Enabling NAT Functions

You can enable NAT function during or after a gateway is launched. NAT function enables instances on private subnets in AWS, Azure, GCP, or OCI to access the Internet. When NAT is enabled, all route tables for private subnets in the VPC/VNet are programmed with a route entry that points the gateway as the target for route entry 0.0.0.0/0.

Source NAT

Three modes of Source NAT are supported:

Single IP

When Single IP is selected, the gateway’s primary IP address is used as source address for Source NAT function. This is the simplest and default mode when you enable NAT at gateway launch time.

Multiple IPs

When Multiple IPs is selected, the gateway translates the source address to the pool of the multiple IPs in a round-robin fashion. The multiple IPs are the secondary IP addresses of the gateway that you need to set up first (see Edit Secondary IPs (for AWS)).

Customized SNAT

When Customized SNAT is selected, the gateway can translate source IP address ranges to different SNAT address and ports, as shown below.

NAT rules are not synchronized from the primary gateway to the HA gateway instances. You must configure NAT rules on the primary and HA gateway instances separately.

Field	Value
SRC CIDR	This is a qualifier condition that specifies a source IP address range where the rule applies. When left blank, this field is not used.
SRC PORT	This is a qualifier condition that specifies a source port that the rule applies. When left blank, this field is not used.
DST CIDR	This is a qualifier condition that specifies a destination IP address range where the rule applies. When left blank, this field is not used and a default route 0.0.0.0/0 pointing to Aviatrix Gateway will be programmed into Cloud platform routing table.
DST PORT	This is a qualifier condition that specifies a destination port where the rule applies. When left blank, this field is not used.
PROTOCOL	This is a qualifier condition that specifies a destination port protocol where the rule applies. When left blank, this field is not used.
INTERFACE	This is a qualifier condition that specifies output interface where the rule applies. When left blank, this field is not used.
CONNECTION	This is a qualifier condition that specifies output connection where the rule applies. When left blank, this field is not used.
MARK	This is a qualifier condition that specifies a tag or mark of a TCP session where the rule applies. When left blank, this field is not used.
SNAT IPS	This is a rule field that specifies the changed source IP address when all specified qualifier conditions meet. When left blank, this field is not used. One of the rule fields must be specified for this rule to take effect. Multiple translated source IP addresses are supported, they are specified as a range, for example, 100.100.1.5 - 100.100.1.10
SNAT PORT	This is a rule field that specifies the changed source port when all specified qualifier conditions meet. When left blank, this field is not used. One of the rule fields must be specified for this rule to take effect.
APPLY ROUTE ENTRY	This is an option to program the route entry "DST CIDR pointing to Aviatrix Gateway" into Cloud platform routing table.
EXCLUDE ROUTE TABLE	This field specifies which VPC private route table will not be programmed with the default route entry. Users can combine this with APPLY ROUTE ENTRY enabled.

Field

Value

SRC CIDR

This is a qualifier condition that specifies a source IP address range where the rule applies. When left blank, this field is not used.

SRC PORT

This is a qualifier condition that specifies a source port that the rule applies. When left blank, this field is not used.

DST CIDR

This is a qualifier condition that specifies a destination IP address range where the rule applies. When left blank, this field is not used and a default route 0.0.0.0/0 pointing to Aviatrix Gateway will be programmed into Cloud platform routing table.

DST PORT

This is a qualifier condition that specifies a destination port where the rule applies. When left blank, this field is not used.

PROTOCOL

This is a qualifier condition that specifies a destination port protocol where the rule applies. When left blank, this field is not used.

INTERFACE

This is a qualifier condition that specifies output interface where the rule applies. When left blank, this field is not used.

CONNECTION

This is a qualifier condition that specifies output connection where the rule applies. When left blank, this field is not used.

MARK

This is a qualifier condition that specifies a tag or mark of a TCP session where the rule applies. When left blank, this field is not used.

SNAT IPS

This is a rule field that specifies the changed source IP address when all specified qualifier conditions meet. When left blank, this field is not used. One of the rule fields must be specified for this rule to take effect. Multiple translated source IP addresses are supported, they are specified as a range, for example, 100.100.1.5 - 100.100.1.10

SNAT PORT

This is a rule field that specifies the changed source port when all specified qualifier conditions meet. When left blank, this field is not used. One of the rule fields must be specified for this rule to take effect.

