FAQ

Instance configuration

SNAT configuration

DNAT configuration

EIP configuration

Cannot access the internet through SNAT

• Check the default route configuration that points to the NAT gateway:

  On the instance details page of the Internet NAT Gateway, view the VPC routes that point to the NAT gateway. Confirm that a route entry that points to the Internet NAT Gateway exists. If no such route entry exists, you must add a route entry to the relevant route table with a destination CIDR block of 0.0.0.0/0 and the Internet NAT Gateway as the next hop.

• Verify the SNAT rule configuration:

  • On the SNAT tab of the Internet NAT Gateway instance details page, confirm that the status of the SNAT entry is Available.

  • Confirm that the source address used for internet access is within the source CIDR block.

• Troubleshoot non-NAT issues:

  • Cross-border access: The access link is unstable.

  • Domain name access: Check whether the domain name is filed and resolved as expected.

  • Access control: Check whether access control policies are configured on the peer, or whether the EIP associated with the instance is added to a whitelist.

• Check the IPv4 gateway configuration: When used with an IPv4 gateway, make sure that the NAT Gateway is in NAT mode and the routes are correctly configured.

SNAT access issues for new ECS instances

This issue occurs if an ECS instance in a newly created vSwitch cannot access the internet through SNAT, but ECS instances in other vSwitches can.

• Confirm that the SNAT entry includes the CIDR block of the new vSwitch:

  NAT Gateway does not automatically create an SNAT entry for a new vSwitch. On the SNAT tab of the instance details page, check whether the source CIDR block of an existing SNAT entry includes the CIDR block of the new vSwitch. If not, you must manually create an SNAT entry.

• If the new vSwitch is associated with a custom route table, confirm that a route entry is configured with a destination CIDR block of 0.0.0.0/0 and a next hop that points to the NAT Gateway. You can manually add the route entry.

Internet access issues with multiple NAT Gateways

This issue occurs if the VPC uses only the system route table and has only one route entry with a destination CIDR block of 0.0.0.0/0 that points to one of the NAT Gateways. If the source CIDR block of the SNAT entry of that NAT Gateway does not include the CIDR block of a specific vSwitch, ECS instances in that vSwitch cannot access the internet.

• If you do not need to use multiple NAT Gateways, we recommend that you delete the unnecessary ones. Then, add an SNAT entry that covers the CIDR block of the vSwitch to the remaining NAT Gateway.

• If you need to use multiple NAT Gateways, see Deploy a highly available Internet NAT Gateway in a single zone.

Failed SNAT access to an FTP server

Possible causes:

• Active FTP mode: A NAT Gateway with an SNAT entry supports only active outbound connections. In active FTP mode, the data connection fails to be established because SNAT does not support active inbound connections. You must use passive FTP mode to connect to the FTP server.

• If an SNAT entry uses multiple EIPs, the FTP control and data connections may use different EIPs after NAT, causing the connection to fail. You must enable EIP affinity for the SNAT rule to ensure that connections from the same client always use the same EIP. You can also create a separate SNAT rule with a single EIP for the FTP client.

Cannot access services via DNAT

• Check the default route configuration that points to the NAT gateway:

  The instance specified in a DNAT entry also requires a route to the NAT Gateway to send response packets. Confirm that the system route table or a custom route table has a route entry with a destination CIDR block of 0.0.0.0/0 that points to the NAT Gateway. You can manually add the route entry.

• Verify the DNAT rule configuration:

  • On the DNAT tab of the Internet NAT Gateway instance details page, confirm that the status of the DNAT entry is Available.

  • Confirm that the port, protocol, destination address, and other parameters are correctly configured in the DNAT rule.

• Check security group rules, firewall settings, and the service port status:

  • From another ECS instance in the same VPC, run the telnet <private IP address of the ECS instance> <private port> command to check if the private port on the ECS instance specified in the DNAT entry is accessible.

    • If the response is unable connect to remote host: Connection timed out, the private port cannot be accessed from within the private network, and therefore cannot be accessed from the internet.

    • If the response is Connected to <private IP address of the ECS instance>, the private port can be accessed.

  • If the private port can be accessed, confirm that the security group rules of the ECS instance allow internet access to the corresponding port and that the firewall has the port open.

• Troubleshoot domain name resolution issues: If the service is inaccessible via the domain name but accessible via the EIP, check the domain name resolution settings and filing status.

• Check the IPv4 gateway configuration: When used with an IPv4 gateway, make sure that the NAT Gateway is in NAT mode and the routes are correctly configured.

• Verify network interface consistency: If the ECS instance has multiple network interfaces, check whether inbound and outbound traffic use the same interface. For more information, see Centralize the public egress.

