Quickstart: Create a NAT gateway using Azure PowerShell

This quickstart shows you how to use the Azure Virtual Network NAT service. You'll create a NAT gateway to provide outbound connectivity for a virtual machine in Azure.


  • An Azure account with an active subscription. Create an account for free.
  • Azure PowerShell installed locally or Azure Cloud Shell

If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run Get-Module -ListAvailable Az to find the installed version. If you need to upgrade, see Install Azure PowerShell module. If you're running PowerShell locally, you also need to run Connect-AzAccount to create a connection with Azure.

Create a resource group

Create a resource group with New-AzResourceGroup. An Azure resource group is a logical container into which Azure resources are deployed and managed.

The following example creates a resource group named myResourceGroupNAT in the eastus2 location:

$rsg = @{
    Name = 'myResourceGroupNAT'
    Location = 'eastus2'
New-AzResourceGroup @rsg

Create the NAT gateway

In this section we create the NAT gateway and supporting resources.

  • To access the Internet, you need one or more public IP addresses for the NAT gateway. Use New-AzPublicIpAddress to create a public IP address resource named myPublicIP in myResourceGroupNAT.

  • Create a global Azure NAT gateway with New-AzNatGateway. The result of this command will create a gateway resource named myNATgateway that uses the public IP address myPublicIP. The idle timeout is set to 10 minutes.

  • Create a virtual network named myVnet with a subnet named mySubnet using New-AzVirtualNetworkSubnetConfig in the myResourceGroup using New-AzVirtualNetwork. The IP address space for the virtual network is The subnet within the virtual network is

  • Create an Azure Bastion host named myBastionHost to access the virtual machine. Use New-AzBastion to create the bastion host. Create a public IP address for the bastion host with New-AzPublicIpAddress.

## Create public IP address for NAT gateway ##
$ip = @{
    Name = 'myPublicIP'
    ResourceGroupName = 'myResourceGroupNAT'
    Location = 'eastus2'
    Sku = 'Standard'
    AllocationMethod = 'Static'
$publicIP = New-AzPublicIpAddress @ip

## Create NAT gateway resource ##
$nat = @{
    ResourceGroupName = 'myResourceGroupNAT'
    Name = 'myNATgateway'
    IdleTimeoutInMinutes = '10'
    Sku = 'Standard'
    Location = 'eastus2'
    PublicIpAddress = $publicIP
$natGateway = New-AzNatGateway @nat

## Create subnet config and associate NAT gateway to subnet##
$subnet = @{
    Name = 'mySubnet'
    AddressPrefix = ''
    NatGateway = $natGateway
$subnetConfig = New-AzVirtualNetworkSubnetConfig @subnet 

## Create Azure Bastion subnet. ##
$bastsubnet = @{
    Name = 'AzureBastionSubnet' 
    AddressPrefix = ''
$bastsubnetConfig = New-AzVirtualNetworkSubnetConfig @bastsubnet

## Create the virtual network ##
$net = @{
    Name = 'myVNet'
    ResourceGroupName = 'myResourceGroupNAT'
    Location = 'eastus2'
    AddressPrefix = ''
    Subnet = $subnetConfig,$bastsubnetConfig
$vnet = New-AzVirtualNetwork @net

## Create public IP address for bastion host. ##
$ip = @{
    Name = 'myBastionIP'
    ResourceGroupName = 'myResourceGroupNAT'
    Location = 'eastus2'
    Sku = 'Standard'
    AllocationMethod = 'Static'
$publicip = New-AzPublicIpAddress @ip

## Create bastion host ##
$bastion = @{
    ResourceGroupName = 'myResourceGroupNAT'
    Name = 'myBastion'
    PublicIpAddress = $publicip
    VirtualNetwork = $vnet
New-AzBastion @bastion -AsJob

Virtual machine

In this section, you'll create a virtual machine to test the NAT gateway and verify the public IP address of the outbound connection.

# Set the administrator and password for the VMs. ##
$cred = Get-Credential

## Place the virtual network into a variable. ##
$vnet = Get-AzVirtualNetwork -Name 'myVNet' -ResourceGroupName 'myResourceGroupNAT'

## Create network interface for virtual machine. ##
$nic = @{
    Name = "myNicVM"
    ResourceGroupName = 'myResourceGroupNAT'
    Location = 'eastus2'
    Subnet = $vnet.Subnets[0]
$nicVM = New-AzNetworkInterface @nic

## Create a virtual machine configuration for VMs ##
$vmsz = @{
    VMName = "myVM"
    VMSize = 'Standard_DS1_v2'  
$vmos = @{
    ComputerName = "myVM"
    Credential = $cred
$vmimage = @{
    PublisherName = 'MicrosoftWindowsServer'
    Offer = 'WindowsServer'
    Skus = '2019-Datacenter'
    Version = 'latest'    
$vmConfig = New-AzVMConfig @vmsz `
    | Set-AzVMOperatingSystem @vmos -Windows `
    | Set-AzVMSourceImage @vmimage `
    | Add-AzVMNetworkInterface -Id $nicVM.Id

## Create the virtual machine for VMs ##
$vm = @{
    ResourceGroupName = 'myResourceGroupNAT'
    Location = 'eastus2'
    VM = $vmConfig
New-AzVM @vm

Wait for the virtual machine creation to complete before moving on to the next section.

Test NAT gateway

In this section, we'll test the NAT gateway. We'll first discover the public IP of the NAT gateway. We'll then connect to the test virtual machine and verify the outbound connection through the NAT gateway.

  1. Sign in to the Azure portal

  2. Find the public IP address for the NAT gateway on the Overview screen. Select All services in the left-hand menu, select All resources, and then select myPublicIP.

  3. Make note of the public IP address:

    Discover public IP address of NAT gateway

  4. Select All services in the left-hand menu, select All resources, and then from the resources list, select myVM that is located in the myResourceGroupNAT resource group.

  5. On the Overview page, select Connect, then Bastion.

  6. Select the blue Use Bastion button.

  7. Enter the username and password entered during VM creation.

  8. Open Internet Explorer on myTestVM.

  9. Enter https://whatsmyip.com in the address bar.

  10. Verify the IP address displayed matches the NAT gateway address you noted in the previous step:

    Internet Explorer showing external outbound IP

Clean up resources

If you're not going to continue to use this application, delete the virtual network, virtual machine, and NAT gateway with the following steps:

Remove-AzResourceGroup -Name 'myResourceGroupNAT' -Force

Next steps

For more information on Azure Virtual Network NAT, see: