What is a NAT gateway? Outbound internet for private subnets
A NAT (Network Address Translation) gateway lets resources in a private subnet reach the internet for outbound connections — like downloading updates — while preventing the internet from initiating inbound connections to them. It solves a very ordinary problem: a database server has no business being reachable from the public internet, but it still occasionally needs to fetch a software patch or call an external API. A NAT gateway is the one-way door that makes both things true at once. This article covers the problem it solves, how the translation works conceptually, the common confusion with an internet gateway, the typical architecture it sits in, and its equivalents across the major clouds.
The problem it solves
A well-designed network, as covered in the what-is-a-virtual-private-cloud explainer, places sensitive resources — databases, internal application servers — in private subnets that have no route to the internet, so nothing outside the network can reach them directly. That is good for security, but it creates a genuine operational need: those same servers still have to fetch operating-system updates, download dependencies, or call an external service occasionally, and all of that traffic is outbound to the internet.
Simply opening the private subnet to the internet would defeat the point of making it private in the first place. What is needed is a mechanism that allows traffic to leave, and allows the replies to that traffic to come back, without ever allowing a connection to be initiated from outside. That is exactly what a NAT gateway provides.
How NAT works, conceptually
Resources inside a subnet — see the what-is-a-subnet explainer for what a subnet actually is — are assigned private addresses that are not directly routable on the public internet. When one of them needs to reach an external site, the NAT gateway translates that private address to a single public address it controls, sends the request onward, and remembers which internal resource made it. When the reply comes back addressed to that public address, the NAT gateway translates it back and delivers it to the correct internal resource.
The point to hold onto, without getting into IP address mechanics, is the direction of the door: connections can only be initiated from inside, out. Nothing on the internet can start a new connection to a private resource through a NAT gateway, because the gateway only ever forwards replies to conversations that began on the inside.
NAT gateway versus internet gateway
This is one of the most common points of confusion for newcomers to cloud networking, and it is worth stating plainly. An internet gateway enables two-way public connectivity — it is what makes a public subnet public, allowing resources with public addresses to be reached from the internet and to reach out to it. A NAT gateway is outbound-only — it allows a private subnet’s resources to initiate connections to the internet, but never the reverse.
A useful shorthand: an internet gateway is a door that opens both ways; a NAT gateway is a door that opens only from the inside. Public subnets typically route through an internet gateway; private subnets that need outbound access route through a NAT gateway instead.
The typical architecture
This pairing shows up in almost every cloud network design. Web servers that must accept inbound traffic from users sit in public subnets, reachable via an internet gateway. Databases and internal application servers sit in private subnets, with no inbound path from the internet at all — but they still route their outbound traffic, such as fetching updates, through a NAT gateway in a public subnet. The web tier faces the world; the private tier faces only the web tier, plus a one-way door out for maintenance traffic. It is a pattern general enough to appear constantly in real architectures and in exam scenario questions alike.
Cloud equivalents
The concept is consistent across providers, with each offering a managed NAT service so nobody has to run and patch their own NAT software: AWS provides the NAT Gateway, Azure provides Azure NAT Gateway, and Google Cloud provides Cloud NAT. All three do the same conceptual job — translating outbound traffic from private resources to a shared public address — as a managed service rather than infrastructure you build yourself.
Where it appears in networking cert study
NAT gateways are a staple of associate-level networking questions. The AWS Solutions Architect Associate exam regularly tests the public-subnet-plus-internet-gateway versus private-subnet-plus-NAT-gateway pattern in architecture scenarios, and the CloudOps Engineer Associate exam approaches the same setup from a troubleshooting angle — diagnosing why a private resource cannot reach the internet. The Azure Administrator Associate exam covers the equivalent Azure NAT Gateway concept within its networking domain. Foundational exams generally expect only that private resources need a separate, outbound-only path to the internet, without the implementation detail.
Original practice questions, timed mock exams and revision notes. No card, nothing to pay.