Azure NAT Gateway: Managed Outbound Connectivity

The outbound connectivity problem

In Azure, there are several ways a private VM can reach the internet:

Default outbound (deprecated): Azure used to provide implicit outbound connectivity to VMs without a public IP. This is being retired and should not be relied on for new deployments.

Instance-level public IP: Give each VM its own public IP. Simple, but expensive, and every VM’s IP appears in outbound traffic — making it hard to manage allowlists at external services.

Load balancer outbound rules: Configure outbound NAT through a Standard load balancer. Works, but limited SNAT ports and requires a load balancer to exist for the purpose.

NAT Gateway: A dedicated managed service for outbound connectivity. Predictable source IPs, massive SNAT port scale, zero configuration on VMs, and fully managed by Azure. This is the right answer for most workloads.

Understanding SNAT port exhaustion

When a VM without a public IP makes an outbound internet connection, Azure translates the VM’s private IP to a public IP. This is Source NAT (SNAT). To track multiple concurrent connections from different VMs using the same public IP, Azure uses port numbers. Each connection uses one SNAT port on the public IP.

A single public IP has 64,000 usable ports. If 100 VMs share one public IP and each opens 640 connections simultaneously, the ports are exhausted. New outbound connections fail with timeout errors. Applications see this as slow or failed external API calls, package download failures, or telemetry loss.

NAT Gateway solves this by providing 64,512 ports per associated public IP, and you can attach up to 16 public IPs — giving you over a million SNAT ports. NAT Gateway also manages port allocation efficiently and recycles idle ports faster than the default SNAT behavior.

Creating a NAT Gateway with the CLI

Create a NAT Gateway and associate it with a subnet:

# Create static public IPs for the NAT Gateway (start with one, add more if needed)
az network public-ip create \
  --name pip-nat-eastus-001 \
  --resource-group rg-prod-networking \
  --location eastus \
  --sku Standard \
  --allocation-method Static \
  --zone 1 2 3

# Create the NAT Gateway
az network nat gateway create \
  --name natgw-prod-eastus \
  --resource-group rg-prod-networking \
  --location eastus \
  --public-ip-addresses pip-nat-eastus-001 \
  --idle-timeout 4

Associate the NAT Gateway with a subnet. All outbound traffic from this subnet will use the NAT Gateway:

az network vnet subnet update \
  --name snet-app \
  --resource-group rg-prod-networking \
  --vnet-name vnet-prod-eastus-001 \
  --nat-gateway natgw-prod-eastus

Add a second public IP to increase SNAT port capacity:

az network public-ip create \
  --name pip-nat-eastus-002 \
  --resource-group rg-prod-networking \
  --location eastus \
  --sku Standard \
  --allocation-method Static \
  --zone 1 2 3

az network nat gateway update \
  --name natgw-prod-eastus \
  --resource-group rg-prod-networking \
  --public-ip-addresses pip-nat-eastus-001 pip-nat-eastus-002

List all NAT Gateways and their associated subnets:

az network nat gateway list \
  --resource-group rg-prod-networking \
  --output table

Show details including associated public IPs and subnets:

az network nat gateway show \
  --name natgw-prod-eastus \
  --resource-group rg-prod-networking

NAT Gateway vs alternatives

NAT Gateway is the right default for most workloads. Use Azure Firewall when you also need outbound traffic inspection and filtering. Use instance public IPs only for VMs that genuinely need inbound connections from the internet.

Monitoring SNAT utilization

Azure Monitor provides metrics for NAT Gateway. The most important one is SNAT Connection Count — if this approaches the total available ports, add another public IP before connections start failing:

# View NAT Gateway metrics (requires az monitor extension)
az monitor metrics list \
  --resource /subscriptions/<sub-id>/resourceGroups/rg-prod-networking/providers/Microsoft.Network/natGateways/natgw-prod-eastus \
  --metric SNATConnectionCount \
  --interval PT1M \
  --output table