensive data requirements.
Acting as a conduit, a NAT gateway essentially translates private IP addresses to public ones for outbound traffic.
Say a resource in one of your private subnets needs to download an update from the internet. The NAT gateway will receive and handle that request, replacing the IP with its own public IP before sending the request out and returning the response. Only solicited inbound responses will be allowed, so your resource will receive the required update but any other requests will be denied.
AWS provides both public and private NAT gateways. Public (default) instances allow resources in a private subnet to connect to the internet by translating the private source IP address to a public IP address. The instances can’t receive unsolicited inbound connections from the internet.
Private instances allow resources in a private subnet to connect to other VPCs or your on-premises network through a private NAT gateway, but the instances can’t receive unsolicited inbound connections from the other VPCs or the on-premises network.
Both instances are highly scalable and managed by AWS, supporting 5 Gbps bandwidth and automatically scaling up to 100 Gbps.
Azure NAT Gateway is attached to your VNet subnet and doesn’t require any additional routing configurations. It allows you to initiate connections from your virtual network to the internet while blocking unsolicited inbound connections. Each NAT Gateway automatically scales up to 50 Gbps.
Google Cloud NAT provides both public and private NAT types. Public NAT allows internal virtual machines with private IP addresses to reach destinations on the internet while also blocking unsolicited traffic; private NAT allows internal virtual machines to communicate between VPC networks.
Google Cloud NAT auto-scales to accommodate egress bandwidth limits for routing outside a VPC network per-instance, up to 25 Gbps.
Oracle NAT Gateway attaches to a Virtual Cloud Network (VCN) and allows outbound connectivity to the internet from a private network while blocking unsolicited traffic. You can configure only one NAT Gateway per VCN, which supports up to 20,000 concurrent connections to a single destination.
There is no cost for the NAT Gateway, however, there is an outbound data charge.
If your organization is mid- to enterprise-sized and moves a lot of data, NAT gateway is worth implementing. Key use cases include:
NAT Gateway needs to be deployed through your cloud provider (if they offer this) or a third-party provider like Megaport.
Megaport NAT Gateway offers a seamless deployment and management experience directly from the Megaport Portal. Provision in minutes and get central visibility alongside your other Megaport services for simpler network admin and resource monitoring.
Beyond the basic usage statistics displayed in the portal for all Megaport services, users requiring more in-depth insights and advanced service monitoring capabilities can also use the comprehensive suite of Megaport API endpoints. These powerful tools allow users to programmatically access detailed statistics, configure service parameters, and integrate NAT gateway monitoring into their existing network management systems.
An API-first approach provides the flexibility needed for large-scale deployments, automation, and complex operations, giving users complete control and transparency over their NAT gateway performance and usage.
Look for a provider that offers multiple performance tiers you can move between virtually to scale with your needs. Megaport NAT Gateway’s performance options make it easy to cater to any deployment scenario – from cloud provider internet access to connectivity between overlapping IP address space.
To optimize the security of your NAT gateway, pair it with strict egress filtering to control what your private resources can reach on the internet. This covers the outbound portion of your setup.
Megaport NAT Gateway allows connectivity to be initiated from your private subnets (located in a cloud provider network) to the internet, while blocking unsolicited inbound internet traffic from reaching your private networks. Combine this with firewall service chaining from Megaport Virtual Edge (MVE)for multi-layered protection.
Cost is the big conversation here. NAT gateways are an example of a metered service, meaning they balloon with scale. For businesses moving huge amounts of data, the costs associated with NAT can grow exponentially if left unchecked.
Between hyperscaler egress fees and the inherent inefficiencies of traditional connectivity solutions, enterprises can be left with an eye-watering data bill—often over $5 million (and sometimes up to $50 million) per annum—thanks to:
Again, by far the easiest and most efficient way to reduce and manage costs is to introduce a private connectivity solution for your underlying connectivity, so you don’t have to pay hyperscaler rates. This caps your fees, becoming incredibly cost-effective when you’re managing and moving large amounts of data.
If you’re running a high-volume software operation, managing enterprise-scale cloud infrastructure, or dealing with petabytes of NAT traffic, you’ll see significant cost savings with Megaport NAT Gateway – up to 70% or even more.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。