Use an IPv4 gateway with an Internet NAT gateway

Deploy the Internet NAT gateway in a public vSwitch. To give ECS instances in a private vSwitch Internet access, configure a route pointing to the Internet NAT gateway. Their Internet-bound traffic then flows to the NAT gateway, which uses its attached public IP address to reach the Internet.

Before combining the two gateways, check the EipBindMode setting of your Internet NAT gateway:

• An Internet NAT gateway created in the console uses NAT mode by default. When calling CreateNatGateway, set EipBindMode to NAT. To change the mode after creation, call ModifyNatGatewayAttribute.

• If your NAT gateway uses MULTI_BINDED mode (multi-EIP-to-ENI mode), you cannot create an IPv4 gateway—the two are incompatible.

• If an IPv4 gateway already exists and you create an Internet NAT gateway with EipBindMode=MULTI_BINDED, you cannot attach EIPs to that NAT gateway.

Configure routes for private vSwitch resources before activating the IPv4 gateway to make sure they retain Internet access after activation.

Impacts of switching to NAT mode

After the switch, the Internet NAT Gateway can be used with an IPv4 gateway. When both SNAT and DNAT entries are configured on the Internet NAT Gateway, an instance can use the SNAT capability to access a DNAT service on the same gateway.

• Billing impact: The switch is free of charge and does not incur additional fees.

• Business impact: During the switch, network connections may experience brief interruptions. The duration of these interruptions increases with the number of associated EIPs.

• Configuration impact:

  • The public egress IP address and existing configurations are not affected.

  • Each associated EIP consumes one private IP address from the vSwitch of the NAT Gateway. Make sure that the vSwitch has sufficient private IP addresses.

  • After the switch, you cannot disable the IPv4 gateway compatibility mode.

Connection timeouts or slow downloads

• Monitor traffic data

  • View monitoring data for the EIPs associated with the NAT Gateway and check for packet loss due to bandwidth limits. If packet loss occurs, we recommend that you upgrade the EIP bandwidth.

  • If you have many ECS instances and it is difficult to identify unusual traffic on a specific instance, use NAT Gateway traffic monitoring to identify the source of the unusual traffic.

• Optimize the Linux kernel

  • Cause: If multiple Linux-based ECS instances concurrently access a Linux server through a NAT Gateway, TCP connection requests may be dropped by the Linux kernel. This can cause connection timeouts or failures. For more information, see Analysis of main scenarios where the Linux kernel protocol stack drops SYN packets.

  • Solution: We recommend that you disable the Linux net.ipv4.tcp_tw_recycle option on the server or disable the Linux net.ipv4.tcp_timestamps option on the client.

"Port Allocation Failures" metric

Meaning: This is the number of connections dropped because the allocation of a TCP or UDP port failed due to an excessively high number of concurrent connections when accessing a destination through the NAT Gateway.

Cause: A single EIP or NAT IP provides a limited number of ports for SNAT. If too many sessions access the same destination and the SNAT rule is configured with too few EIPs or NAT IPs, port allocation fails.

Solution: If the number of port allocation failures continues to increase, add more EIPs or NAT IPs to the SNAT rule.

Changing the billing method of a NAT Gateway

• Supported billing methods: Only pay-as-you-go is supported.

• Discontinued billing methods for new purchases: subscription and pay-by-specification.

• Convert existing instances:

  • Existing subscription and pay-by-specification NAT Gateway instances can be converted to pay-as-you-go.

  • You cannot revert from pay-as-you-go to pay-by-specification. Proceed with caution.

Sudden increase in NAT Gateway costs

NAT Gateway is a pay-as-you-go product. An increase in costs usually means that the NAT Gateway is processing more traffic. You can investigate this in the following ways:

• Check monitoring data: In CloudMonitor, view metrics such as inbound/outbound traffic and the number of connections for the NAT Gateway instance to identify traffic peaks.

• Check billing details: Use Expenses and Costs to view hourly billing details for the NAT Gateway and pinpoint the time when the costs increased.

• Enable traffic logs: Enable session logs and flow logs for the NAT Gateway and deliver the logs to Log Service for analysis to pinpoint the traffic source.

Refunding a NAT Gateway resource plan

NAT Gateway resource plans support five-day unconditional refunds and pro-rated refunds. For more information, see Refund rules.

Billing after NAT Gateway deletion

If you receive bills after deleting a NAT Gateway instance, it is likely due to the billing system's billing delay mechanism. These bills cover the usage incurred before the instance was deleted. You can check the billing details to confirm the usage period.

NAT Gateway creation quota

An Alibaba Cloud account can create an unlimited number of NAT Gateways.