NAT Gateway

A NAT (Network Address Translation) Gateway in Oracle Cloud Infrastructure (OCI) is a managed networking service that enables resources in a private subnet to initiate outbound connections to the public internet without requiring a public IP address.

The NAT Gateway translates the private IP address of the resource into a NAT public IP for outbound communication. It allows responses to return to the private resource while preventing unsolicited inbound connections from the internet.

Example

Private Compute Instance
       │
       │ Private IP
       ▼
Private Subnet
       │
       │ Route: 0.0.0.0/0
       ▼
NAT Gateway
       │
       ▼
    Internet

Key point: NAT Gateway is primarily used when a private resource needs outbound internet connectivity while remaining inaccessible directly from the public internet.

How NAT Gateway works in OCI

There are several components involved:

Private Subnet → Route Table → NAT Gateway → Internet Gateway → Internet

The important point is that the private subnet's route table sends internet-bound traffic to the NAT Gateway.

For example, the route table contains:

0.0.0.0/0 means all IPv4 destinations that aren't matched by a more specific route.

Traffic flow

Suppose your private VM wants to download an update:

Private VM
10.0.1.0
    │
    │ Request
    ▼
Private Subnet
    │
    ▼
Route Table
0.0.0.0/0 → NAT Gateway
    │
    ▼
NAT Gateway
    │
    ▼
Internet

The NAT Gateway translates the private source address when the traffic goes toward the internet.

The response comes back through the NAT Gateway, which maintains the connection mapping and forwards the response to the original private VM.

Why do we need NAT Gateway?

A private subnet normally doesn't have a direct route to the internet.

Private VM
     │
     │
     ▼
Private Subnet
     │
     X
   Internet

If we need that private VM to access the internet, we can use a NAT Gateway.

Private VM
     │
     ▼
Private Subnet
     │
     ▼
Route Table
     │
     ▼
NAT Gateway
     │
     ▼
Internet

This provides outbound internet connectivity while keeping the VM private.

🎯 Lab Objective

In this lab, we will configure an OCI NAT Gateway to provide controlled outbound internet connectivity to a private instance without assigning a public IP address.

The objective is to allow a private spoke server to:

• Install software

• Download security updates

• Retrieve required packages

—all while ensuring the instance remains inaccessible from the public internet.

let's try to install telnet software in our asus spoke app server

as we seen that software could't install due to non internet connectivity

🛠 Steps to Configure NAT Gateway

1. Create a NAT Gateway

Navigation Path:

Networking → Virtual Cloud Network (VCN) → asus_VCN → Gateways → NAT Gateways

During creation, always select Ephemeral Public IP Address.

This option provides a lifetime-bounded public IP address managed by Oracle.

2. Update Route Table

Add a route rule in the private subnet’s route table:

• Destination CIDR: 0.0.0.0/0

• Target: NAT Gateway

3. Validate Connectivity

Once the route rule is added, the private VM can initiate outbound connections.

For example, installing telnet software on the private spoke server will now succeed, as the NAT Gateway provides internet access.

❓ Question: How does OCI resolve conflicting routes?

✅ Answer:

Oracle Cloud Infrastructure (OCI) uses the Longest Prefix Match (LPM) technique to resolve conflicting routes.

When multiple route rules match the same destination, OCI selects the most specific route—the one with the longest prefix length.

📌 Example Route Table

10.0.0.0/25 → hub_drg
0.0.0.0/0   → nat_gw

• If the destination is 10.0.0.10, both routes technically match.

• However, 10.0.0.0/25 is more specific than 0.0.0.0/0, so OCI forwards the traffic through the DRG.

For internet traffic such as 8.8.8.8:

• The specific 10.0.0.0/25 route does not match.

• OCI uses the default route:

8.8.8.8 → 0.0.0.0/0 → NAT Gateway

🔑 Key Principle

More specific route wins.

Prefix length determines specificity:

/25  >  /16  >  /8  >  /0

📊 Summary

• OCI evaluates all matching routes.

• The route with the longest prefix (most specific match) is selected.

• This ensures precise routing for private networks while still allowing default routes for general internet traffic.