Azure NAT Gateway on Microsoft Azure
What is Azure NAT Gateway?
Azure NAT Gateway is a fully managed network address translation (NAT) service that lets resources in a subnet connect outbound to the internet securely, without requiring a public IP address of their own. Unsolicited inbound connections from the internet are always blocked; only response packets to previously initiated outbound connections are allowed through.
The service is available in two SKUs: Standard (zonal, limited to a single availability zone, up to 50 Gbps throughput) and StandardV2 (zone-redundant across multiple availability zones, up to 100 Gbps throughput, plus IPv6 support and flow log support). Microsoft recommends StandardV2 for highly available architectures.
For organizations with GDPR requirements, Azure NAT Gateway is available in European Azure regions and meets the applicable compliance standards.
Core Features
- Two SKUs: Standard (zonal) and StandardV2 (zone-redundant, higher throughput, IPv6 support)
- Dynamic SNAT port allocation: Each associated public IP address provides 64,512 SNAT ports; a NAT gateway can scale to more than 1 million SNAT ports
- Up to 16 public IP addresses (StandardV2 additionally up to 16 IPv6 addresses) per NAT gateway, or alternatively IP prefixes
- No routing configuration required: Once attached to a subnet, the gateway automatically becomes the default route to the internet
- High scalability: Up to 2 million concurrent connections per gateway
- Takes precedence over other outbound methods: NAT Gateway has priority over load balancer outbound rules, instance-level public IPs, and Azure Firewall
Typical Use Cases
Private VMs with internet access: Virtual machines without public IP addresses can securely access the internet while inbound connections remain blocked.
Static outbound IPs for whitelisting: External APIs or partner systems requiring IP whitelisting can be reached via fixed NAT gateway IPs.
Microservices architectures: Containers and App Service instances in private subnets gain reliable internet access for external dependencies via VNet integration.
Batch workloads: Large data processing jobs can access external services in parallel without risking SNAT port exhaustion, since NAT Gateway allocates SNAT ports dynamically.
Benefits
Azure NAT Gateway significantly simplifies network architecture: no health probes, backend pools, or complex routing rules are required. As a distributed service spanning multiple fault domains, it is highly resilient, and it substantially reduces the risk of SNAT port exhaustion compared to default outbound access or load balancer rules.
Frequently Asked Questions about Azure NAT Gateway
What differentiates NAT Gateway from other outbound solutions?
NAT Gateway offers significantly higher SNAT port allowances (64,512 ports per IP) compared to load balancer outbound rules or individual public IPs, simpler management, and optional zone redundancy via the StandardV2 SKU. The service is specifically optimized for outbound scenarios and requires no configuration of health probes or backend pools.
What is the difference between Standard and StandardV2?
The Standard SKU is zonal (a single availability zone) and supports only IPv4. StandardV2 is zone-redundant, offers up to 100 Gbps throughput, IPv6 support, and flow logs. An existing Standard NAT gateway cannot be upgraded to StandardV2; it must be recreated.
How is Azure NAT Gateway billed?
Costs consist of an hourly base charge per NAT gateway plus a fee per GB of processed data. According to Microsoft, Standard and StandardV2 are priced the same. Current prices are available on the official Azure NAT Gateway pricing page.
Can I combine NAT Gateway with Azure Firewall?
Yes, NAT Gateway and Azure Firewall can be used together, for example by associating the NAT gateway with an Azure Firewall subnet in a hub VNet to provide outbound connectivity for peered spoke VNets.
How many public IP addresses can a NAT Gateway use?
A NAT gateway supports up to 16 public IPv4 addresses; StandardV2 additionally supports up to 16 IPv6 addresses. These can be configured as individual IPs or as an IP prefix. Each IP provides 64,512 SNAT ports.
Can NAT Gateway be used with multiple subnets?
Yes, a NAT gateway can be assigned to multiple subnets within the same virtual network. However, only one NAT gateway can be attached to any single subnet at a time.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you in implementing and optimizing Azure NAT Gateway. We help with network architecture, cost optimization, and migration from existing outbound solutions.
Contact us for a non-binding consultation on Azure NAT Gateway and network architectures.
Typical Use Cases
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
