LAB 53 ‐ Nat gateway testing - DevWithNehaCloud/Oracle-Cloud-Infrastructure-wiki GitHub Wiki

NAT Gateway in OCI

Overview

A NAT Gateway (Network Address Translation Gateway) allows instances in a Private Subnet to access the internet without assigning them a Public IP address.

It provides outbound-only internet connectivity, which means:

✅ Private instances can download packages, updates, patches, and access external APIs.

✅ Private instances remain inaccessible from the internet.

❌ Internet users cannot initiate connections to private instances.

This helps maintain security while still allowing internet access when required.

Why Do We Need a NAT Gateway?

By default, an instance in a private subnet has only a private IP address and cannot directly communicate with the internet.

Common use cases:

  • OS package updates (yum update, dnf update)
  • Software installation
  • Downloading application dependencies
  • Accessing GitHub repositories
  • Calling external APIs
  • Security patch downloads

A NAT Gateway solves this problem without exposing the server to the internet.

How NAT Gateway Works

When a private instance sends traffic to the internet:

  1. The request reaches the NAT Gateway through a Route Table.
  2. NAT Gateway replaces the instance's private IP with its own public IP.
  3. The request is sent to the internet.
  4. The response comes back to the NAT Gateway.
  5. NAT Gateway forwards the response to the original private instance.

The internet only sees the NAT Gateway's public IP, not the private instance.

Architecture Diagram

+-------------------+
| Private Instance  |
| 10.0.1.10         |
+---------+---------+
          |
          | Route: 0.0.0.0/0
          v
+-------------------+
|   NAT Gateway     |
| Public IP Assigned|
+---------+---------+
          |
          |
          v
+-------------------+
|     Internet      |
| GitHub, Oracle,   |
| Linux Repos, APIs |
+-------------------+

Key Features

  • Outbound internet access for private instances
  • No Public IP required on the instance
  • Blocks inbound internet connections
  • Highly available managed OCI service
  • Supports TCP, UDP, and ICMP traffic
  • Improves security by keeping servers private

Route Table Configuration

To use a NAT Gateway, add the following route rule in the Private Subnet Route Table:

Destination CIDR Target Type
0.0.0.0/0 NAT Gateway

This sends all internet-bound traffic through the NAT Gateway.

NAT Gateway vs Internet Gateway

NAT Gateway Internet Gateway
Used for Private Subnets Used for Public Subnets
No Public IP required on instance Public IP required
Outbound traffic only Inbound and Outbound traffic
More secure Publicly accessible

Real-Time Example

Suppose an application server is running in a private subnet and needs to install Apache:

sudo dnf install httpd -y

The server sends the request through the NAT Gateway, downloads the package from the internet, and receives the response.

At the same time, nobody from the internet can directly SSH or access that private server.

Conclusion

A NAT Gateway provides secure outbound internet access for private instances. It allows servers to download updates, software, and access external services while keeping them protected from direct internet exposure. This makes it a common and recommended solution for production environments in OCI.

STEPS

  1. login from bastion-jump-server to swiggy private server
mkdir keys

cd keys

vi privatekey.pem

paste the private key content and check

cat privatekey.pem

chmod 600 privatekey.pem

pwd

ssh -i /home/opc/keys/privatekey.pem [email protected]
  1. After logging into the Private Instance, test the current Internet connectivity.

its not working

  1. checked the route table
  1. checked the security list

5: Create the NAT Gateway

Now that we have verified the existing connectivity, Route Table, and Security List configuration, we can proceed with creating the NAT Gateway.

Now adding NAT Gateway in OCI Console

Open the OCI Console ➔ Navigate to Networking ➔ Virtual Cloud Networks (VCN).

In your spoke VCN, click on Gateways and verify whether a NAT Gateway already exists.

If it does not exist, click Create NAT Gateway, provide a name, and create it.

its created

  1. Now navigate to your Private Subnet and open its associated Route Table.

Click Add Route Rules and enter the following details:

Target Type: NAT Gateway Destination CIDR Block: 0.0.0.0/0 Target NAT Gateway: Select your NAT Gateway Click Add Route Rules.

  1. again verify the internet connectivity

It's working now

  1. Install a Package to Verify Outbound Connectivity
sudo dnf install -y telnet

installed successfully

installing nginx

sudo dnf install -y nginx

installed successfully

Route Selection in OCI (Longest Prefix Match)

How Does OCI Choose a Route?

When multiple route rules match the same destination, OCI uses the Longest Prefix Match (LPM) rule.

This means OCI always selects the route with the most specific CIDR block (the route with the largest subnet mask).

The more specific the route, the higher its priority.

Example

Consider the following route rules:

Destination CIDR Target
0.0.0.0/0 NAT Gateway
10.0.0.0/16 DRG
10.0.1.0/24 Service Gateway

Now suppose traffic is destined for:

10.0.1.50

This IP matches all three routes:

  • 0.0.0.0/0
  • 10.0.0.0/16
  • 10.0.1.0/24

OCI chooses:

10.0.1.0/24 → Service Gateway

because /24 is more specific than /16 and /0.

Another Example

Destination CIDR Target
0.0.0.0/0 NAT Gateway
192.168.0.0/16 DRG
192.168.1.0/24 LPG

Traffic Destination:

192.168.1.25

Matching Routes:

  • 0.0.0.0/0
  • 192.168.0.0/16
  • 192.168.1.0/24

Selected Route:

192.168.1.0/24 → LPG

because /24 is the longest prefix and therefore has the highest priority.

Interview Question

Q: If multiple route rules match a destination IP, how does OCI decide which route to use?

Answer:

OCI uses the Longest Prefix Match (LPM) algorithm. When multiple routes match a destination IP, OCI selects the route with the most specific CIDR block (largest subnet mask). For example, if routes for 0.0.0.0/0, 10.0.0.0/16, and 10.0.1.0/24 all match the destination 10.0.1.50, OCI chooses 10.0.1.0/24 because it is the most specific route.

Quick Interview Tip

Remember:

/32 > /28 > /24 > /16 > /8 > /0

The route with the longest prefix length wins.

This is called Longest Prefix Match (LPM).