NAT gateways
Updated
A Wolkra NAT gateway gives servers on a private network outbound internet access while they keep no public IP address of their own. Private servers can fetch updates and call external APIs, and nobody on the internet can open a connection to them.
The problem a NAT gateway solves
Putting databases, workers and internal services on a private network with no public address is a strong security choice. But those servers still need the internet now and then: package updates, container images, time sync, payment and email APIs, webhooks to other services.
Without a gateway, the usual workaround is to give each server a public IP "just for updates", which brings back the exposure you wanted to avoid. A NAT gateway removes that trade-off.
How it works
The NAT gateway sits on the edge of your private network with one public address. When a private server opens a connection to the internet, the gateway translates the private source address to its public one and keeps track of the connection, so replies find their way back. Connections that start on the internet have no matching entry and are not forwarded.
In short:
- Outbound: allowed, for every server on the network that routes through the gateway
- Replies: allowed, because the gateway tracks each connection
- Unsolicited inbound: not forwarded
All outbound traffic from your private servers appears to come from the gateway's public address. That is useful when an external service asks you to allow-list a single address.
Setting it up in the console
- Create a private network with your own IP range, or open an existing one.
- Choose Add NAT gateway on the network.
- Create servers on the network with public IPv4 and IPv6 turned off.
- The servers reach the internet through the gateway. Test it with a package update.
The private networks doc includes a full example with an app server, a database and a NAT gateway.
Using the API
NAT gateways can be created, listed and deleted through the Wolkra API with a project-scoped token. Teams that create a fresh environment per branch or per customer usually script the network, the gateway and the servers together. In Composer you can place a NAT gateway on the canvas and see what it adds to the monthly cost before you apply.
NAT gateway, Elastic IP or load balancer?
These three often appear together. Each handles a different direction of traffic.
| Need | Use |
|---|---|
| Private servers must reach the internet | NAT gateway |
| One private server must be reachable on its own public IP | Elastic IP |
| Several private servers must share incoming web traffic | Load balancer |
A common production layout uses a load balancer for incoming traffic and a NAT gateway for outgoing traffic, with every app and database server private.
Typical uses
- App servers and workers in a SaaS backend that only call out
- Databases that need updates but must never be public
- CI runners that pull code and images but accept no connections
- Automation workers that call external APIs from one known address
Security notes
A NAT gateway is not a full security policy on its own. Combine it with:
- Firewalls with outbound rules, if private servers should only reach a few known services
- No public IPs on servers that do not need them, so nothing can bypass the design
- A VPN or bastion for admin access, see WireGuard VPN server
Pricing basis
A NAT gateway is billed by the hour from your prepaid balance and capped at its monthly price, like every Wolkra resource. Traffic through it is unmetered, with no per-GB processing fees. See the pricing page for the current price.
Limits to know
- A NAT gateway handles outbound connections only.
- It serves servers on the private network it is attached to, in the same location. Today that is Frankfurt.
- Fair use applies to all traffic, as described in the Acceptable Use Policy.
Related products
- Private networks
- IP addresses and Elastic IPs
- Load balancers
- Firewalls for rules on top of NAT
- Network for bandwidth and IPv6
Keep servers private and connected
Run your backend without public addresses and still keep it up to date. Sign up for Wolkra and add a NAT gateway to your network in Frankfurt.
Frequently asked questions
What does a NAT gateway do?
It lets servers on a private network reach the internet without having public addresses themselves. Outbound connections go through the gateway, and unsolicited inbound connections are not forwarded.
When do I need a NAT gateway?
You need one when servers have no public IP but still have to install updates, pull container images, send email through an API or call external services.
Can a NAT gateway make a private server reachable from outside?
No, a NAT gateway is for outbound traffic. To accept inbound traffic, put a load balancer in front of the server or assign an Elastic IP.
Is traffic through a NAT gateway metered?
No. Traffic on Wolkra is unmetered with no per-GB fees, including traffic that passes through a NAT gateway. A fair-use policy applies.
How do I add a NAT gateway?
Create a private network, then add a NAT gateway to it in the console or through the API. Servers on that network can use it for outbound access.