Manage NAT gateway

Learn how to create and remove a NAT gateway resource from a virtual network subnet. A NAT gateway enables outbound connectivity for resources in an Azure Virtual Network. You may wish to change the IP address or prefix your resources use for outbound connectivity to the internet. The public IP address and public IP address prefixes associated with the NAT gateway can be changed after deployment.

This article explains how to manage the following aspects of NAT gateway:

  • Create a NAT gateway and associate it with an existing subnet.

  • Remove a NAT gateway from an existing subnet and delete the resource.

  • Add or remove a public IP address or public IP prefix.

Prerequisites

  • An Azure account with an active subscription. Create an account for free.

  • An existing Azure Virtual Network. For information about creating an Azure Virtual Network, see Quickstart: Create a virtual network using the Azure portal.

    • The example virtual network used in this article is named myVNet. Replace the example value with the name of your virtual network.

    • The example subnet used in this article is named mySubnet. Replace the example value with the name of your subnet.

    • The example nat gateway used in this article is named myNATgateway.

  • This how-to article requires version 2.31.0 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.

  • Azure PowerShell installed locally or Azure Cloud Shell.

  • Sign in to Azure PowerShell and ensure you've selected the subscription with which you want to use this feature. For more information, see Sign in with Azure PowerShell.

  • Ensure your Az.Network module is 4.3.0 or later. To verify the installed module, use the command Get-InstalledModule -Name "Az.Network". If the module requires an update, use the command Update-Module -Name Az.Network if necessary.

If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run Get-Module -ListAvailable Az to find the installed version. If you need to upgrade, see Install Azure PowerShell module. If you're running PowerShell locally, you also need to run Connect-AzAccount to create a connection with Azure.

Create a NAT gateway and associate it with an existing subnet

You can create a NAT gateway resource and add it to an existing subnet with the Azure portal, PowerShell, and the Azure CLI.

  1. Sign-in to the Azure portal.

  2. In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.

  3. Select + Create.

  4. Enter or select the following information in the Basics tab of Create network address translation (NAT) gateway.

    Setting Value
    Project details
    Subscription Select your subscription.
    Resource group Select your resource group or select Create new to create a new resource group.
    Instance details
    NAT gateway name Enter myNATgateway.
    Region Select your region. East US 2 is used in this example.
    Availability zone Select an availability zone. No Zone is used in this example.
    For more information about NAT gateway availability, see NAT gateway and availability zones.
    TCP idle timeout (minutes) Select an idle timeout. The default of 4 is used in this example.
  5. Select the Outbound IP tab, or select Next: Outbound IP.

  6. You can select an existing public IP address or prefix or both to associate with the NAT gateway and enable outbound connectivity.

    • To create a new public IP for the NAT gateway, select Create a new public IP address. Enter myPublicIP-NAT in Name. Select OK.

    • To create a new public IP prefix for the NAT gateway, select Create a new public IP prefix. Enter myPublicIPPrefix-NAT in Name. Select a Prefix size. Select OK.

  7. Select the Subnet tab, or select Next: Subnet.

  8. Select your virtual network or select Create new to create a new virtual network. In this example, select myVNet or your existing virtual network in the pull-down box.

  9. Select the checkbox next to mySubnet or your existing subnet.

  10. Select Review + create.

  11. Select Create.

Remove a NAT gateway from an existing subnet and delete the resource

To remove a NAT gateway from an existing subnet, complete the following steps.

  1. Sign-in to the Azure portal.

  2. In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.

  3. Select myNATgateway or the name of your NAT gateway.

  4. Select Subnets in Settings.

  5. Select Disassociate to remove the NAT gateway from the configured subnet.

You can now associate the NAT gateway with a different subnet or virtual network in your subscription. To delete the NAT gateway resource, complete the following steps.

  1. In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.

  2. Select myNATgateway or the name of your NAT gateway.

  3. Select Delete.

  4. Select Yes.

Note

The public IP address or prefix associated with the NAT gateway aren't deleted when you delete the NAT gateway resource.

Add or remove a public IP address

Complete the following steps to add or remove a public IP address from a NAT gateway.

  1. Sign-in to the Azure portal.

  2. In the search box at the top of the portal, enter Public IP address. Select Public IP addresses in the search results.

  3. Select + Create.

  4. Enter or select the following information in Create public IP address.

    Setting Value
    IP version Select IPv4.
    SKU Select Standard.
    Tier Select Regional.
    IPv4 IP Address Configuration
    Name Enter myPublicIP-NAT2.
    Routing preference Leave the default of Microsoft network.
    Subscription Select your subscription.
    Resource group Select your resource group. myResourceGroup is used in this example.
    Location Select a location. East US 2 is used in this example.
    Availability zone Leave the default of Zone-redundant.
  5. Select Create.

  6. In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.

  7. Select myNATgateway or the name of your NAT gateway.

  8. Select Outbound IP in Settings.

  9. The IP addresses and prefixes associated with the NAT gateway are displayed. Select Change next to Public IP addresses.

  10. Select the pull-down box next to Public IP addresses. Select the checkbox next to the IP address you created previously to add the IP address to the NAT gateway. To remove an address, uncheck the box next to its name.

  11. Select OK.

  12. Select Save.

Add or remove a public IP prefix

Complete the following steps to add or remove a public IP prefix from a NAT gateway.

  1. Sign-in to the Azure portal.

  2. In the search box at the top of the portal, enter Public IP prefix. Select Public IP Prefixes in the search results.

  3. Select + Create.

  4. Enter or select the following information in the Basics tab of Create a public IP prefix.

    Setting Value
    Project details
    Subscription Select your subscription.
    Resource group Select your resource group. myResourceGroup is used in this example.
    Instance details
    Name Enter myPublicIPPrefix-NAT.
    Region Select your region. East US 2 is used in this example.
    IP version Select IPv4.
    Prefix ownership Select Microsoft owned.
    Prefix size Select a prefix size. /28 (16 addresses) is used in this example.
  5. Select Review + create.

  6. Select Create.

  7. In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.

  8. Select myNATgateway or the name of your NAT gateway.

  9. Select Outbound IP in Settings.

  10. The IP addresses and prefixes associated with the NAT gateway are displayed. Select Change next to Public IP prefixes.

  11. Select the pull-down box next to Public IP Prefixes. Select the checkbox next to the IP address prefix you created previously to add the prefix to the NAT gateway. To remove a prefix, uncheck the box next to its name.

  12. Select OK.

  13. Select Save.

Next steps

To learn more about Azure Virtual Network NAT and its capabilities, see the following articles: