NAT Gateway | Internet Gateway | DNAT Gateway

 Internet Gateway:

        By default, all resources/virtual machines will have an internet access because the default routes have a path to internet as below.

 This is the not best practice as we are exposing the azure resource IP to the internet which is a security concern. To access the internet but without exposing the private IP of a resource can be done using NAT gateway(SNAT) or DNAT.

 

NAT Gateway:

        It is otherwise called as Source NAT as this helps to hide the source IP address of a specific instances when it connects to the internet. NAT Gateway will  precedence over Internet gateway.

 

Azure definition is as follows 'A NAT gateway allows you to connect your private resources in a virtual network to the internet without using public IP addresses. It performs source network address translation (SNAT) for outbound traffic by replacing the private source IP address with a public IP address'

 

     This will only allow traffic from internal resource to the outside internet not the vice versa. NAST gateway can be used for various resources like VM, AKS, Azure Functions, App Services, Data Bricks etc.

 

    NAT gateway is a managed services and can have up to 16 public IP addresses. Each IP can support up to 64000 parallel connections(TCP/UDP). Each NAT gateway resource can support up to 50Gbps of inbound and outbound traffic.

 

    Points to be noted:

            - Each VNET/Subnet can have only one NAT gateway

            - Multiple Subnet can have a single NAT gateway or its own NAT gateway

            - But multiple VNET cannot have a same NAT gateway.

 

DNAT:

    Destination NAT helps to hide the destination address in the Azure. This works closely with Azure Firewall services to control the inbound traffic as well.