APPLY ROUTE ENTRY

This is an option to program the route entry "DST CIDR pointing to Aviatrix Gateway" into Cloud platform routing table.

EXCLUDE ROUTE TABLE

This field specifies which VPC private route table will not be programmed with the default route entry. Users can combine this with APPLY ROUTE ENTRY enabled.

Destination NAT

Destination NAT (DNAT) allows you to change the destination to a virtual address range.

There are multiple optional parameters you can configure to meet your requirement.

NAT rules are not synchronized from the primary gateway to the HA gateway instances. You must configure NAT rules on the primary and HA gateway instances separately.

Field	Value
SRC CIDR	This is a qualifier condition that specifies a source IP address range where the rule applies. When left blank, this field is not used.
SRC PORT	This is a qualifier condition that specifies a source port that the rule applies. When left blank, this field is not used.
DST CIDR	This is a qualifier condition that specifies a destination IP address range where the rule applies. When left blank, this field is not used and a default route 0.0.0.0/0 pointing to Aviatrix Gateway will be programmed into Cloud platform routing table.
DST PORT	This is a qualifier condition that specifies a destination port where the rule applies. When left blank, this field is not used.
PROTOCOL	This is a qualifier condition that specifies a destination port protocol where the rule applies. When left blank, this field is not used.
INTERFACE	This is a qualifier condition that specifies output interface where the rule applies. When left blank, this field is not used.
CONNECTION	This is a qualifier condition that specifies output connection where the rule applies. When left blank, this field is not used.
MARK	This is a rule field that specifies a tag or mark of a TCP session when all qualifier conditions meet. When left blank, this field is not used.
DNAT IPS	This is a rule field that specifies the translated destination IP address when all specified qualifier conditions meet. When left blank, this field is not used. One of the rule field must be specified for this rule to take effect. Multiple translated source IP addresses are supported, they are specified as a range, for example, 100.101.2.5 - 100.101.2.10
DNAT PORT	This is a rule field that specifies the translated destination port when all specified qualifier conditions meet. When left blank, this field is not used. One of the rule field must be specified for this rule to take effect.
APPLY ROUTE ENTRY	This is an option to program the route entry "DST CIDR pointing to Aviatrix Gateway" into Cloud platform routing table.
EXCLUDE ROUTE TABLE	This field specifies which VPC private route table will not be programmed with the default route entry. Users can combine this with APPLY ROUTE ENTRY enabled.

Field

Value

SRC CIDR

This is a qualifier condition that specifies a source IP address range where the rule applies. When left blank, this field is not used.

SRC PORT

This is a qualifier condition that specifies a source port that the rule applies. When left blank, this field is not used.

DST CIDR

DST PORT

This is a qualifier condition that specifies a destination port where the rule applies. When left blank, this field is not used.

PROTOCOL

This is a qualifier condition that specifies a destination port protocol where the rule applies. When left blank, this field is not used.

INTERFACE

This is a qualifier condition that specifies output interface where the rule applies. When left blank, this field is not used.

CONNECTION

This is a qualifier condition that specifies output connection where the rule applies. When left blank, this field is not used.

MARK

This is a rule field that specifies a tag or mark of a TCP session when all qualifier conditions meet. When left blank, this field is not used.

DNAT IPS

This is a rule field that specifies the translated destination IP address when all specified qualifier conditions meet. When left blank, this field is not used. One of the rule field must be specified for this rule to take effect. Multiple translated source IP addresses are supported, they are specified as a range, for example, 100.101.2.5 - 100.101.2.10

DNAT PORT

This is a rule field that specifies the translated destination port when all specified qualifier conditions meet. When left blank, this field is not used. One of the rule field must be specified for this rule to take effect.

APPLY ROUTE ENTRY

This is an option to program the route entry "DST CIDR pointing to Aviatrix Gateway" into Cloud platform routing table.

EXCLUDE ROUTE TABLE

This field specifies which VPC private route table will not be programmed with the default route entry. Users can combine this with APPLY ROUTE ENTRY enabled.