Can I assign a private IP to NAT gateway

Question

Can I assign a private IP to NAT gateway

Anchal Singh 5

Hi I want my logic apps to make API calls using a STATIC PRIVATE IP. Can I assign a private IP to the NAT gateway?

The logic app will send API request to an internal server so I want this to route internally not over the public internet.

Anchal Singh 5 Reputation points

2025-02-13T10:07:30.8133333+00:00

Hi Team,

Can I please get a response on the above query.

3 answers

Your answer

Anchal Singh 5 Reputation points

2025-02-13T10:07:30.8133333+00:00

Hi Team,

Can I please get a response on the above query.

Answer 1

Create a Virtual Network (VNet):
- Create a VNet if you don't have one already.
- Ensure your Logic Apps are integrated with this VNet.
Set up a Private Endpoint for Logic Apps:
- Azure Logic Apps can be configured to connect to your VNet using a Private Endpoint.
- Create a Private Endpoint for your Logic App. This will ensure that all traffic from the Logic App to the API goes through your VNet, keeping it internal.
Create a NAT Gateway:
- A NAT Gateway allows your VNet to access resources over the internet or external services, but using a private IP.
- Create a NAT Gateway and associate it with the subnet in the VNet that your Logic Apps will use.
Assign Static Private IP to NAT Gateway:
- When setting up the NAT Gateway, assign a static private IP from the subnet to ensure the outbound traffic from the Logic App always uses this private IP.
- You need to ensure that the subnet where your Logic App runs is using this NAT Gateway for outbound traffic.
Route traffic through NAT Gateway:
- In the Route Table associated with the subnet where the Logic App is deployed, ensure that the route is directed to the NAT Gateway.
- This ensures that any outbound traffic from your Logic App to the internal server stays within the private network.
Ensure Internal Server Accessibility:
- Verify that the internal server where your Logic App will send API requests is accessible from the VNet.
- The internal server should have the appropriate network security group (NSG) rules and private IP address configured to accept traffic from the Logic Apps.
Testing:
- Once configured, test the API calls from your Logic App to ensure the traffic is routed over the private network and uses the static private IP of the NAT Gateway.

Answer 2

Anchal Singh 5

Can you provide me any documentation on how to complete step 4? How do I Assign Static Private IP to NAT Gateway?

It keeps on asking for a public IP and I see no way to assign just a private IP here. Do you mean assign a public/private IP pair?

rvinnakota 4,760 Reputation points Moderator

2025-02-06T16:44:10.42+00:00

Hi Anchal Singh, A private IP cannot be assigned to the NAT Gateway; only a public IP can be assigned. The NAT Gateway uses this public IP to access the internet Refer this link : https://learn.microsoft.com/en-us/azure/nat-gateway/faq#is-the-nat-gateway-public-ip-address-static Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Anchal Singh 5 Reputation points

2025-02-10T16:37:14.5633333+00:00

Hi,

I am speaking in reference to the above answer by Zafar (MVP).

So for step 4 the NAT Gateway will have a static Public IP assigned to it not private one. (Private IP will be allotted and NAT will change that to a public IP).

If that is the case then in Step 6 my internal server needs to be accessible by the Public IP (of NAT gateway) to 'accept traffic from the Logic Apps'?? and not accessible by the VNet and private IP address?

In Step 7 API calls to my internal server from Logic app with be over a public network using NAT's public IP?? and not its private IP over a private network?

Please refer to my question and the first answer provide by MVP and tell me if it is feasible or not? Because from your recent response it seems like the first answer give by Zafar (MVP) is not practical as it contradicts Step 4, 6 & 7. Kindly provide some clarity.

Answer 3

Alex Burlachenko 10,255

hi,

nope, you can’t assign a private IP to a NAT gateway. NAT gateways in Azure are all about giving your resources (like VMs) outbound internet access using a public IP. They don’t handle private IPs or internal routing.

Anchal Singh 5 Reputation points

2025-02-13T11:14:11.5333333+00:00
Hi,

Can you please help me out with the below questions. I am speaking in reference to the first answer by Zafar (MVP). I was basically seeking a solution of how I can get my logic app to run APIs to access an internal virtual server over a private a network with private IP that I can whitelist.

If that is the case then in Step 6 my internal server needs to be accessible by the Public IP (of NAT gateway) to 'accept traffic from the Logic Apps'?? and not accessible by the VNet and private IP address?

In Step 7 API calls to my internal server from Logic app with be over a public network using NAT's public IP?? and not its private IP over a private network?

Please refer to my question and the first answer provide by MVP and tell me if it is feasible or not?
Alex Burlachenko 10,255 Reputation points

2025-02-13T11:22:11.4766667+00:00

So in Step 6, should my internal server be accessible via the Public IP of the NAT Gateway, instead of a private IP over the VNet?

my answer is No, your internal server should remain accessible only via private IP within the VNet.

The NAT Gateway is used only for outbound traffic (Logic Apps -> External Services).

Your Logic Apps should connect via a Private Endpoint to your internal server over a private IP within the VNet.

Your internal server should NOT be accessible via the NAT Gateway’s Public IP, because that exposes it to the internet.

In Step 7, will API calls from Logic Apps to my internal server go over a public network using the NAT Gateway’s public IP?

My answ - No, API calls to your internal server will remain private.

NAT Gateway is not used for inbound traffic. It only allows outbound traffic from VNet to the internet.

Since your goal is private communication, Logic Apps should send API requests over the private VNet using Private Endpoint + VNet integration.

Your internal server should have NSG rules allowing traffic from Logic Apps’ subnet (private IPs).

Feasibility of Your Setup:

Yes it is, your requirement is feasible, but you need to ensure:

Private Endpoint for Logic Apps -> So it stays within VNet.

VNet Integration for Logic Apps -> Ensures it can reach private IPs.

NSG & Firewall Rules -> Allow private traffic from Logic Apps to internal server.

No Public Exposure of Internal Server -> Do not rely on NAT Gateway for this.

Share via

Can I assign a private IP to NAT gateway

3 answers

Your answer