Setting up a NAT gateway

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

1. View a description of the CLI create gateway command:

   yc vpc gateway create --help
   

2. Create a gateway in the default folder:

   yc vpc gateway create \
      --name test-gateway
   

3. Get the gateway ID:

   yc vpc gateway list
   

   Command result:

   +----------------------+--------------+-------------+
   |          ID          |     NAME     | DESCRIPTION |
   +----------------------+--------------+-------------+
   | enpkq1v2e7p0******** | test-gateway |             |
   +----------------------+--------------+-------------+
   

4. Create a route table with the gateway as the next hop and the 0.0.0.0/0 destination prefix:

   yc vpc route-table create \
      --name=test-route-table \
      --network-name=<network_name> \
      --route destination=0.0.0.0/0,gateway-id=enpkq1v2e7p0********
   

   Where --network-name is the name of the network you are creating the table in.

5. Associate the table with the subnet:

   yc vpc subnet update <subnet_name> \
      --route-table-name=test-route-table
   

Terraform allows you to quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. Configuration files store the infrastructure description in the HashiCorp Configuration Language (HCL). Terraform and its providers are distributed under the Business Source License.

For more information about the provider resources, see the documentation on the Terraform website or the mirror.

If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

If you don't have Terraform, install it and configure the Yandex Cloud provider.

To create a NAT gateway, specify it as the next hop in the route table, and link the table to the subnet, use the following configuration:

data "yandex_vpc_network" "net" {
  folder_id = "<folder_ID>"
  name      = "<network_name>"
}

resource "yandex_vpc_subnet" "subnet" {
  folder_id      = "<folder_ID>"
  name           = "<subnet_name>"
  v4_cidr_blocks = ["10.20.30.0/24"]
  zone           = "ru-central1-a"
  network_id     = data.yandex_vpc_network.net.id
  route_table_id = yandex_vpc_route_table.rt.id
}

resource "yandex_vpc_gateway" "nat_gateway" {
  folder_id      = "<folder_ID>"
  name = "test-gateway"
  shared_egress_gateway {}
}

resource "yandex_vpc_route_table" "rt" {
  folder_id      = "<folder_ID>"
  name       = "test-route-table"
  network_id = "<network_ID>"

  static_route {
    destination_prefix = "0.0.0.0/0"
    gateway_id         = yandex_vpc_gateway.nat_gateway.id
  }
}

Where folder_id is the ID of the folder hosting the subnet.

1. Create a NAT gateway. Use the create REST API method for the Gateway resource or the GatewayService/Create gRPC API call, and provide the following in the request:

   • ID of the folder the gateway will reside in, in the folderId parameter.

   • Gateaway name in the name parameter. The name format is as follows:

     • The name must be from 3 to 63 characters long.
     • It may contain lowercase Latin letters, numbers, and hyphens.
     • The first character must be a letter and the last character cannot be a hyphen.

2. Link the NAT gateway to the new routing table. For this, use the create REST API method for the RouteTable resource or the RouteTableService/Create gRPC API call, and provide the following in the request:

   • ID of the folder the route table will reside in, in the folderId parameter.

   • Route table name in the name parameter. The name format is as follows:

     • The name must be from 3 to 63 characters long.
     • It may contain lowercase Latin letters, numbers, and hyphens.
     • The first character must be a letter and the last character cannot be a hyphen.

   • ID of the network the route table will reside in, in the networkId parameter.

   • 0.0.0.0/0 as the destination subnet prefix, in the staticRoutes[].destinationPrefix parameter.

   • NAT gateway name in the staticRoutes[].gatewayId parameter.

     To get the NAT gateway ID, use the list REST API method for the Gateway resource or the GatewayService/List gRPC API call. In your request, provide the folder ID in the folderId parameter.

3. Link the route table to the subnet. For this, use the update REST API method for the Subnet resource or the SubnetService/Update gRPC API call, and provide the following in the request:

   • Network ID in the subnetId parameter.

     To get the subnet ID, use the list REST API method for the Subnet resource or the SubnetService/List gRPC API call and provide the folder ID in the folderId request parameter.

     To learn how to find out the folder ID, see Getting the folder ID.

   • Route table ID in the routeTableId parameter.

   • The name of the routeTableId parameter in the updateMask parameter.

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the updateMask parameter as a single comma-separated string.