Skip to content

Internet gateways

An Internet gateway lets instances on a project's routed networks reach the Internet. Their traffic goes out through one shared public address (NAT) that the location assigns. Nothing on the Internet can reach your instances through it: for that, give an instance a public IP, which also needs the gateway.

A project has at most one Internet gateway. It serves every network attached to private routing; isolated networks never use it.

How traffic reaches your instances and the Internet In one location, the project's private routing joins its networks. An Internet gateway lets instances reach the Internet through a shared outbound address. A public IP brings traffic from the Internet to one instance, here web-1 on the network app. web-2 has no public IP: it can reach out through the gateway but cannot be reached from the Internet. Internet Internet gateway outbound via 198.51.100.2 Public IP 203.0.113.21 → web-1 Private routing joins your networks Network · app 10.0.0.0/24 web-1 10.0.0.11 web-2 10.0.0.12 out in
The gateway takes traffic out for every instance on a routed network; only an instance with a public IP, here web-1, can be reached from the Internet.

Find it under Networking → Internet gateways.

Internet gateways: Karachi's gateway with its outbound address and the networks behind it
Internet gateways: Karachi's gateway with its outbound address and the networks behind it

Create an Internet gateway

  1. Choose Create Internet gateway. For owners, admins and the billing role, the dialog says the price per hour and per month.
  2. Confirm with Create Internet gateway. The outbound address shows once it is ready.

You can also create it with the project: Create an Internet gateway (outbound NAT).

{placement_id} is the project's ID in its location: placements[0].id in GET /v1/orgs/$ORG/projects/$PROJECT.

curl -sS -X POST "$NUBESTACK_API/v1/orgs/$ORG/projects/$PROJECT/placements/plc_01jbkhi/internet-gateway" \
  -H "Authorization: Bearer $NUBESTACK_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'

A gateway made or changed with the location's own tools and shown with outbound NAT off offers Manage → Enable outbound NAT.

Delete an Internet gateway

  1. Detach every public IP of the project from its instance or load balancer.
  2. Choose Manage → Delete gateway and confirm.
curl -sS -X DELETE "$NUBESTACK_API/v1/orgs/$ORG/projects/$PROJECT/placements/plc_01jbkhi/internet-gateway" \
  -H "Authorization: Bearer $NUBESTACK_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Outbound access stops and the outbound address is released. Private routing, routes, networks and instances stay.

What blocks a delete

Refusal Why Resolve
public_ips_in_use A public IP of the project is still attached; the message lists them Detach them first, under Public IPs

Limits and good practice

  • A gateway counts as Internet gateway hours in your usage for as long as it exists, whether or not anything uses it.
  • The outbound address can change if you delete the gateway and create a new one. Do not ask others to allow-list it unless you keep the gateway.
  • IPv4 only. Port forwarding from the outbound address to an instance is not offered; give the instance a public IP or put a load balancer in front of it.
  • To keep an instance off the Internet on a network that has a gateway, use a security group without outbound rules to public addresses (the Private only template).